{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-08491dd2cf518a12", "name": "Possibly dead Python function: html_diff", "shortDescription": {"text": "Possibly dead Python function: html_diff"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-190f8f658c66f60e", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/pages/calc/MarkdownPreview.tsx:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/pages/calc/MarkdownPreview.tsx:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32424a901ee06d8f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/pages/calc/MarkdownPreview.tsx:58", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/pages/calc/MarkdownPreview.tsx:58"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aeed8de66e1c5a00", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/pages/misc/QrCode.tsx:92", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/pages/misc/QrCode.tsx:92"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8987d6d1c30c7202", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccd0ac0980205c05", "name": "Insecure pattern 'weak_hash' in README.md:41", "shortDescription": {"text": "Insecure pattern 'weak_hash' in README.md:41"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cde0dbbcc4d90e1c", "name": "Insecure pattern 'weak_hash' in frontend/src/tools.ts:56", "shortDescription": {"text": "Insecure pattern 'weak_hash' in frontend/src/tools.ts:56"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-caf3bbff63843992", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/src/pages/calc/MarkdownPreview.tsx:58", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/pages/calc/MarkdownPreview.tsx:58"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4e741ed1376efc7", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/src/pages/misc/QrCode.tsx:92", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/pages/misc/QrCode.tsx:92"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b32570a5c0502a90", "name": "Insecure pattern 'weak_hash' in frontend/src/pages/codec/HashTool.tsx:39", "shortDescription": {"text": "Insecure pattern 'weak_hash' in frontend/src/pages/codec/HashTool.tsx:39"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23417bdc5c7219f0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93afed2afb1d3d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bcb27cc7399b3417", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "14 tests / 97 src (ratio 0.14)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 43 placeholder/mock markers across 20 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15600b324da686f3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/api/client.ts:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/api/client.ts:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-feb2d86fa35d35e6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/pages/convert/CurlConverter.tsx:26", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/pages/convert/CurlConverter.tsx:26"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9b9de983cea85c7", "name": "Frontend route `/home` has no Link/navigate to it \u2014 frontend/src/App.tsx", "shortDescription": {"text": "Frontend route `/home` has no Link/navigate to it \u2014 frontend/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-839202c4e515c09a", "name": "Frontend route `/jwt_viewer` has no Link/navigate to it \u2014 frontend/src/App.tsx", "shortDescription": {"text": "Frontend route `/jwt_viewer` has no Link/navigate to it \u2014 frontend/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b3de20aeed11ea6", "name": "Frontend route `/schedule_cron` has no Link/navigate to it \u2014 frontend/src/App.tsx", "shortDescription": {"text": "Frontend route `/schedule_cron` has no Link/navigate to it \u2014 frontend/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e9e26145bc4b79b", "name": "FastAPI POST `lorem` without auth dependency \u2014 backend/app/routers/misc.py:33", "shortDescription": {"text": "FastAPI POST `lorem` without auth dependency \u2014 backend/app/routers/misc.py:33"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c869d6b32a54aaa4", "name": "FastAPI POST `qr` without auth dependency \u2014 backend/app/routers/misc.py:57", "shortDescription": {"text": "FastAPI POST `qr` without auth dependency \u2014 backend/app/routers/misc.py:57"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d49ce1b6ca835938", "name": "FastAPI POST `md_to_pdf` without auth dependency \u2014 backend/app/routers/document.py:13", "shortDescription": {"text": "FastAPI POST `md_to_pdf` without auth dependency \u2014 backend/app/routers/document.py:13"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f5bb52953208dda1", "name": "FastAPI POST `pdf_to_md` without auth dependency \u2014 backend/app/routers/document.py:30", "shortDescription": {"text": "FastAPI POST `pdf_to_md` without auth dependency \u2014 backend/app/routers/document.py:30"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b4b5f296d349ac1", "name": "FastAPI POST `regex_check` without auth dependency \u2014 backend/app/routers/regex_tools.py:21", "shortDescription": {"text": "FastAPI POST `regex_check` without auth dependency \u2014 backend/app/routers/regex_tools.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8a5a69407d4234e8", "name": "FastAPI POST `regex_generate` without auth dependency \u2014 backend/app/routers/regex_tools.py:42", "shortDescription": {"text": "FastAPI POST `regex_generate` without auth dependency \u2014 backend/app/routers/regex_tools.py:42"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a79d734b38695689", "name": "FastAPI POST `preview` without auth dependency \u2014 backend/app/routers/fake_data.py:33", "shortDescription": {"text": "FastAPI POST `preview` without auth dependency \u2014 backend/app/routers/fake_data.py:33"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56fabb952a43e365", "name": "FastAPI POST `export` without auth dependency \u2014 backend/app/routers/fake_data.py:40", "shortDescription": {"text": "FastAPI POST `export` without auth dependency \u2014 backend/app/routers/fake_data.py:40"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52d9dfbc1ac60c1c", "name": "FastAPI POST `diff` without auth dependency \u2014 backend/app/routers/string_tools.py:30", "shortDescription": {"text": "FastAPI POST `diff` without auth dependency \u2014 backend/app/routers/string_tools.py:30"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b0573a84183f013", "name": "FastAPI POST `counter` without auth dependency \u2014 backend/app/routers/string_tools.py:35", "shortDescription": {"text": "FastAPI POST `counter` without auth dependency \u2014 backend/app/routers/string_tools.py:35"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b57898e031008f40", "name": "FastAPI POST `columns` without auth dependency \u2014 backend/app/routers/string_tools.py:52", "shortDescription": {"text": "FastAPI POST `columns` without auth dependency \u2014 backend/app/routers/string_tools.py:52"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f77b59bc37aab593", "name": "FastAPI POST `clean` without auth dependency \u2014 backend/app/routers/string_tools.py:68", "shortDescription": {"text": "FastAPI POST `clean` without auth dependency \u2014 backend/app/routers/string_tools.py:68"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65f25de91d56ad7e", "name": "FastAPI POST `stats` without auth dependency \u2014 backend/app/routers/string_tools.py:77", "shortDescription": {"text": "FastAPI POST `stats` without auth dependency \u2014 backend/app/routers/string_tools.py:77"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e32c82a373ca5986", "name": "FastAPI POST `random_number` without auth dependency \u2014 backend/app/routers/string_tools.py:102", "shortDescription": {"text": "FastAPI POST `random_number` without auth dependency \u2014 backend/app/routers/string_tools.py:102"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce6b88701f4b80f8", "name": "FastAPI POST `random_string` without auth dependency \u2014 backend/app/routers/string_tools.py:110", "shortDescription": {"text": "FastAPI POST `random_string` without auth dependency \u2014 backend/app/routers/string_tools.py:110"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92ad3caf3a541faa", "name": "FastAPI POST `shuffle` without auth dependency \u2014 backend/app/routers/string_tools.py:116", "shortDescription": {"text": "FastAPI POST `shuffle` without auth dependency \u2014 backend/app/routers/string_tools.py:116"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c7588eb6d6dc67f1", "name": "FastAPI POST `base64_endpoint` without auth dependency \u2014 backend/app/routers/encoding.py:11", "shortDescription": {"text": "FastAPI POST `base64_endpoint` without auth dependency \u2014 backend/app/routers/encoding.py:11"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-189b6a8a30a6840a", "name": "FastAPI POST `jwt_endpoint` without auth dependency \u2014 backend/app/routers/encoding.py:21", "shortDescription": {"text": "FastAPI POST `jwt_endpoint` without auth dependency \u2014 backend/app/routers/encoding.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7c3fd048692eaf0", "name": "FastAPI POST `uuid_generate` without auth dependency \u2014 backend/app/routers/codec.py:58", "shortDescription": {"text": "FastAPI POST `uuid_generate` without auth dependency \u2014 backend/app/routers/codec.py:58"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-974fce02869cd23e", "name": "FastAPI POST `uuid_inspect` without auth dependency \u2014 backend/app/routers/codec.py:82", "shortDescription": {"text": "FastAPI POST `uuid_inspect` without auth dependency \u2014 backend/app/routers/codec.py:82"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-878e5d3d0f7d7329", "name": "FastAPI POST `hash_text` without auth dependency \u2014 backend/app/routers/codec.py:115", "shortDescription": {"text": "FastAPI POST `hash_text` without auth dependency \u2014 backend/app/routers/codec.py:115"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2050bbb8b75a3e0", "name": "FastAPI POST `hmac_text` without auth dependency \u2014 backend/app/routers/codec.py:126", "shortDescription": {"text": "FastAPI POST `hmac_text` without auth dependency \u2014 backend/app/routers/codec.py:126"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7534dfb16e3e0b8b", "name": "FastAPI POST `url_codec` without auth dependency \u2014 backend/app/routers/codec.py:136", "shortDescription": {"text": "FastAPI POST `url_codec` without auth dependency \u2014 backend/app/routers/codec.py:136"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22f90a35b72d5855", "name": "FastAPI POST `query_string_parse` without auth dependency \u2014 backend/app/routers/codec.py:148", "shortDescription": {"text": "FastAPI POST `query_string_parse` without auth dependency \u2014 backend/app/routers/codec.py:148"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be14e2a89636a097", "name": "FastAPI POST `case_convert` without auth dependency \u2014 backend/app/routers/codec.py:164", "shortDescription": {"text": "FastAPI POST `case_convert` without auth dependency \u2014 backend/app/routers/codec.py:164"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4829c9e4c66e1207", "name": "FastAPI POST `jwt_sign` without auth dependency \u2014 backend/app/routers/codec.py:169", "shortDescription": {"text": "FastAPI POST `jwt_sign` without auth dependency \u2014 backend/app/routers/codec.py:169"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f8313315ec2b5c20", "name": "FastAPI POST `format_convert` without auth dependency \u2014 backend/app/routers/convert.py:20", "shortDescription": {"text": "FastAPI POST `format_convert` without auth dependency \u2014 backend/app/routers/convert.py:20"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1e149bece556eb0", "name": "FastAPI POST `jsonpath_eval` without auth dependency \u2014 backend/app/routers/convert.py:30", "shortDescription": {"text": "FastAPI POST `jsonpath_eval` without auth dependency \u2014 backend/app/routers/convert.py:30"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ea49ce6998e3490", "name": "FastAPI POST `curl_convert` without auth dependency \u2014 backend/app/routers/convert.py:44", "shortDescription": {"text": "FastAPI POST `curl_convert` without auth dependency \u2014 backend/app/routers/convert.py:44"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a02a92038c86991c", "name": "FastAPI POST `cron_next` without auth dependency \u2014 backend/app/routers/calc.py:35", "shortDescription": {"text": "FastAPI POST `cron_next` without auth dependency \u2014 backend/app/routers/calc.py:35"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3669aed0e5d0029a", "name": "FastAPI POST `color_convert` without auth dependency \u2014 backend/app/routers/calc.py:47", "shortDescription": {"text": "FastAPI POST `color_convert` without auth dependency \u2014 backend/app/routers/calc.py:47"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d39ba7529509947", "name": "FastAPI POST `contrast` without auth dependency \u2014 backend/app/routers/calc.py:63", "shortDescription": {"text": "FastAPI POST `contrast` without auth dependency \u2014 backend/app/routers/calc.py:63"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ec98b17e8ecaf32", "name": "FastAPI POST `chmod` without auth dependency \u2014 backend/app/routers/calc.py:80", "shortDescription": {"text": "FastAPI POST `chmod` without auth dependency \u2014 backend/app/routers/calc.py:80"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-624cb25dc09bc365", "name": "FastAPI POST `cidr` without auth dependency \u2014 backend/app/routers/calc.py:89", "shortDescription": {"text": "FastAPI POST `cidr` without auth dependency \u2014 backend/app/routers/calc.py:89"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6dc60451d0539ac4", "name": "FastAPI POST `markdown_preview` without auth dependency \u2014 backend/app/routers/calc.py:128", "shortDescription": {"text": "FastAPI POST `markdown_preview` without auth dependency \u2014 backend/app/routers/calc.py:128"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d6d41b8f2e22baf", "name": "FastAPI POST `time_convert` without auth dependency \u2014 backend/app/routers/time_tools.py:14", "shortDescription": {"text": "FastAPI POST `time_convert` without auth dependency \u2014 backend/app/routers/time_tools.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e6623ec1939da56", "name": "FastAPI POST `cron` without auth dependency \u2014 backend/app/routers/time_tools.py:22", "shortDescription": {"text": "FastAPI POST `cron` without auth dependency \u2014 backend/app/routers/time_tools.py:22"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-10b530345f53a4dd", "name": "FastAPI POST `validate_json` without auth dependency \u2014 backend/app/routers/json_tools.py:30", "shortDescription": {"text": "FastAPI POST `validate_json` without auth dependency \u2014 backend/app/routers/json_tools.py:30"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c16240b47f79fd41", "name": "FastAPI POST `schema_from_json` without auth dependency \u2014 backend/app/routers/json_tools.py:67", "shortDescription": {"text": "FastAPI POST `schema_from_json` without auth dependency \u2014 backend/app/routers/json_tools.py:67"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a94fe8b2e41361f0", "name": "FastAPI POST `sample_from_schema` without auth dependency \u2014 backend/app/routers/json_tools.py:76", "shortDescription": {"text": "FastAPI POST `sample_from_schema` without auth dependency \u2014 backend/app/routers/json_tools.py:76"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1f194eeb579fbdc6", "name": "FastAPI POST `json_convert` without auth dependency \u2014 backend/app/routers/json_tools.py:91", "shortDescription": {"text": "FastAPI POST `json_convert` without auth dependency \u2014 backend/app/routers/json_tools.py:91"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-89a3a09eb857f243", "name": "FastAPI POST `json_parse` without auth dependency \u2014 backend/app/routers/json_tools.py:112", "shortDescription": {"text": "FastAPI POST `json_parse` without auth dependency \u2014 backend/app/routers/json_tools.py:112"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b1d5926fda286fa", "name": "Unused endpoint: GET /{full_path:path}", "shortDescription": {"text": "Unused endpoint: GET /{full_path:path}"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /{full_path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd3207cf185141b0", "name": "Unused endpoint: GET /http-statuses", "shortDescription": {"text": "Unused endpoint: GET /http-statuses"}, "fullDescription": {"text": "`backend/app/routers/misc.py` declares `GET /http-statuses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5f55a3b39587071", "name": "Unused endpoint: GET /mime-types", "shortDescription": {"text": "Unused endpoint: GET /mime-types"}, "fullDescription": {"text": "`backend/app/routers/misc.py` declares `GET /mime-types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60d742deeae35f2b", "name": "Unused endpoint: POST /lorem", "shortDescription": {"text": "Unused endpoint: POST /lorem"}, "fullDescription": {"text": "`backend/app/routers/misc.py` declares `POST /lorem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5c6154ddfe9f487", "name": "Unused endpoint: POST /qr", "shortDescription": {"text": "Unused endpoint: POST /qr"}, "fullDescription": {"text": "`backend/app/routers/misc.py` declares `POST /qr` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61cd72059c857967", "name": "Unused endpoint: POST /md-to-pdf", "shortDescription": {"text": "Unused endpoint: POST /md-to-pdf"}, "fullDescription": {"text": "`backend/app/routers/document.py` declares `POST /md-to-pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9f2386781f5e4e7", "name": "Unused endpoint: POST /pdf-to-md", "shortDescription": {"text": "Unused endpoint: POST /pdf-to-md"}, "fullDescription": {"text": "`backend/app/routers/document.py` declares `POST /pdf-to-md` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-554ffd052999fac9", "name": "Unused endpoint: POST /check", "shortDescription": {"text": "Unused endpoint: POST /check"}, "fullDescription": {"text": "`backend/app/routers/regex_tools.py` declares `POST /check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-970eb92d6ec2bfaa", "name": "Unused endpoint: POST /generate", "shortDescription": {"text": "Unused endpoint: POST /generate"}, "fullDescription": {"text": "`backend/app/routers/regex_tools.py` declares `POST /generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9630d39f953a327c", "name": "Unused endpoint: GET /types", "shortDescription": {"text": "Unused endpoint: GET /types"}, "fullDescription": {"text": "`backend/app/routers/fake_data.py` declares `GET /types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cccfe89f81ab208f", "name": "Unused endpoint: POST /preview", "shortDescription": {"text": "Unused endpoint: POST /preview"}, "fullDescription": {"text": "`backend/app/routers/fake_data.py` declares `POST /preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7028d9c853d87627", "name": "Unused endpoint: POST /export", "shortDescription": {"text": "Unused endpoint: POST /export"}, "fullDescription": {"text": "`backend/app/routers/fake_data.py` declares `POST /export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03bfe2bb33d2fdbf", "name": "Unused endpoint: POST /diff", "shortDescription": {"text": "Unused endpoint: POST /diff"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /diff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-284873ae98fb3d01", "name": "Unused endpoint: POST /count", "shortDescription": {"text": "Unused endpoint: POST /count"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /count` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7daa5b2cf1ac2e0", "name": "Unused endpoint: POST /columns", "shortDescription": {"text": "Unused endpoint: POST /columns"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /columns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749f55bf99b6439d", "name": "Unused endpoint: POST /clean", "shortDescription": {"text": "Unused endpoint: POST /clean"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /clean` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10fa82f1cb5daafa", "name": "Unused endpoint: POST /stats", "shortDescription": {"text": "Unused endpoint: POST /stats"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-664a88205d8ff9bc", "name": "Unused endpoint: POST /random-number", "shortDescription": {"text": "Unused endpoint: POST /random-number"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /random-number` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a217f54c86fa2e32", "name": "Unused endpoint: POST /random-string", "shortDescription": {"text": "Unused endpoint: POST /random-string"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /random-string` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29b2378921c889d6", "name": "Unused endpoint: POST /shuffle", "shortDescription": {"text": "Unused endpoint: POST /shuffle"}, "fullDescription": {"text": "`backend/app/routers/string_tools.py` declares `POST /shuffle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e85ad5aa7983e09a", "name": "Unused endpoint: POST /base64", "shortDescription": {"text": "Unused endpoint: POST /base64"}, "fullDescription": {"text": "`backend/app/routers/encoding.py` declares `POST /base64` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81ac193e378a2bd1", "name": "Unused endpoint: POST /jwt", "shortDescription": {"text": "Unused endpoint: POST /jwt"}, "fullDescription": {"text": "`backend/app/routers/encoding.py` declares `POST /jwt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee64de12f3cc7c89", "name": "Unused endpoint: POST /uuid/generate", "shortDescription": {"text": "Unused endpoint: POST /uuid/generate"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /uuid/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84a06dc31f23e914", "name": "Unused endpoint: POST /uuid/inspect", "shortDescription": {"text": "Unused endpoint: POST /uuid/inspect"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /uuid/inspect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b1b6390bbb2408a", "name": "Unused endpoint: POST /hash", "shortDescription": {"text": "Unused endpoint: POST /hash"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /hash` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e9b7ef2755701df", "name": "Unused endpoint: POST /hmac", "shortDescription": {"text": "Unused endpoint: POST /hmac"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /hmac` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b1bc1790eb7bfec", "name": "Unused endpoint: POST /url", "shortDescription": {"text": "Unused endpoint: POST /url"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2238766cd00c0260", "name": "Unused endpoint: POST /url/parse", "shortDescription": {"text": "Unused endpoint: POST /url/parse"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /url/parse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2aae7e732f9aa86", "name": "Unused endpoint: POST /case", "shortDescription": {"text": "Unused endpoint: POST /case"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /case` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aee41c2a11cb2bd9", "name": "Unused endpoint: POST /jwt/sign", "shortDescription": {"text": "Unused endpoint: POST /jwt/sign"}, "fullDescription": {"text": "`backend/app/routers/codec.py` declares `POST /jwt/sign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f6f9c277a39ef9d", "name": "Unused endpoint: POST /format", "shortDescription": {"text": "Unused endpoint: POST /format"}, "fullDescription": {"text": "`backend/app/routers/convert.py` declares `POST /format` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5025ad5ecc6e345a", "name": "Unused endpoint: POST /jsonpath", "shortDescription": {"text": "Unused endpoint: POST /jsonpath"}, "fullDescription": {"text": "`backend/app/routers/convert.py` declares `POST /jsonpath` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9190c5f3cc7449a8", "name": "Unused endpoint: POST /curl", "shortDescription": {"text": "Unused endpoint: POST /curl"}, "fullDescription": {"text": "`backend/app/routers/convert.py` declares `POST /curl` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8871251dea0ef2b2", "name": "Unused endpoint: POST /cron-next", "shortDescription": {"text": "Unused endpoint: POST /cron-next"}, "fullDescription": {"text": "`backend/app/routers/calc.py` declares `POST /cron-next` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea765518f2e81593", "name": "Unused endpoint: POST /color", "shortDescription": {"text": "Unused endpoint: POST /color"}, "fullDescription": {"text": "`backend/app/routers/calc.py` declares `POST /color` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3eeb8bfc82ec51f3", "name": "Unused endpoint: POST /contrast", "shortDescription": {"text": "Unused endpoint: POST /contrast"}, "fullDescription": {"text": "`backend/app/routers/calc.py` declares `POST /contrast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c512a3abf8834cc", "name": "Unused endpoint: POST /chmod", "shortDescription": {"text": "Unused endpoint: POST /chmod"}, "fullDescription": {"text": "`backend/app/routers/calc.py` declares `POST /chmod` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c134d45716ab21f0", "name": "Unused endpoint: POST /cidr", "shortDescription": {"text": "Unused endpoint: POST /cidr"}, "fullDescription": {"text": "`backend/app/routers/calc.py` declares `POST /cidr` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74972bb9ebed8ea5", "name": "Unused endpoint: POST /markdown", "shortDescription": {"text": "Unused endpoint: POST /markdown"}, "fullDescription": {"text": "`backend/app/routers/calc.py` declares `POST /markdown` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37583ca7e4c862e2", "name": "Unused endpoint: POST /convert", "shortDescription": {"text": "Unused endpoint: POST /convert"}, "fullDescription": {"text": "`backend/app/routers/time_tools.py` declares `POST /convert` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1044f93bd093823", "name": "Unused endpoint: POST /cron", "shortDescription": {"text": "Unused endpoint: POST /cron"}, "fullDescription": {"text": "`backend/app/routers/time_tools.py` declares `POST /cron` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34c0472a1f1fafe5", "name": "Unused endpoint: POST /validate", "shortDescription": {"text": "Unused endpoint: POST /validate"}, "fullDescription": {"text": "`backend/app/routers/json_tools.py` declares `POST /validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbdd4638010f5cb5", "name": "Unused endpoint: POST /schema", "shortDescription": {"text": "Unused endpoint: POST /schema"}, "fullDescription": {"text": "`backend/app/routers/json_tools.py` declares `POST /schema` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fca3f0b64c781eed", "name": "Unused endpoint: POST /sample", "shortDescription": {"text": "Unused endpoint: POST /sample"}, "fullDescription": {"text": "`backend/app/routers/json_tools.py` declares `POST /sample` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21d4e3431aa9b5dc", "name": "Unused endpoint: POST /parse", "shortDescription": {"text": "Unused endpoint: POST /parse"}, "fullDescription": {"text": "`backend/app/routers/json_tools.py` declares `POST /parse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22179"}, "properties": {"repository": "vib795/everyday-developer-tools", "repoUrl": "https://github.com/vib795/everyday-developer-tools", "branch": "main"}, "results": [{"ruleId": "scanner-08491dd2cf518a12", "level": "note", "message": {"text": "Possibly dead Python function: html_diff"}, "properties": {"repobilityId": "4cee1be0f3cbfe2f", "scanner": "scanner-primary", "fingerprint": "08491dd2cf518a12", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/diff.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-190f8f658c66f60e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/pages/calc/MarkdownPreview.tsx:15"}, "properties": {"repobilityId": "28dbcf896240fdc1", "scanner": "scanner-primary", "fingerprint": "190f8f658c66f60e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-32424a901ee06d8f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/pages/calc/MarkdownPreview.tsx:58"}, "properties": {"repobilityId": "122c28fe6bd6afbf", "scanner": "scanner-primary", "fingerprint": "32424a901ee06d8f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-aeed8de66e1c5a00", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/pages/misc/QrCode.tsx:92"}, "properties": {"repobilityId": "8dfbca2cc7f97627", "scanner": "scanner-primary", "fingerprint": "aeed8de66e1c5a00", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-8987d6d1c30c7202", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "068fbf45727eac17", "scanner": "scanner-primary", "fingerprint": "8987d6d1c30c7202", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "3b0af0f097bb17ef", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-ccd0ac0980205c05", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in README.md:41"}, "properties": {"repobilityId": "5388562008acceec", "scanner": "scanner-primary", "fingerprint": "ccd0ac0980205c05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-cde0dbbcc4d90e1c", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in frontend/src/tools.ts:56"}, "properties": {"repobilityId": "082c5e4252aa1c7c", "scanner": "scanner-primary", "fingerprint": "cde0dbbcc4d90e1c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/tools.ts"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-caf3bbff63843992", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/pages/calc/MarkdownPreview.tsx:58"}, "properties": {"repobilityId": "7880fbfa16f8093a", "scanner": "scanner-primary", "fingerprint": "caf3bbff63843992", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/calc/MarkdownPreview.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-a4e741ed1376efc7", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/pages/misc/QrCode.tsx:92"}, "properties": {"repobilityId": "72596b85633494fb", "scanner": "scanner-primary", "fingerprint": "a4e741ed1376efc7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/misc/QrCode.tsx"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-b32570a5c0502a90", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in frontend/src/pages/codec/HashTool.tsx:39"}, "properties": {"repobilityId": "b70922382a602cfb", "scanner": "scanner-primary", "fingerprint": "b32570a5c0502a90", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/codec/HashTool.tsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-23417bdc5c7219f0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a833c344243e4150", "scanner": "scanner-primary", "fingerprint": "23417bdc5c7219f0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-package.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-23417bdc5c7219f0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56a6d65fdaf20435", "scanner": "scanner-primary", "fingerprint": "23417bdc5c7219f0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-package.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-23417bdc5c7219f0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38da1791907e2ba4", "scanner": "scanner-primary", "fingerprint": "23417bdc5c7219f0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-package.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-93afed2afb1d3d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c9dc38618b6f046c", "scanner": "scanner-primary", "fingerprint": "93afed2afb1d3d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-image.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-bcb27cc7399b3417", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "736649e50f9ac2c0", "scanner": "scanner-primary", "fingerprint": "bcb27cc7399b3417", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/vulnerability-check.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-bcb27cc7399b3417", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bda4b263cf73c4aa", "scanner": "scanner-primary", "fingerprint": "bcb27cc7399b3417", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/vulnerability-check.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-bcb27cc7399b3417", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "736649e50f9ac2c0", "scanner": "scanner-primary", "fingerprint": "bcb27cc7399b3417", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/vulnerability-check.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f50aaba580a3e734", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "cd23e5ed0301a2c9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c32879721a4c9735", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d648442810d411cd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-15600b324da686f3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/api/client.ts:38"}, "properties": {"repobilityId": "e17853bd009a76a8", "scanner": "scanner-primary", "fingerprint": "15600b324da686f3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-feb2d86fa35d35e6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/pages/convert/CurlConverter.tsx:26"}, "properties": {"repobilityId": "a90729da632171ae", "scanner": "scanner-primary", "fingerprint": "feb2d86fa35d35e6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c9b9de983cea85c7", "level": "warning", "message": {"text": "Frontend route `/home` has no Link/navigate to it \u2014 frontend/src/App.tsx"}, "properties": {"repobilityId": "0e8a1992f1c1fea1", "scanner": "scanner-primary", "fingerprint": "c9b9de983cea85c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-839202c4e515c09a", "level": "warning", "message": {"text": "Frontend route `/jwt_viewer` has no Link/navigate to it \u2014 frontend/src/App.tsx"}, "properties": {"repobilityId": "d2f32cf46c307e15", "scanner": "scanner-primary", "fingerprint": "839202c4e515c09a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6b3de20aeed11ea6", "level": "warning", "message": {"text": "Frontend route `/schedule_cron` has no Link/navigate to it \u2014 frontend/src/App.tsx"}, "properties": {"repobilityId": "90709786c9b786b2", "scanner": "scanner-primary", "fingerprint": "6b3de20aeed11ea6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-0e9e26145bc4b79b", "level": "error", "message": {"text": "FastAPI POST `lorem` without auth dependency \u2014 backend/app/routers/misc.py:33"}, "properties": {"repobilityId": "b9fad664cac8e00c", "scanner": "scanner-primary", "fingerprint": "0e9e26145bc4b79b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/misc.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-c869d6b32a54aaa4", "level": "error", "message": {"text": "FastAPI POST `qr` without auth dependency \u2014 backend/app/routers/misc.py:57"}, "properties": {"repobilityId": "b360558906735cb5", "scanner": "scanner-primary", "fingerprint": "c869d6b32a54aaa4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/misc.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-d49ce1b6ca835938", "level": "error", "message": {"text": "FastAPI POST `md_to_pdf` without auth dependency \u2014 backend/app/routers/document.py:13"}, "properties": {"repobilityId": "38751f0a3b0f86d7", "scanner": "scanner-primary", "fingerprint": "d49ce1b6ca835938", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/document.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-f5bb52953208dda1", "level": "error", "message": {"text": "FastAPI POST `pdf_to_md` without auth dependency \u2014 backend/app/routers/document.py:30"}, "properties": {"repobilityId": "6e861c426d453a7a", "scanner": "scanner-primary", "fingerprint": "f5bb52953208dda1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/document.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-9b4b5f296d349ac1", "level": "error", "message": {"text": "FastAPI POST `regex_check` without auth dependency \u2014 backend/app/routers/regex_tools.py:21"}, "properties": {"repobilityId": "690e88bc733e8e77", "scanner": "scanner-primary", "fingerprint": "9b4b5f296d349ac1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/regex_tools.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-8a5a69407d4234e8", "level": "error", "message": {"text": "FastAPI POST `regex_generate` without auth dependency \u2014 backend/app/routers/regex_tools.py:42"}, "properties": {"repobilityId": "5c90e275d125feb3", "scanner": "scanner-primary", "fingerprint": "8a5a69407d4234e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/regex_tools.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-a79d734b38695689", "level": "error", "message": {"text": "FastAPI POST `preview` without auth dependency \u2014 backend/app/routers/fake_data.py:33"}, "properties": {"repobilityId": "066592f2e7ab52d0", "scanner": "scanner-primary", "fingerprint": "a79d734b38695689", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/fake_data.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-56fabb952a43e365", "level": "error", "message": {"text": "FastAPI POST `export` without auth dependency \u2014 backend/app/routers/fake_data.py:40"}, "properties": {"repobilityId": "74a4f71963e2d6ac", "scanner": "scanner-primary", "fingerprint": "56fabb952a43e365", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/fake_data.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-52d9dfbc1ac60c1c", "level": "error", "message": {"text": "FastAPI POST `diff` without auth dependency \u2014 backend/app/routers/string_tools.py:30"}, "properties": {"repobilityId": "54a527521abb9b75", "scanner": "scanner-primary", "fingerprint": "52d9dfbc1ac60c1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-5b0573a84183f013", "level": "error", "message": {"text": "FastAPI POST `counter` without auth dependency \u2014 backend/app/routers/string_tools.py:35"}, "properties": {"repobilityId": "6a164084d749018e", "scanner": "scanner-primary", "fingerprint": "5b0573a84183f013", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-b57898e031008f40", "level": "error", "message": {"text": "FastAPI POST `columns` without auth dependency \u2014 backend/app/routers/string_tools.py:52"}, "properties": {"repobilityId": "20f50410bab785bc", "scanner": "scanner-primary", "fingerprint": "b57898e031008f40", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-f77b59bc37aab593", "level": "error", "message": {"text": "FastAPI POST `clean` without auth dependency \u2014 backend/app/routers/string_tools.py:68"}, "properties": {"repobilityId": "300aca196ffdbc86", "scanner": "scanner-primary", "fingerprint": "f77b59bc37aab593", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-65f25de91d56ad7e", "level": "error", "message": {"text": "FastAPI POST `stats` without auth dependency \u2014 backend/app/routers/string_tools.py:77"}, "properties": {"repobilityId": "505bb5db1d63e91e", "scanner": "scanner-primary", "fingerprint": "65f25de91d56ad7e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-e32c82a373ca5986", "level": "error", "message": {"text": "FastAPI POST `random_number` without auth dependency \u2014 backend/app/routers/string_tools.py:102"}, "properties": {"repobilityId": "0febd7322e82d03b", "scanner": "scanner-primary", "fingerprint": "e32c82a373ca5986", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-ce6b88701f4b80f8", "level": "error", "message": {"text": "FastAPI POST `random_string` without auth dependency \u2014 backend/app/routers/string_tools.py:110"}, "properties": {"repobilityId": "f46095e32048f69d", "scanner": "scanner-primary", "fingerprint": "ce6b88701f4b80f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-92ad3caf3a541faa", "level": "error", "message": {"text": "FastAPI POST `shuffle` without auth dependency \u2014 backend/app/routers/string_tools.py:116"}, "properties": {"repobilityId": "1801b471669d4708", "scanner": "scanner-primary", "fingerprint": "92ad3caf3a541faa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/string_tools.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-c7588eb6d6dc67f1", "level": "error", "message": {"text": "FastAPI POST `base64_endpoint` without auth dependency \u2014 backend/app/routers/encoding.py:11"}, "properties": {"repobilityId": "1eb66021586cbc62", "scanner": "scanner-primary", "fingerprint": "c7588eb6d6dc67f1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/encoding.py"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-189b6a8a30a6840a", "level": "error", "message": {"text": "FastAPI POST `jwt_endpoint` without auth dependency \u2014 backend/app/routers/encoding.py:21"}, "properties": {"repobilityId": "6e98948d898e9a99", "scanner": "scanner-primary", "fingerprint": "189b6a8a30a6840a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/encoding.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-d7c3fd048692eaf0", "level": "error", "message": {"text": "FastAPI POST `uuid_generate` without auth dependency \u2014 backend/app/routers/codec.py:58"}, "properties": {"repobilityId": "c6317739a2e5b63b", "scanner": "scanner-primary", "fingerprint": "d7c3fd048692eaf0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-974fce02869cd23e", "level": "error", "message": {"text": "FastAPI POST `uuid_inspect` without auth dependency \u2014 backend/app/routers/codec.py:82"}, "properties": {"repobilityId": "0c1be00d150e3716", "scanner": "scanner-primary", "fingerprint": "974fce02869cd23e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-878e5d3d0f7d7329", "level": "error", "message": {"text": "FastAPI POST `hash_text` without auth dependency \u2014 backend/app/routers/codec.py:115"}, "properties": {"repobilityId": "e0097f69bf0bba9d", "scanner": "scanner-primary", "fingerprint": "878e5d3d0f7d7329", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-c2050bbb8b75a3e0", "level": "error", "message": {"text": "FastAPI POST `hmac_text` without auth dependency \u2014 backend/app/routers/codec.py:126"}, "properties": {"repobilityId": "aa947446df3b2486", "scanner": "scanner-primary", "fingerprint": "c2050bbb8b75a3e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-7534dfb16e3e0b8b", "level": "error", "message": {"text": "FastAPI POST `url_codec` without auth dependency \u2014 backend/app/routers/codec.py:136"}, "properties": {"repobilityId": "5422c97e10a5d8d8", "scanner": "scanner-primary", "fingerprint": "7534dfb16e3e0b8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-22f90a35b72d5855", "level": "error", "message": {"text": "FastAPI POST `query_string_parse` without auth dependency \u2014 backend/app/routers/codec.py:148"}, "properties": {"repobilityId": "741266b750075ec9", "scanner": "scanner-primary", "fingerprint": "22f90a35b72d5855", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-be14e2a89636a097", "level": "error", "message": {"text": "FastAPI POST `case_convert` without auth dependency \u2014 backend/app/routers/codec.py:164"}, "properties": {"repobilityId": "c8f058b2df1a79e5", "scanner": "scanner-primary", "fingerprint": "be14e2a89636a097", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-4829c9e4c66e1207", "level": "error", "message": {"text": "FastAPI POST `jwt_sign` without auth dependency \u2014 backend/app/routers/codec.py:169"}, "properties": {"repobilityId": "85b85dab45d1f0a8", "scanner": "scanner-primary", "fingerprint": "4829c9e4c66e1207", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/codec.py"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-f8313315ec2b5c20", "level": "error", "message": {"text": "FastAPI POST `format_convert` without auth dependency \u2014 backend/app/routers/convert.py:20"}, "properties": {"repobilityId": "c589d2f15012056d", "scanner": "scanner-primary", "fingerprint": "f8313315ec2b5c20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/convert.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-d1e149bece556eb0", "level": "error", "message": {"text": "FastAPI POST `jsonpath_eval` without auth dependency \u2014 backend/app/routers/convert.py:30"}, "properties": {"repobilityId": "62e39997a98d5eba", "scanner": "scanner-primary", "fingerprint": "d1e149bece556eb0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/convert.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-7ea49ce6998e3490", "level": "error", "message": {"text": "FastAPI POST `curl_convert` without auth dependency \u2014 backend/app/routers/convert.py:44"}, "properties": {"repobilityId": "9b198976ae3a9c01", "scanner": "scanner-primary", "fingerprint": "7ea49ce6998e3490", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/convert.py"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-a02a92038c86991c", "level": "error", "message": {"text": "FastAPI POST `cron_next` without auth dependency \u2014 backend/app/routers/calc.py:35"}, "properties": {"repobilityId": "333e907f4f5ac202", "scanner": "scanner-primary", "fingerprint": "a02a92038c86991c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/calc.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-3669aed0e5d0029a", "level": "error", "message": {"text": "FastAPI POST `color_convert` without auth dependency \u2014 backend/app/routers/calc.py:47"}, "properties": {"repobilityId": "d83f9668af40db11", "scanner": "scanner-primary", "fingerprint": "3669aed0e5d0029a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/calc.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-6d39ba7529509947", "level": "error", "message": {"text": "FastAPI POST `contrast` without auth dependency \u2014 backend/app/routers/calc.py:63"}, "properties": {"repobilityId": "fc4d3c959d1adddb", "scanner": "scanner-primary", "fingerprint": "6d39ba7529509947", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/calc.py"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-4ec98b17e8ecaf32", "level": "error", "message": {"text": "FastAPI POST `chmod` without auth dependency \u2014 backend/app/routers/calc.py:80"}, "properties": {"repobilityId": "726624e3046a60fb", "scanner": "scanner-primary", "fingerprint": "4ec98b17e8ecaf32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/calc.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-624cb25dc09bc365", "level": "error", "message": {"text": "FastAPI POST `cidr` without auth dependency \u2014 backend/app/routers/calc.py:89"}, "properties": {"repobilityId": "665cd6e8ca32a361", "scanner": "scanner-primary", "fingerprint": "624cb25dc09bc365", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/calc.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-6dc60451d0539ac4", "level": "error", "message": {"text": "FastAPI POST `markdown_preview` without auth dependency \u2014 backend/app/routers/calc.py:128"}, "properties": {"repobilityId": "66f7543948b600a4", "scanner": "scanner-primary", "fingerprint": "6dc60451d0539ac4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/calc.py"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-8d6d41b8f2e22baf", "level": "error", "message": {"text": "FastAPI POST `time_convert` without auth dependency \u2014 backend/app/routers/time_tools.py:14"}, "properties": {"repobilityId": "6f3c260b963afbae", "scanner": "scanner-primary", "fingerprint": "8d6d41b8f2e22baf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/time_tools.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-0e6623ec1939da56", "level": "error", "message": {"text": "FastAPI POST `cron` without auth dependency \u2014 backend/app/routers/time_tools.py:22"}, "properties": {"repobilityId": "006d793a40220b71", "scanner": "scanner-primary", "fingerprint": "0e6623ec1939da56", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/time_tools.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-10b530345f53a4dd", "level": "error", "message": {"text": "FastAPI POST `validate_json` without auth dependency \u2014 backend/app/routers/json_tools.py:30"}, "properties": {"repobilityId": "2692eb0955e7fcb7", "scanner": "scanner-primary", "fingerprint": "10b530345f53a4dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/json_tools.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-c16240b47f79fd41", "level": "error", "message": {"text": "FastAPI POST `schema_from_json` without auth dependency \u2014 backend/app/routers/json_tools.py:67"}, "properties": {"repobilityId": "d54600112e7d6b7f", "scanner": "scanner-primary", "fingerprint": "c16240b47f79fd41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/json_tools.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-a94fe8b2e41361f0", "level": "error", "message": {"text": "FastAPI POST `sample_from_schema` without auth dependency \u2014 backend/app/routers/json_tools.py:76"}, "properties": {"repobilityId": "41355d7939b1b6be", "scanner": "scanner-primary", "fingerprint": "a94fe8b2e41361f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/json_tools.py"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-1f194eeb579fbdc6", "level": "error", "message": {"text": "FastAPI POST `json_convert` without auth dependency \u2014 backend/app/routers/json_tools.py:91"}, "properties": {"repobilityId": "d81ba0d0bcb80dd4", "scanner": "scanner-primary", "fingerprint": "1f194eeb579fbdc6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/json_tools.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-89a3a09eb857f243", "level": "error", "message": {"text": "FastAPI POST `json_parse` without auth dependency \u2014 backend/app/routers/json_tools.py:112"}, "properties": {"repobilityId": "45e81168cc8d27b9", "scanner": "scanner-primary", "fingerprint": "89a3a09eb857f243", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/json_tools.py"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "414de3a0f9ad89dd", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9a7ab29051c0367b", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b1d5926fda286fa", "level": "note", "message": {"text": "Unused endpoint: GET /{full_path:path}"}, "properties": {"repobilityId": "574058a6b8490f0e", "scanner": "scanner-primary", "fingerprint": "1b1d5926fda286fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd3207cf185141b0", "level": "note", "message": {"text": "Unused endpoint: GET /http-statuses"}, "properties": {"repobilityId": "05945e73abd44831", "scanner": "scanner-primary", "fingerprint": "fd3207cf185141b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5f55a3b39587071", "level": "note", "message": {"text": "Unused endpoint: GET /mime-types"}, "properties": {"repobilityId": "a3e5f9d3fba46bf9", "scanner": "scanner-primary", "fingerprint": "c5f55a3b39587071", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60d742deeae35f2b", "level": "note", "message": {"text": "Unused endpoint: POST /lorem"}, "properties": {"repobilityId": "117f224688d07c62", "scanner": "scanner-primary", "fingerprint": "60d742deeae35f2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5c6154ddfe9f487", "level": "note", "message": {"text": "Unused endpoint: POST /qr"}, "properties": {"repobilityId": "e1dcf1823e0bdb0c", "scanner": "scanner-primary", "fingerprint": "a5c6154ddfe9f487", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61cd72059c857967", "level": "note", "message": {"text": "Unused endpoint: POST /md-to-pdf"}, "properties": {"repobilityId": "99e465543e8e8e45", "scanner": "scanner-primary", "fingerprint": "61cd72059c857967", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9f2386781f5e4e7", "level": "note", "message": {"text": "Unused endpoint: POST /pdf-to-md"}, "properties": {"repobilityId": "f8e40d5bb6d8a518", "scanner": "scanner-primary", "fingerprint": "e9f2386781f5e4e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-554ffd052999fac9", "level": "note", "message": {"text": "Unused endpoint: POST /check"}, "properties": {"repobilityId": "bc8709e01fae6f6a", "scanner": "scanner-primary", "fingerprint": "554ffd052999fac9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-970eb92d6ec2bfaa", "level": "note", "message": {"text": "Unused endpoint: POST /generate"}, "properties": {"repobilityId": "884618f227ac5ebf", "scanner": "scanner-primary", "fingerprint": "970eb92d6ec2bfaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9630d39f953a327c", "level": "note", "message": {"text": "Unused endpoint: GET /types"}, "properties": {"repobilityId": "209676ed46fba6c0", "scanner": "scanner-primary", "fingerprint": "9630d39f953a327c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cccfe89f81ab208f", "level": "note", "message": {"text": "Unused endpoint: POST /preview"}, "properties": {"repobilityId": "4f1ecf26530d9f20", "scanner": "scanner-primary", "fingerprint": "cccfe89f81ab208f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7028d9c853d87627", "level": "note", "message": {"text": "Unused endpoint: POST /export"}, "properties": {"repobilityId": "216bd5447ee84945", "scanner": "scanner-primary", "fingerprint": "7028d9c853d87627", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-03bfe2bb33d2fdbf", "level": "note", "message": {"text": "Unused endpoint: POST /diff"}, "properties": {"repobilityId": "909d616e358e470c", "scanner": "scanner-primary", "fingerprint": "03bfe2bb33d2fdbf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-284873ae98fb3d01", "level": "note", "message": {"text": "Unused endpoint: POST /count"}, "properties": {"repobilityId": "4f4298e6596b50a2", "scanner": "scanner-primary", "fingerprint": "284873ae98fb3d01", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e7daa5b2cf1ac2e0", "level": "note", "message": {"text": "Unused endpoint: POST /columns"}, "properties": {"repobilityId": "b87f7a4788f5f42e", "scanner": "scanner-primary", "fingerprint": "e7daa5b2cf1ac2e0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-749f55bf99b6439d", "level": "note", "message": {"text": "Unused endpoint: POST /clean"}, "properties": {"repobilityId": "15d9e6b4bfa0ff66", "scanner": "scanner-primary", "fingerprint": "749f55bf99b6439d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10fa82f1cb5daafa", "level": "note", "message": {"text": "Unused endpoint: POST /stats"}, "properties": {"repobilityId": "85483ebdf07b61a2", "scanner": "scanner-primary", "fingerprint": "10fa82f1cb5daafa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-664a88205d8ff9bc", "level": "note", "message": {"text": "Unused endpoint: POST /random-number"}, "properties": {"repobilityId": "049b4194ef2f0c86", "scanner": "scanner-primary", "fingerprint": "664a88205d8ff9bc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a217f54c86fa2e32", "level": "note", "message": {"text": "Unused endpoint: POST /random-string"}, "properties": {"repobilityId": "135f3278a53184e3", "scanner": "scanner-primary", "fingerprint": "a217f54c86fa2e32", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-29b2378921c889d6", "level": "note", "message": {"text": "Unused endpoint: POST /shuffle"}, "properties": {"repobilityId": "6b041f10c5aa6c94", "scanner": "scanner-primary", "fingerprint": "29b2378921c889d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e85ad5aa7983e09a", "level": "note", "message": {"text": "Unused endpoint: POST /base64"}, "properties": {"repobilityId": "1825d312a7b05bec", "scanner": "scanner-primary", "fingerprint": "e85ad5aa7983e09a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81ac193e378a2bd1", "level": "note", "message": {"text": "Unused endpoint: POST /jwt"}, "properties": {"repobilityId": "eb8ee81a3924df61", "scanner": "scanner-primary", "fingerprint": "81ac193e378a2bd1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee64de12f3cc7c89", "level": "note", "message": {"text": "Unused endpoint: POST /uuid/generate"}, "properties": {"repobilityId": "ea9bab132a48d6b0", "scanner": "scanner-primary", "fingerprint": "ee64de12f3cc7c89", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84a06dc31f23e914", "level": "note", "message": {"text": "Unused endpoint: POST /uuid/inspect"}, "properties": {"repobilityId": "892c1aa5c8226110", "scanner": "scanner-primary", "fingerprint": "84a06dc31f23e914", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b1b6390bbb2408a", "level": "note", "message": {"text": "Unused endpoint: POST /hash"}, "properties": {"repobilityId": "3ed6f72ced951d0e", "scanner": "scanner-primary", "fingerprint": "0b1b6390bbb2408a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e9b7ef2755701df", "level": "note", "message": {"text": "Unused endpoint: POST /hmac"}, "properties": {"repobilityId": "ee4167de9cff1339", "scanner": "scanner-primary", "fingerprint": "4e9b7ef2755701df", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6b1bc1790eb7bfec", "level": "note", "message": {"text": "Unused endpoint: POST /url"}, "properties": {"repobilityId": "9a721e82e031874e", "scanner": "scanner-primary", "fingerprint": "6b1bc1790eb7bfec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2238766cd00c0260", "level": "note", "message": {"text": "Unused endpoint: POST /url/parse"}, "properties": {"repobilityId": "f9ed23d70a207db3", "scanner": "scanner-primary", "fingerprint": "2238766cd00c0260", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2aae7e732f9aa86", "level": "note", "message": {"text": "Unused endpoint: POST /case"}, "properties": {"repobilityId": "e140d7750886b793", "scanner": "scanner-primary", "fingerprint": "e2aae7e732f9aa86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aee41c2a11cb2bd9", "level": "note", "message": {"text": "Unused endpoint: POST /jwt/sign"}, "properties": {"repobilityId": "30bf1b713500a006", "scanner": "scanner-primary", "fingerprint": "aee41c2a11cb2bd9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f6f9c277a39ef9d", "level": "note", "message": {"text": "Unused endpoint: POST /format"}, "properties": {"repobilityId": "854ffd1550d09a0c", "scanner": "scanner-primary", "fingerprint": "2f6f9c277a39ef9d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5025ad5ecc6e345a", "level": "note", "message": {"text": "Unused endpoint: POST /jsonpath"}, "properties": {"repobilityId": "7101f7e49793a940", "scanner": "scanner-primary", "fingerprint": "5025ad5ecc6e345a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9190c5f3cc7449a8", "level": "note", "message": {"text": "Unused endpoint: POST /curl"}, "properties": {"repobilityId": "0e652fcfb87262bc", "scanner": "scanner-primary", "fingerprint": "9190c5f3cc7449a8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8871251dea0ef2b2", "level": "note", "message": {"text": "Unused endpoint: POST /cron-next"}, "properties": {"repobilityId": "9e913aa648266540", "scanner": "scanner-primary", "fingerprint": "8871251dea0ef2b2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea765518f2e81593", "level": "note", "message": {"text": "Unused endpoint: POST /color"}, "properties": {"repobilityId": "3591b4f463ff57bf", "scanner": "scanner-primary", "fingerprint": "ea765518f2e81593", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3eeb8bfc82ec51f3", "level": "note", "message": {"text": "Unused endpoint: POST /contrast"}, "properties": {"repobilityId": "dcd2858e7a0821fa", "scanner": "scanner-primary", "fingerprint": "3eeb8bfc82ec51f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c512a3abf8834cc", "level": "note", "message": {"text": "Unused endpoint: POST /chmod"}, "properties": {"repobilityId": "e419a0a869c5c9cd", "scanner": "scanner-primary", "fingerprint": "9c512a3abf8834cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c134d45716ab21f0", "level": "note", "message": {"text": "Unused endpoint: POST /cidr"}, "properties": {"repobilityId": "61e1dc69e63df2bb", "scanner": "scanner-primary", "fingerprint": "c134d45716ab21f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74972bb9ebed8ea5", "level": "note", "message": {"text": "Unused endpoint: POST /markdown"}, "properties": {"repobilityId": "8bb59cd2d251fbdd", "scanner": "scanner-primary", "fingerprint": "74972bb9ebed8ea5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-37583ca7e4c862e2", "level": "note", "message": {"text": "Unused endpoint: POST /convert"}, "properties": {"repobilityId": "3efb66fbb2a5536c", "scanner": "scanner-primary", "fingerprint": "37583ca7e4c862e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b1044f93bd093823", "level": "note", "message": {"text": "Unused endpoint: POST /cron"}, "properties": {"repobilityId": "5e6711f1746a1697", "scanner": "scanner-primary", "fingerprint": "b1044f93bd093823", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34c0472a1f1fafe5", "level": "note", "message": {"text": "Unused endpoint: POST /validate"}, "properties": {"repobilityId": "d1cd2c5683f93410", "scanner": "scanner-primary", "fingerprint": "34c0472a1f1fafe5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dbdd4638010f5cb5", "level": "note", "message": {"text": "Unused endpoint: POST /schema"}, "properties": {"repobilityId": "e63eb8ae36e45b08", "scanner": "scanner-primary", "fingerprint": "dbdd4638010f5cb5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fca3f0b64c781eed", "level": "note", "message": {"text": "Unused endpoint: POST /sample"}, "properties": {"repobilityId": "9dc0e2543adc8b3a", "scanner": "scanner-primary", "fingerprint": "fca3f0b64c781eed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-21d4e3431aa9b5dc", "level": "note", "message": {"text": "Unused endpoint: POST /parse"}, "properties": {"repobilityId": "e58afe35ab4dbcfb", "scanner": "scanner-primary", "fingerprint": "21d4e3431aa9b5dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}