{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f1869805cae5cc4d", "name": "Possibly dead Python function: compute_fibonacci_levels", "shortDescription": {"text": "Possibly dead Python function: compute_fibonacci_levels"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c7d7c22945fdd71", "name": "Possibly dead Python function: stable_rng", "shortDescription": {"text": "Possibly dead Python function: stable_rng"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae0d3e2acf8c781f", "name": "Possibly dead Python function: fetch_sector_indices", "shortDescription": {"text": "Possibly dead Python function: fetch_sector_indices"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98f2e0fb03c2196e", "name": "Possibly dead Python function: generate_fernet_key", "shortDescription": {"text": "Possibly dead Python function: generate_fernet_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b07d3872b46d7a", "name": "Possibly dead Python function: cancel_order", "shortDescription": {"text": "Possibly dead Python function: cancel_order"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23836d69ce6c832c", "name": "Insecure pattern 'cors_wildcard' in backend/server.py:52", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in backend/server.py:52"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a6d89ed8693e58c", "name": "Insecure pattern 'tls_verify_false' in backend/broker/tms_client.py:80", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in backend/broker/tms_client.py:80"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8b82b9bdc58d82b", "name": "Insecure pattern 'local_storage_auth_token' in src/lib/auth-context.tsx:49", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in src/lib/auth-context.tsx:49"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb22617cdecae921", "name": "Very large file: backend/nepse_fetcher.py (1447 lines)", "shortDescription": {"text": "Very large file: backend/nepse_fetcher.py (1447 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 71 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 23 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 17 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-096cb35ce578e0db", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/colab_continuous_train.py:46", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/colab_continuous_train.py:46"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-341d234de8b7d20b", "name": "Commented-code block (7 lines) in backend/__init__.py:7", "shortDescription": {"text": "Commented-code block (7 lines) in backend/__init__.py:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5753c4df88c8f006", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/api-client.ts:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/api-client.ts:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/nepse_fetcher.py:fetch_today_prices, backend/nepse_fetcher.py:fetch_today_prices, backend/nepse_fetcher.py:fetch_today_prices\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/nepse_fetcher.py:fetch_nepse_index_history, backend/nepse_fetcher.py:fetch_nepse_index_history\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/autonomous/models.py:train, backend/autonomous/models.py:train, backend/autonomous/models.py:train, backend/autonomous/models.py:train\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/autonomous/models.py:predict_frame, backend/autonomous/models.py:predict_frame, backend/autonomous/models.py:predict_frame, backend/autonomous/models.py:predict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/autonomous/models.py:predict_latest, backend/autonomous/models.py:predict_latest, backend/autonomous/models.py:predict_latest, backend/autonomous/models.py:predict_latest\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9abbe53fa8c10e4", "name": "FastAPI POST `autonomous_refresh_signals` without auth dependency \u2014 backend/autonomous/api.py:57", "shortDescription": {"text": "FastAPI POST `autonomous_refresh_signals` without auth dependency \u2014 backend/autonomous/api.py:57"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f28ed65f4dc6e398", "name": "FastAPI POST `autonomous_run_ingestion` without auth dependency \u2014 backend/autonomous/api.py:89", "shortDescription": {"text": "FastAPI POST `autonomous_run_ingestion` without auth dependency \u2014 backend/autonomous/api.py:89"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21a2ee5df9cbf4d8", "name": "FastAPI POST `autonomous_build_training_dataset` without auth dependency \u2014 backend/autonomous/api.py:94", "shortDescription": {"text": "FastAPI POST `autonomous_build_training_dataset` without auth dependency \u2014 backend/autonomous/api.py:94"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f3ce43f6431c10b7", "name": "FastAPI POST `autonomous_run_training` without auth dependency \u2014 backend/autonomous/api.py:112", "shortDescription": {"text": "FastAPI POST `autonomous_run_training` without auth dependency \u2014 backend/autonomous/api.py:112"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-30ba544e5ddc77ee", "name": "FastAPI POST `autonomous_evaluate_outcomes` without auth dependency \u2014 backend/autonomous/api.py:117", "shortDescription": {"text": "FastAPI POST `autonomous_evaluate_outcomes` without auth dependency \u2014 backend/autonomous/api.py:117"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a905096ee45cbee", "name": "FastAPI POST `trader_run_cycle` without auth dependency \u2014 backend/autonomous/api.py:146", "shortDescription": {"text": "FastAPI POST `trader_run_cycle` without auth dependency \u2014 backend/autonomous/api.py:146"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a33cd4c4a40e3726", "name": "FastAPI POST `trader_connect_broker` without auth dependency \u2014 backend/autonomous/api.py:168", "shortDescription": {"text": "FastAPI POST `trader_connect_broker` without auth dependency \u2014 backend/autonomous/api.py:168"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8536fa90fdc8631a", "name": "FastAPI POST `trader_force_exit` without auth dependency \u2014 backend/autonomous/api.py:242", "shortDescription": {"text": "FastAPI POST `trader_force_exit` without auth dependency \u2014 backend/autonomous/api.py:242"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d56702805b77d7b3", "name": "FastAPI POST `trader_manual_trade` without auth dependency \u2014 backend/autonomous/api.py:254", "shortDescription": {"text": "FastAPI POST `trader_manual_trade` without auth dependency \u2014 backend/autonomous/api.py:254"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbe2b451b1d8e5f0", "name": "Dangling fetch: POST /api/broker/meroshare/connect (src/lib/broker-client.ts:71)", "shortDescription": {"text": "Dangling fetch: POST /api/broker/meroshare/connect (src/lib/broker-client.ts:71)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:71` calls `POST /api/broker/meroshare/connect` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/meroshare/connect`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ed0c191a337d5ed", "name": "Dangling fetch: GET /api/broker/meroshare/status (src/lib/broker-client.ts:78)", "shortDescription": {"text": "Dangling fetch: GET /api/broker/meroshare/status (src/lib/broker-client.ts:78)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:78` calls `GET /api/broker/meroshare/status` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/meroshare/status`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e9704415796edf96", "name": "Dangling fetch: GET /api/broker/meroshare/portfolio (src/lib/broker-client.ts:82)", "shortDescription": {"text": "Dangling fetch: GET /api/broker/meroshare/portfolio (src/lib/broker-client.ts:82)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:82` calls `GET /api/broker/meroshare/portfolio` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/meroshare/portfolio`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73d54294c4b358c8", "name": "Dangling fetch: DELETE /api/broker/meroshare (src/lib/broker-client.ts:86)", "shortDescription": {"text": "Dangling fetch: DELETE /api/broker/meroshare (src/lib/broker-client.ts:86)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:86` calls `DELETE /api/broker/meroshare` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/meroshare`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f4cabcef880f985c", "name": "Dangling fetch: POST /api/broker/tms/connect (src/lib/broker-client.ts:99)", "shortDescription": {"text": "Dangling fetch: POST /api/broker/tms/connect (src/lib/broker-client.ts:99)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:99` calls `POST /api/broker/tms/connect` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/tms/connect`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-018d60d312fe0132", "name": "Dangling fetch: GET /api/broker/tms/status (src/lib/broker-client.ts:106)", "shortDescription": {"text": "Dangling fetch: GET /api/broker/tms/status (src/lib/broker-client.ts:106)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:106` calls `GET /api/broker/tms/status` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/tms/status`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78dbdc513063a066", "name": "Dangling fetch: GET /api/broker/tms/portfolio (src/lib/broker-client.ts:110)", "shortDescription": {"text": "Dangling fetch: GET /api/broker/tms/portfolio (src/lib/broker-client.ts:110)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:110` calls `GET /api/broker/tms/portfolio` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/tms/portfolio`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1cd1e383c2bf07d5", "name": "Dangling fetch: DELETE /api/broker/tms (src/lib/broker-client.ts:114)", "shortDescription": {"text": "Dangling fetch: DELETE /api/broker/tms (src/lib/broker-client.ts:114)"}, "fullDescription": {"text": "`src/lib/broker-client.ts:114` calls `DELETE /api/broker/tms` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/broker/tms`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee4aa5ddab88c9dc", "name": "Unused endpoint: GET /api/auth/me", "shortDescription": {"text": "Unused endpoint: GET /api/auth/me"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5a39262ac205120", "name": "Unused endpoint: POST /api/auth/logout", "shortDescription": {"text": "Unused endpoint: POST /api/auth/logout"}, "fullDescription": {"text": "`backend/server.py` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64e13c1c9db0e996", "name": "Unused endpoint: GET /api/market", "shortDescription": {"text": "Unused endpoint: GET /api/market"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b77d1b6dcf40b239", "name": "Unused endpoint: GET /api/market/nepse-index", "shortDescription": {"text": "Unused endpoint: GET /api/market/nepse-index"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market/nepse-index` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8427a83f1dad9ec", "name": "Unused endpoint: GET /api/market/regime", "shortDescription": {"text": "Unused endpoint: GET /api/market/regime"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market/regime` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de5db7dcb38ec1dc", "name": "Unused endpoint: GET /api/market/intelligence", "shortDescription": {"text": "Unused endpoint: GET /api/market/intelligence"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market/intelligence` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c02b177d624667c", "name": "Unused endpoint: GET /api/market/index-history", "shortDescription": {"text": "Unused endpoint: GET /api/market/index-history"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market/index-history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55915c1546c5a4be", "name": "Unused endpoint: GET /api/market/index-analysis", "shortDescription": {"text": "Unused endpoint: GET /api/market/index-analysis"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market/index-analysis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92da417639cb07e6", "name": "Unused endpoint: GET /api/market/sectors", "shortDescription": {"text": "Unused endpoint: GET /api/market/sectors"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/market/sectors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e1face0a0dde5e7", "name": "Unused endpoint: GET /api/stocks", "shortDescription": {"text": "Unused endpoint: GET /api/stocks"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/stocks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ffdbd2b9b1f0416", "name": "Unused endpoint: GET /api/stocks/{symbol}", "shortDescription": {"text": "Unused endpoint: GET /api/stocks/{symbol}"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/stocks/{symbol}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d573aac008b3d10", "name": "Unused endpoint: GET /api/stocks/{symbol}/history", "shortDescription": {"text": "Unused endpoint: GET /api/stocks/{symbol}/history"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/stocks/{symbol}/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fbe7063671b5f86", "name": "Unused endpoint: GET /api/predictions/daily", "shortDescription": {"text": "Unused endpoint: GET /api/predictions/daily"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/predictions/daily` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c6788841e6be4ab", "name": "Unused endpoint: GET /api/predictions/weekly", "shortDescription": {"text": "Unused endpoint: GET /api/predictions/weekly"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/predictions/weekly` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb7e2be88469fb4b", "name": "Unused endpoint: GET /api/predictions/monthly", "shortDescription": {"text": "Unused endpoint: GET /api/predictions/monthly"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/predictions/monthly` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be7805c54200a988", "name": "Unused endpoint: GET /api/portfolio", "shortDescription": {"text": "Unused endpoint: GET /api/portfolio"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/portfolio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d04cc0c89a61dc8", "name": "Unused endpoint: GET /api/live/stocks", "shortDescription": {"text": "Unused endpoint: GET /api/live/stocks"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/live/stocks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ae4bf38a74ad8a4", "name": "Unused endpoint: GET /api/live/market", "shortDescription": {"text": "Unused endpoint: GET /api/live/market"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/live/market` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1642d5af8631c0d5", "name": "Unused endpoint: GET /api/ai/predictions", "shortDescription": {"text": "Unused endpoint: GET /api/ai/predictions"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/ai/predictions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b311f76f746e281", "name": "Unused endpoint: GET /api/ai/prediction/{symbol}", "shortDescription": {"text": "Unused endpoint: GET /api/ai/prediction/{symbol}"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/ai/prediction/{symbol}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85926ae13ce6e2f8", "name": "Unused endpoint: GET /api/ai/feature-importance", "shortDescription": {"text": "Unused endpoint: GET /api/ai/feature-importance"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/ai/feature-importance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e3910c36e173fb9", "name": "Unused endpoint: GET /api/ai/model-metrics", "shortDescription": {"text": "Unused endpoint: GET /api/ai/model-metrics"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/ai/model-metrics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`backend/server.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d504b80adc9409ec", "name": "Unused endpoint: GET /dashboard", "shortDescription": {"text": "Unused endpoint: GET /dashboard"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c45b14190c8385b", "name": "Unused endpoint: GET /signals", "shortDescription": {"text": "Unused endpoint: GET /signals"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /signals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a94ff7d3a33775a", "name": "Unused endpoint: POST /signals/refresh", "shortDescription": {"text": "Unused endpoint: POST /signals/refresh"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /signals/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-772e896666cb028d", "name": "Unused endpoint: GET /signals/refresh/status", "shortDescription": {"text": "Unused endpoint: GET /signals/refresh/status"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /signals/refresh/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27208d085ea43354", "name": "Unused endpoint: GET /signals/{symbol}", "shortDescription": {"text": "Unused endpoint: GET /signals/{symbol}"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /signals/{symbol}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e674e69292f924d3", "name": "Unused endpoint: GET /system/status", "shortDescription": {"text": "Unused endpoint: GET /system/status"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /system/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cef245becc98bc3d", "name": "Unused endpoint: GET /backtests/latest", "shortDescription": {"text": "Unused endpoint: GET /backtests/latest"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /backtests/latest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c329a12c06dc4859", "name": "Unused endpoint: POST /ingestion/run", "shortDescription": {"text": "Unused endpoint: POST /ingestion/run"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /ingestion/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc7a2485eb01cf96", "name": "Unused endpoint: POST /datasets/build", "shortDescription": {"text": "Unused endpoint: POST /datasets/build"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /datasets/build` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c12626ea282c864", "name": "Unused endpoint: POST /training/run", "shortDescription": {"text": "Unused endpoint: POST /training/run"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /training/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-538768e1044dd8c1", "name": "Unused endpoint: POST /outcomes/evaluate", "shortDescription": {"text": "Unused endpoint: POST /outcomes/evaluate"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /outcomes/evaluate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-603bc560821915d5", "name": "Unused endpoint: GET /trader/status", "shortDescription": {"text": "Unused endpoint: GET /trader/status"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /trader/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1af904053f66aa37", "name": "Unused endpoint: GET /trader/recommendations", "shortDescription": {"text": "Unused endpoint: GET /trader/recommendations"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /trader/recommendations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bf9be36250d38f6", "name": "Unused endpoint: POST /trader/run", "shortDescription": {"text": "Unused endpoint: POST /trader/run"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /trader/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2637ed97547996c4", "name": "Unused endpoint: POST /trader/connect", "shortDescription": {"text": "Unused endpoint: POST /trader/connect"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /trader/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00579e5796290ee7", "name": "Unused endpoint: GET /trader/portfolio", "shortDescription": {"text": "Unused endpoint: GET /trader/portfolio"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /trader/portfolio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3264960afd519b65", "name": "Unused endpoint: GET /trader/positions", "shortDescription": {"text": "Unused endpoint: GET /trader/positions"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /trader/positions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fff67366564b00bb", "name": "Unused endpoint: POST /trader/exit", "shortDescription": {"text": "Unused endpoint: POST /trader/exit"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /trader/exit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a70bff3c7d5249e", "name": "Unused endpoint: POST /trader/manual-trade", "shortDescription": {"text": "Unused endpoint: POST /trader/manual-trade"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `POST /trader/manual-trade` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-492b252d4d7333ac", "name": "Unused endpoint: GET /trader/trades", "shortDescription": {"text": "Unused endpoint: GET /trader/trades"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /trader/trades` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f62d02f8d7eb975b", "name": "Unused endpoint: GET /trader/audit", "shortDescription": {"text": "Unused endpoint: GET /trader/audit"}, "fullDescription": {"text": "`backend/autonomous/api.py` declares `GET /trader/audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f29a7b90d62ef80", "name": "Unused endpoint: POST /meroshare/connect", "shortDescription": {"text": "Unused endpoint: POST /meroshare/connect"}, "fullDescription": {"text": "`backend/broker/api.py` declares `POST /meroshare/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a016f235b7b44250", "name": "Unused endpoint: GET /meroshare/status", "shortDescription": {"text": "Unused endpoint: GET /meroshare/status"}, "fullDescription": {"text": "`backend/broker/api.py` declares `GET /meroshare/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e4cc399b6d7dcc", "name": "Unused endpoint: GET /meroshare/portfolio", "shortDescription": {"text": "Unused endpoint: GET /meroshare/portfolio"}, "fullDescription": {"text": "`backend/broker/api.py` declares `GET /meroshare/portfolio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-016ba399ee704b30", "name": "Unused endpoint: DELETE /meroshare", "shortDescription": {"text": "Unused endpoint: DELETE /meroshare"}, "fullDescription": {"text": "`backend/broker/api.py` declares `DELETE /meroshare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed411bfdcb07cbeb", "name": "Unused endpoint: POST /tms/connect", "shortDescription": {"text": "Unused endpoint: POST /tms/connect"}, "fullDescription": {"text": "`backend/broker/api.py` declares `POST /tms/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a9e9af921b1e8ea", "name": "Unused endpoint: GET /tms/status", "shortDescription": {"text": "Unused endpoint: GET /tms/status"}, "fullDescription": {"text": "`backend/broker/api.py` declares `GET /tms/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20484"}, "properties": {"repository": "sulav1234567/nepse", "repoUrl": "https://github.com/sulav1234567/nepse", "branch": "main"}, "results": [{"ruleId": "scanner-f1869805cae5cc4d", "level": "note", "message": {"text": "Possibly dead Python function: compute_fibonacci_levels"}, "properties": {"repobilityId": "e578da0cb71b94f1", "scanner": "scanner-primary", "fingerprint": "f1869805cae5cc4d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/engine.py:109"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c7d7c22945fdd71", "level": "note", "message": {"text": "Possibly dead Python function: stable_rng"}, "properties": {"repobilityId": "8afc9e438e3a09fe", "scanner": "scanner-primary", "fingerprint": "1c7d7c22945fdd71", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/deterministic.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae0d3e2acf8c781f", "level": "note", "message": {"text": "Possibly dead Python function: fetch_sector_indices"}, "properties": {"repobilityId": "0fcfaaaa4dc50fdc", "scanner": "scanner-primary", "fingerprint": "ae0d3e2acf8c781f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/nepse_fetcher.py:880"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98f2e0fb03c2196e", "level": "note", "message": {"text": "Possibly dead Python function: generate_fernet_key"}, "properties": {"repobilityId": "e722bfad5ce138aa", "scanner": "scanner-primary", "fingerprint": "98f2e0fb03c2196e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/security.py:112"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8b07d3872b46d7a", "level": "note", "message": {"text": "Possibly dead Python function: cancel_order"}, "properties": {"repobilityId": "466246ae9a8d1252", "scanner": "scanner-primary", "fingerprint": "b8b07d3872b46d7a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/broker/tms_client.py:242"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "06b87ac9439092d6", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-23836d69ce6c832c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in backend/server.py:52"}, "properties": {"repobilityId": "ade4cc2906bcbfb9", "scanner": "scanner-primary", "fingerprint": "23836d69ce6c832c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/server.py"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-6a6d89ed8693e58c", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in backend/broker/tms_client.py:80"}, "properties": {"repobilityId": "6d8377e2bc1ffa5f", "scanner": "scanner-primary", "fingerprint": "6a6d89ed8693e58c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/broker/tms_client.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-a8b82b9bdc58d82b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in src/lib/auth-context.tsx:49"}, "properties": {"repobilityId": "dc4be1bc62846243", "scanner": "scanner-primary", "fingerprint": "a8b82b9bdc58d82b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/lib/auth-context.tsx"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-bb22617cdecae921", "level": "note", "message": {"text": "Very large file: backend/nepse_fetcher.py (1447 lines)"}, "properties": {"repobilityId": "913876a585c6560b", "scanner": "scanner-primary", "fingerprint": "bb22617cdecae921", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "9d557524605c9dd0", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ba60fb8815f69009", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2b71c4518db0816f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "56397a19b80684a7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4f255b59e25ce24e", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5492a5378cf5db13", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9a31cc934c60c745", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-096cb35ce578e0db", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/colab_continuous_train.py:46"}, "properties": {"repobilityId": "a3ff7dfc2f2659c3", "scanner": "scanner-primary", "fingerprint": "096cb35ce578e0db", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-341d234de8b7d20b", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/__init__.py:7"}, "properties": {"repobilityId": "e96063a4910516d2", "scanner": "scanner-primary", "fingerprint": "341d234de8b7d20b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5753c4df88c8f006", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/api-client.ts:29"}, "properties": {"repobilityId": "50f3456ac6e73384", "scanner": "scanner-primary", "fingerprint": "5753c4df88c8f006", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "2950f50467a9813e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "a0a1119161826263", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dfb2eaed43c92aec", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "57ae1222852ded4f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "a76f7edc923fa160", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "2e8588df7057705b", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "2c852f71ee2af06a", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "21369ec525e1b119", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "80fe6695166b4a24", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cedf952aff095294", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4b8b1e5fe56bc694", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e9abbe53fa8c10e4", "level": "error", "message": {"text": "FastAPI POST `autonomous_refresh_signals` without auth dependency \u2014 backend/autonomous/api.py:57"}, "properties": {"repobilityId": "7db1391bc0b1225c", "scanner": "scanner-primary", "fingerprint": "e9abbe53fa8c10e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-f28ed65f4dc6e398", "level": "error", "message": {"text": "FastAPI POST `autonomous_run_ingestion` without auth dependency \u2014 backend/autonomous/api.py:89"}, "properties": {"repobilityId": "31229175f3f726d5", "scanner": "scanner-primary", "fingerprint": "f28ed65f4dc6e398", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-21a2ee5df9cbf4d8", "level": "error", "message": {"text": "FastAPI POST `autonomous_build_training_dataset` without auth dependency \u2014 backend/autonomous/api.py:94"}, "properties": {"repobilityId": "451d1abff210522d", "scanner": "scanner-primary", "fingerprint": "21a2ee5df9cbf4d8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-f3ce43f6431c10b7", "level": "error", "message": {"text": "FastAPI POST `autonomous_run_training` without auth dependency \u2014 backend/autonomous/api.py:112"}, "properties": {"repobilityId": "b9c2817edecb04e0", "scanner": "scanner-primary", "fingerprint": "f3ce43f6431c10b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-30ba544e5ddc77ee", "level": "error", "message": {"text": "FastAPI POST `autonomous_evaluate_outcomes` without auth dependency \u2014 backend/autonomous/api.py:117"}, "properties": {"repobilityId": "e656837ad1b94941", "scanner": "scanner-primary", "fingerprint": "30ba544e5ddc77ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-9a905096ee45cbee", "level": "error", "message": {"text": "FastAPI POST `trader_run_cycle` without auth dependency \u2014 backend/autonomous/api.py:146"}, "properties": {"repobilityId": "dd85c7a8202f4395", "scanner": "scanner-primary", "fingerprint": "9a905096ee45cbee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-a33cd4c4a40e3726", "level": "error", "message": {"text": "FastAPI POST `trader_connect_broker` without auth dependency \u2014 backend/autonomous/api.py:168"}, "properties": {"repobilityId": "1dbd3ad3f75fdf62", "scanner": "scanner-primary", "fingerprint": "a33cd4c4a40e3726", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-8536fa90fdc8631a", "level": "error", "message": {"text": "FastAPI POST `trader_force_exit` without auth dependency \u2014 backend/autonomous/api.py:242"}, "properties": {"repobilityId": "6f7b7ff8a685e7ce", "scanner": "scanner-primary", "fingerprint": "8536fa90fdc8631a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 242}}}]}, {"ruleId": "scanner-d56702805b77d7b3", "level": "error", "message": {"text": "FastAPI POST `trader_manual_trade` without auth dependency \u2014 backend/autonomous/api.py:254"}, "properties": {"repobilityId": "27427f614f4cf08c", "scanner": "scanner-primary", "fingerprint": "d56702805b77d7b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/autonomous/api.py"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-cbe2b451b1d8e5f0", "level": "error", "message": {"text": "Dangling fetch: POST /api/broker/meroshare/connect (src/lib/broker-client.ts:71)"}, "properties": {"repobilityId": "ee3f35c4036f29f2", "scanner": "scanner-primary", "fingerprint": "cbe2b451b1d8e5f0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-7ed0c191a337d5ed", "level": "error", "message": {"text": "Dangling fetch: GET /api/broker/meroshare/status (src/lib/broker-client.ts:78)"}, "properties": {"repobilityId": "b0c19106bef488a7", "scanner": "scanner-primary", "fingerprint": "7ed0c191a337d5ed", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e9704415796edf96", "level": "error", "message": {"text": "Dangling fetch: GET /api/broker/meroshare/portfolio (src/lib/broker-client.ts:82)"}, "properties": {"repobilityId": "2fd487e41848d683", "scanner": "scanner-primary", "fingerprint": "e9704415796edf96", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-73d54294c4b358c8", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/broker/meroshare (src/lib/broker-client.ts:86)"}, "properties": {"repobilityId": "90071a4f3b9f786c", "scanner": "scanner-primary", "fingerprint": "73d54294c4b358c8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-f4cabcef880f985c", "level": "error", "message": {"text": "Dangling fetch: POST /api/broker/tms/connect (src/lib/broker-client.ts:99)"}, "properties": {"repobilityId": "513a25ac75483b06", "scanner": "scanner-primary", "fingerprint": "f4cabcef880f985c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-018d60d312fe0132", "level": "error", "message": {"text": "Dangling fetch: GET /api/broker/tms/status (src/lib/broker-client.ts:106)"}, "properties": {"repobilityId": "3966ec2a536ce310", "scanner": "scanner-primary", "fingerprint": "018d60d312fe0132", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-78dbdc513063a066", "level": "error", "message": {"text": "Dangling fetch: GET /api/broker/tms/portfolio (src/lib/broker-client.ts:110)"}, "properties": {"repobilityId": "beea0c6bdb8b5ab6", "scanner": "scanner-primary", "fingerprint": "78dbdc513063a066", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1cd1e383c2bf07d5", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/broker/tms (src/lib/broker-client.ts:114)"}, "properties": {"repobilityId": "0cbf692670ed6db1", "scanner": "scanner-primary", "fingerprint": "1cd1e383c2bf07d5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-ee4aa5ddab88c9dc", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/me"}, "properties": {"repobilityId": "ced03cb5942ff3f4", "scanner": "scanner-primary", "fingerprint": "ee4aa5ddab88c9dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5a39262ac205120", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/logout"}, "properties": {"repobilityId": "7028093b69b5b11d", "scanner": "scanner-primary", "fingerprint": "d5a39262ac205120", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64e13c1c9db0e996", "level": "note", "message": {"text": "Unused endpoint: GET /api/market"}, "properties": {"repobilityId": "b2c8a4aebd6711be", "scanner": "scanner-primary", "fingerprint": "64e13c1c9db0e996", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b77d1b6dcf40b239", "level": "note", "message": {"text": "Unused endpoint: GET /api/market/nepse-index"}, "properties": {"repobilityId": "969c467f1918dad0", "scanner": "scanner-primary", "fingerprint": "b77d1b6dcf40b239", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f8427a83f1dad9ec", "level": "note", "message": {"text": "Unused endpoint: GET /api/market/regime"}, "properties": {"repobilityId": "39c03381fd921a48", "scanner": "scanner-primary", "fingerprint": "f8427a83f1dad9ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-de5db7dcb38ec1dc", "level": "note", "message": {"text": "Unused endpoint: GET /api/market/intelligence"}, "properties": {"repobilityId": "9d3ac84451dcc97a", "scanner": "scanner-primary", "fingerprint": "de5db7dcb38ec1dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c02b177d624667c", "level": "note", "message": {"text": "Unused endpoint: GET /api/market/index-history"}, "properties": {"repobilityId": "b4d31c8f41a6137a", "scanner": "scanner-primary", "fingerprint": "0c02b177d624667c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55915c1546c5a4be", "level": "note", "message": {"text": "Unused endpoint: GET /api/market/index-analysis"}, "properties": {"repobilityId": "1b0db8e94d4c046b", "scanner": "scanner-primary", "fingerprint": "55915c1546c5a4be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92da417639cb07e6", "level": "note", "message": {"text": "Unused endpoint: GET /api/market/sectors"}, "properties": {"repobilityId": "86cb478a92dfa4c7", "scanner": "scanner-primary", "fingerprint": "92da417639cb07e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9e1face0a0dde5e7", "level": "note", "message": {"text": "Unused endpoint: GET /api/stocks"}, "properties": {"repobilityId": "d2449f55759ad1ab", "scanner": "scanner-primary", "fingerprint": "9e1face0a0dde5e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1ffdbd2b9b1f0416", "level": "note", "message": {"text": "Unused endpoint: GET /api/stocks/{symbol}"}, "properties": {"repobilityId": "d773749e72418d07", "scanner": "scanner-primary", "fingerprint": "1ffdbd2b9b1f0416", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4d573aac008b3d10", "level": "note", "message": {"text": "Unused endpoint: GET /api/stocks/{symbol}/history"}, "properties": {"repobilityId": "ab8ac6b657a07cad", "scanner": "scanner-primary", "fingerprint": "4d573aac008b3d10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8fbe7063671b5f86", "level": "note", "message": {"text": "Unused endpoint: GET /api/predictions/daily"}, "properties": {"repobilityId": "b6d07a9db86c6822", "scanner": "scanner-primary", "fingerprint": "8fbe7063671b5f86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c6788841e6be4ab", "level": "note", "message": {"text": "Unused endpoint: GET /api/predictions/weekly"}, "properties": {"repobilityId": "33dec9542f21e23b", "scanner": "scanner-primary", "fingerprint": "4c6788841e6be4ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb7e2be88469fb4b", "level": "note", "message": {"text": "Unused endpoint: GET /api/predictions/monthly"}, "properties": {"repobilityId": "df1e13bf534298ea", "scanner": "scanner-primary", "fingerprint": "cb7e2be88469fb4b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be7805c54200a988", "level": "note", "message": {"text": "Unused endpoint: GET /api/portfolio"}, "properties": {"repobilityId": "51ecb9e49d0c735c", "scanner": "scanner-primary", "fingerprint": "be7805c54200a988", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d04cc0c89a61dc8", "level": "note", "message": {"text": "Unused endpoint: GET /api/live/stocks"}, "properties": {"repobilityId": "a7de0316638c479c", "scanner": "scanner-primary", "fingerprint": "9d04cc0c89a61dc8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ae4bf38a74ad8a4", "level": "note", "message": {"text": "Unused endpoint: GET /api/live/market"}, "properties": {"repobilityId": "716e41ad4ea16419", "scanner": "scanner-primary", "fingerprint": "2ae4bf38a74ad8a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1642d5af8631c0d5", "level": "note", "message": {"text": "Unused endpoint: GET /api/ai/predictions"}, "properties": {"repobilityId": "e1033d9b405934fa", "scanner": "scanner-primary", "fingerprint": "1642d5af8631c0d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b311f76f746e281", "level": "note", "message": {"text": "Unused endpoint: GET /api/ai/prediction/{symbol}"}, "properties": {"repobilityId": "a68cec570355b73c", "scanner": "scanner-primary", "fingerprint": "8b311f76f746e281", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85926ae13ce6e2f8", "level": "note", "message": {"text": "Unused endpoint: GET /api/ai/feature-importance"}, "properties": {"repobilityId": "3f51f57eb28b7de0", "scanner": "scanner-primary", "fingerprint": "85926ae13ce6e2f8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9e3910c36e173fb9", "level": "note", "message": {"text": "Unused endpoint: GET /api/ai/model-metrics"}, "properties": {"repobilityId": "77236d083ec0f5b5", "scanner": "scanner-primary", "fingerprint": "9e3910c36e173fb9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "5a66da359de337dc", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d504b80adc9409ec", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard"}, "properties": {"repobilityId": "b7816cedd998432a", "scanner": "scanner-primary", "fingerprint": "d504b80adc9409ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c45b14190c8385b", "level": "note", "message": {"text": "Unused endpoint: GET /signals"}, "properties": {"repobilityId": "8b83c9fdb88b9a08", "scanner": "scanner-primary", "fingerprint": "6c45b14190c8385b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a94ff7d3a33775a", "level": "note", "message": {"text": "Unused endpoint: POST /signals/refresh"}, "properties": {"repobilityId": "dc5869a5d79e6f5f", "scanner": "scanner-primary", "fingerprint": "2a94ff7d3a33775a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-772e896666cb028d", "level": "note", "message": {"text": "Unused endpoint: GET /signals/refresh/status"}, "properties": {"repobilityId": "ec6e0462bb8a8690", "scanner": "scanner-primary", "fingerprint": "772e896666cb028d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-27208d085ea43354", "level": "note", "message": {"text": "Unused endpoint: GET /signals/{symbol}"}, "properties": {"repobilityId": "163645a89d0531b7", "scanner": "scanner-primary", "fingerprint": "27208d085ea43354", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e674e69292f924d3", "level": "note", "message": {"text": "Unused endpoint: GET /system/status"}, "properties": {"repobilityId": "c0c6e6807860d40f", "scanner": "scanner-primary", "fingerprint": "e674e69292f924d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cef245becc98bc3d", "level": "note", "message": {"text": "Unused endpoint: GET /backtests/latest"}, "properties": {"repobilityId": "d62cc2a8f66925cf", "scanner": "scanner-primary", "fingerprint": "cef245becc98bc3d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c329a12c06dc4859", "level": "note", "message": {"text": "Unused endpoint: POST /ingestion/run"}, "properties": {"repobilityId": "16c40f1c0ffe6a99", "scanner": "scanner-primary", "fingerprint": "c329a12c06dc4859", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc7a2485eb01cf96", "level": "note", "message": {"text": "Unused endpoint: POST /datasets/build"}, "properties": {"repobilityId": "0c9b3cc13d6b99c2", "scanner": "scanner-primary", "fingerprint": "cc7a2485eb01cf96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c12626ea282c864", "level": "note", "message": {"text": "Unused endpoint: POST /training/run"}, "properties": {"repobilityId": "7680c7bcb1ad29f3", "scanner": "scanner-primary", "fingerprint": "7c12626ea282c864", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-538768e1044dd8c1", "level": "note", "message": {"text": "Unused endpoint: POST /outcomes/evaluate"}, "properties": {"repobilityId": "6fe4afcd5c844f52", "scanner": "scanner-primary", "fingerprint": "538768e1044dd8c1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-603bc560821915d5", "level": "note", "message": {"text": "Unused endpoint: GET /trader/status"}, "properties": {"repobilityId": "cdc6cb32002f0f41", "scanner": "scanner-primary", "fingerprint": "603bc560821915d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1af904053f66aa37", "level": "note", "message": {"text": "Unused endpoint: GET /trader/recommendations"}, "properties": {"repobilityId": "0302a34a3cc2429b", "scanner": "scanner-primary", "fingerprint": "1af904053f66aa37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8bf9be36250d38f6", "level": "note", "message": {"text": "Unused endpoint: POST /trader/run"}, "properties": {"repobilityId": "26cdff77ce7317d3", "scanner": "scanner-primary", "fingerprint": "8bf9be36250d38f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2637ed97547996c4", "level": "note", "message": {"text": "Unused endpoint: POST /trader/connect"}, "properties": {"repobilityId": "8d13a5bd11e72180", "scanner": "scanner-primary", "fingerprint": "2637ed97547996c4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00579e5796290ee7", "level": "note", "message": {"text": "Unused endpoint: GET /trader/portfolio"}, "properties": {"repobilityId": "7a45741b03fc4a43", "scanner": "scanner-primary", "fingerprint": "00579e5796290ee7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3264960afd519b65", "level": "note", "message": {"text": "Unused endpoint: GET /trader/positions"}, "properties": {"repobilityId": "0ef5dcb8e767b92d", "scanner": "scanner-primary", "fingerprint": "3264960afd519b65", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fff67366564b00bb", "level": "note", "message": {"text": "Unused endpoint: POST /trader/exit"}, "properties": {"repobilityId": "9efd87c8407c9e76", "scanner": "scanner-primary", "fingerprint": "fff67366564b00bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a70bff3c7d5249e", "level": "note", "message": {"text": "Unused endpoint: POST /trader/manual-trade"}, "properties": {"repobilityId": "0d0a6f9db4964e83", "scanner": "scanner-primary", "fingerprint": "6a70bff3c7d5249e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-492b252d4d7333ac", "level": "note", "message": {"text": "Unused endpoint: GET /trader/trades"}, "properties": {"repobilityId": "91ac2f831a2c61d7", "scanner": "scanner-primary", "fingerprint": "492b252d4d7333ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f62d02f8d7eb975b", "level": "note", "message": {"text": "Unused endpoint: GET /trader/audit"}, "properties": {"repobilityId": "3c7189adc1a3e4a2", "scanner": "scanner-primary", "fingerprint": "f62d02f8d7eb975b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f29a7b90d62ef80", "level": "note", "message": {"text": "Unused endpoint: POST /meroshare/connect"}, "properties": {"repobilityId": "da934481a3c82c00", "scanner": "scanner-primary", "fingerprint": "5f29a7b90d62ef80", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a016f235b7b44250", "level": "note", "message": {"text": "Unused endpoint: GET /meroshare/status"}, "properties": {"repobilityId": "d90fbe8c45592417", "scanner": "scanner-primary", "fingerprint": "a016f235b7b44250", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c9e4cc399b6d7dcc", "level": "note", "message": {"text": "Unused endpoint: GET /meroshare/portfolio"}, "properties": {"repobilityId": "5f488e9365ceba64", "scanner": "scanner-primary", "fingerprint": "c9e4cc399b6d7dcc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-016ba399ee704b30", "level": "note", "message": {"text": "Unused endpoint: DELETE /meroshare"}, "properties": {"repobilityId": "3f6fa1ab8cf427a5", "scanner": "scanner-primary", "fingerprint": "016ba399ee704b30", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed411bfdcb07cbeb", "level": "note", "message": {"text": "Unused endpoint: POST /tms/connect"}, "properties": {"repobilityId": "00a2f579aa70afc2", "scanner": "scanner-primary", "fingerprint": "ed411bfdcb07cbeb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a9e9af921b1e8ea", "level": "note", "message": {"text": "Unused endpoint: GET /tms/status"}, "properties": {"repobilityId": "e27e604d3e779249", "scanner": "scanner-primary", "fingerprint": "1a9e9af921b1e8ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}