{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8b7fd72c319e7242", "name": "Possibly dead Python function: translate_zh_en", "shortDescription": {"text": "Possibly dead Python function: translate_zh_en"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca428149fbc9b2b6", "name": "Possibly dead Python function: import_kouyu_yaml", "shortDescription": {"text": "Possibly dead Python function: import_kouyu_yaml"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd195630c281c6da", "name": "Possibly dead Python function: toggle_deck_creating_suspension", "shortDescription": {"text": "Possibly dead Python function: toggle_deck_creating_suspension"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f76ccb5ed03bfe4", "name": "Possibly dead Python function: delete_card", "shortDescription": {"text": "Possibly dead Python function: delete_card"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-715819dceab6b3f9", "name": "Possibly dead Python function: run_single_query", "shortDescription": {"text": "Possibly dead Python function: run_single_query"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b56e49c7eee93ff2", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1bc39eb7cb0b0ee", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba2c89fda31fa436", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ade34d2f9ee7f8e2", "name": "Icon-only button without accessible name \u2014 static/app.js:2057", "shortDescription": {"text": "Icon-only button without accessible name \u2014 static/app.js:2057"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c6aaf32c39ad502", "name": "Stray `console.log` in TS/JS \u2014 static/app.js:3881", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/app.js:3881"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f766e1edc8208aec", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/app.js:241", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/app.js:241"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-953160adb7e8b774", "name": "Insecure pattern 'insert_adjacent_html' in static/app.js:3798", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in static/app.js:3798"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-415f37be0a28bebb", "name": "Insecure pattern 'direct_innerhtml_assignment' in .claude/skills/skill-creator/skills/skill-creator/eval-viewer/viewer.h", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in .claude/skills/skill-creator/skills/skill-creator/eval-viewer/viewer.html:766"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4aff7eba1bcf337f", "name": "Insecure pattern 'direct_innerhtml_assignment' in .claude/skills/skill-creator/skills/skill-creator/assets/eval_review.h", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in .claude/skills/skill-creator/skills/skill-creator/assets/eval_review.html:69"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0fa3efa277aed28", "name": "Very large file: static/app.js (7815 lines)", "shortDescription": {"text": "Very large file: static/app.js (7815 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d4d825f299b62f9", "name": "Very large file: database/cards.py (1661 lines)", "shortDescription": {"text": "Very large file: database/cards.py (1661 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 37 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 91 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb0d2c55ed6875d", "name": "Agent authority lacks a verifier contract: .claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-806d74aa357a00c9", "name": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/commit-push-pr.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/commit-push-pr.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23a1d958251248df", "name": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/commit.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/commit.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c77063d914dc9ea", "name": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/clean_gone.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/clean_gone.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-192852eb3a456dc8", "name": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29918f018056f8b0", "name": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/agents/comparator.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/agents/comparator.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-adb5f4b281c731cb", "name": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/references/schemas.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/references/schemas.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0efe259e39dbfdce", "name": "Network/subprocess call without timeout or try/except \u2014 tts.py:224", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tts.py:224"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99acc05432952e39", "name": "Commented-code block (6 lines) in static/app.js:285", "shortDescription": {"text": "Commented-code block (6 lines) in static/app.js:285"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a8e055e8304bff04", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/app.js:693", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/app.js:693"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4adf05687b0a86e9", "name": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/skill-creator/skills/skill-creator/scripts/run_ev", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/skill-creator/skills/skill-creator/scripts/run_eval.py:85"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntts.py:preload_all_async, tts.py:preload\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndatabase/browse.py:bulk_bury_cards_by_words, database/browse.py:bulk_suspend_cards_by_words, database/browse.py:bulk_move_cards_by_words\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d40e97facc8a66cc", "name": "FastAPI POST `log_ui_action` without auth dependency \u2014 main.py:224", "shortDescription": {"text": "FastAPI POST `log_ui_action` without auth dependency \u2014 main.py:224"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f54e5925fbfcc18d", "name": "FastAPI POST `restart_server` without auth dependency \u2014 main.py:229", "shortDescription": {"text": "FastAPI POST `restart_server` without auth dependency \u2014 main.py:229"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b67b96899b30366", "name": "FastAPI POST `submit_review` without auth dependency \u2014 routes/review.py:99", "shortDescription": {"text": "FastAPI POST `submit_review` without auth dependency \u2014 routes/review.py:99"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7dd5c04e9d537e62", "name": "FastAPI POST `undo_review` without auth dependency \u2014 routes/review.py:259", "shortDescription": {"text": "FastAPI POST `undo_review` without auth dependency \u2014 routes/review.py:259"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7db30ab02667819e", "name": "FastAPI POST `bury_card` without auth dependency \u2014 routes/review.py:314", "shortDescription": {"text": "FastAPI POST `bury_card` without auth dependency \u2014 routes/review.py:314"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c1c1bf0f2a0b953", "name": "FastAPI POST `unbury_card` without auth dependency \u2014 routes/review.py:320", "shortDescription": {"text": "FastAPI POST `unbury_card` without auth dependency \u2014 routes/review.py:320"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-185cc84da720c4ff", "name": "FastAPI POST `session_timelines` without auth dependency \u2014 routes/review.py:336", "shortDescription": {"text": "FastAPI POST `session_timelines` without auth dependency \u2014 routes/review.py:336"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dfebf597a19b0eb9", "name": "FastAPI POST `preview_import` without auth dependency \u2014 routes/imports.py:15", "shortDescription": {"text": "FastAPI POST `preview_import` without auth dependency \u2014 routes/imports.py:15"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f3835844efba4a02", "name": "FastAPI POST `upload_import` without auth dependency \u2014 routes/imports.py:22", "shortDescription": {"text": "FastAPI POST `upload_import` without auth dependency \u2014 routes/imports.py:22"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d34af03f6b9d6847", "name": "FastAPI POST `import_from_directory` without auth dependency \u2014 routes/imports.py:92", "shortDescription": {"text": "FastAPI POST `import_from_directory` without auth dependency \u2014 routes/imports.py:92"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b30e2e84ffee8232", "name": "FastAPI POST `quick_add_word` without auth dependency \u2014 routes/imports.py:168", "shortDescription": {"text": "FastAPI POST `quick_add_word` without auth dependency \u2014 routes/imports.py:168"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ce7900d92a5d725", "name": "FastAPI POST `create_deck` without auth dependency \u2014 routes/decks.py:99", "shortDescription": {"text": "FastAPI POST `create_deck` without auth dependency \u2014 routes/decks.py:99"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a9208706842dbea", "name": "FastAPI DELETE `delete_deck` without auth dependency \u2014 routes/decks.py:112", "shortDescription": {"text": "FastAPI DELETE `delete_deck` without auth dependency \u2014 routes/decks.py:112"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e880c7a6ee1a8a51", "name": "FastAPI DELETE `clear_deck_cards` without auth dependency \u2014 routes/decks.py:121", "shortDescription": {"text": "FastAPI DELETE `clear_deck_cards` without auth dependency \u2014 routes/decks.py:121"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ffbd2262159e2adb", "name": "FastAPI POST `restore_deck` without auth dependency \u2014 routes/decks.py:133", "shortDescription": {"text": "FastAPI POST `restore_deck` without auth dependency \u2014 routes/decks.py:133"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-831b23d15cead3b3", "name": "FastAPI DELETE `purge_deck` without auth dependency \u2014 routes/decks.py:139", "shortDescription": {"text": "FastAPI DELETE `purge_deck` without auth dependency \u2014 routes/decks.py:139"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-10c1547228df1fe2", "name": "FastAPI POST `toggle_creating_suspension` without auth dependency \u2014 routes/decks.py:145", "shortDescription": {"text": "FastAPI POST `toggle_creating_suspension` without auth dependency \u2014 routes/decks.py:145"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de110efdf054c9bf", "name": "FastAPI POST `toggle_category_suspension` without auth dependency \u2014 routes/decks.py:150", "shortDescription": {"text": "FastAPI POST `toggle_category_suspension` without auth dependency \u2014 routes/decks.py:150"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43903e18792d2d0c", "name": "FastAPI POST `toggle_deck_all_suspension` without auth dependency \u2014 routes/decks.py:155", "shortDescription": {"text": "FastAPI POST `toggle_deck_all_suspension` without auth dependency \u2014 routes/decks.py:155"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5bc5631f76b984ef", "name": "FastAPI POST `restore_trashed_card` without auth dependency \u2014 routes/decks.py:160", "shortDescription": {"text": "FastAPI POST `restore_trashed_card` without auth dependency \u2014 routes/decks.py:160"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5121f0dc24b36ba4", "name": "FastAPI DELETE `purge_trashed_card` without auth dependency \u2014 routes/decks.py:166", "shortDescription": {"text": "FastAPI DELETE `purge_trashed_card` without auth dependency \u2014 routes/decks.py:166"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b1894e1917386b89", "name": "FastAPI DELETE `purge_all_cards_from_trash_deck` without auth dependency \u2014 routes/decks.py:172", "shortDescription": {"text": "FastAPI DELETE `purge_all_cards_from_trash_deck` without auth dependency \u2014 routes/decks.py:172"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f16a9ed069bae8e", "name": "FastAPI DELETE `purge_card_from_trash_deck` without auth dependency \u2014 routes/decks.py:178", "shortDescription": {"text": "FastAPI DELETE `purge_card_from_trash_deck` without auth dependency \u2014 routes/decks.py:178"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4693be9251ca598", "name": "FastAPI DELETE `empty_trash` without auth dependency \u2014 routes/decks.py:184", "shortDescription": {"text": "FastAPI DELETE `empty_trash` without auth dependency \u2014 routes/decks.py:184"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e8474c704c10fde4", "name": "FastAPI PUT `update_deck` without auth dependency \u2014 routes/decks.py:193", "shortDescription": {"text": "FastAPI PUT `update_deck` without auth dependency \u2014 routes/decks.py:193"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8cc0fab27f6f763e", "name": "FastAPI POST `create_preset` without auth dependency \u2014 routes/decks.py:209", "shortDescription": {"text": "FastAPI POST `create_preset` without auth dependency \u2014 routes/decks.py:209"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b21fa56573faa4f8", "name": "FastAPI DELETE `delete_preset` without auth dependency \u2014 routes/decks.py:219", "shortDescription": {"text": "FastAPI DELETE `delete_preset` without auth dependency \u2014 routes/decks.py:219"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60f1fad75a4a646e", "name": "FastAPI PUT `update_deck_preset` without auth dependency \u2014 routes/decks.py:235", "shortDescription": {"text": "FastAPI PUT `update_deck_preset` without auth dependency \u2014 routes/decks.py:235"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b400f8e43a839be", "name": "FastAPI PUT `assign_preset_to_deck` without auth dependency \u2014 routes/decks.py:243", "shortDescription": {"text": "FastAPI PUT `assign_preset_to_deck` without auth dependency \u2014 routes/decks.py:243"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b65a9eb958063d1b", "name": "FastAPI POST `toggle_bury_siblings` without auth dependency \u2014 routes/decks.py:249", "shortDescription": {"text": "FastAPI POST `toggle_bury_siblings` without auth dependency \u2014 routes/decks.py:249"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f803af39c1e9e76", "name": "FastAPI POST `toggle_new_review_order` without auth dependency \u2014 routes/decks.py:261", "shortDescription": {"text": "FastAPI POST `toggle_new_review_order` without auth dependency \u2014 routes/decks.py:261"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9db174e0be36bc5a", "name": "FastAPI POST `set_deck_preset_as_default` without auth dependency \u2014 routes/decks.py:273", "shortDescription": {"text": "FastAPI POST `set_deck_preset_as_default` without auth dependency \u2014 routes/decks.py:273"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f380b720a50c9a69", "name": "FastAPI PUT `set_preset_category_override` without auth dependency \u2014 routes/decks.py:300", "shortDescription": {"text": "FastAPI PUT `set_preset_category_override` without auth dependency \u2014 routes/decks.py:300"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-30335c98a8c81108", "name": "FastAPI DELETE `delete_preset_category_override` without auth dependency \u2014 routes/decks.py:310", "shortDescription": {"text": "FastAPI DELETE `delete_preset_category_override` without auth dependency \u2014 routes/decks.py:310"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b0978bcbd110a268", "name": "FastAPI POST `trigger_import` without auth dependency \u2014 routes/browse.py:16", "shortDescription": {"text": "FastAPI POST `trigger_import` without auth dependency \u2014 routes/browse.py:16"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0244f06de26fc414", "name": "FastAPI PUT `update_word` without auth dependency \u2014 routes/browse.py:29", "shortDescription": {"text": "FastAPI PUT `update_word` without auth dependency \u2014 routes/browse.py:29"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03cb5917463883c2", "name": "FastAPI POST `regenerate_word_fields` without auth dependency \u2014 routes/browse.py:223", "shortDescription": {"text": "FastAPI POST `regenerate_word_fields` without auth dependency \u2014 routes/browse.py:223"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14248c4fb83141c1", "name": "FastAPI POST `apply_regen_result` without auth dependency \u2014 routes/browse.py:257", "shortDescription": {"text": "FastAPI POST `apply_regen_result` without auth dependency \u2014 routes/browse.py:257"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb3ef0cfb000ce8d", "name": "FastAPI POST `ai_enrich_word` without auth dependency \u2014 routes/browse.py:278", "shortDescription": {"text": "FastAPI POST `ai_enrich_word` without auth dependency \u2014 routes/browse.py:278"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d8337b41a98bd3d", "name": "FastAPI POST `regenerate_hanzi_info` without auth dependency \u2014 routes/browse.py:324", "shortDescription": {"text": "FastAPI POST `regenerate_hanzi_info` without auth dependency \u2014 routes/browse.py:324"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f98997d579621893", "name": "FastAPI PUT `update_hanzi` without auth dependency \u2014 routes/browse.py:348", "shortDescription": {"text": "FastAPI PUT `update_hanzi` without auth dependency \u2014 routes/browse.py:348"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98d447d538d5e4ff", "name": "FastAPI POST `toggle_suspend` without auth dependency \u2014 routes/browse.py:380", "shortDescription": {"text": "FastAPI POST `toggle_suspend` without auth dependency \u2014 routes/browse.py:380"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22cfc230fe5db9ea", "name": "FastAPI POST `leech_card_endpoint` without auth dependency \u2014 routes/browse.py:385", "shortDescription": {"text": "FastAPI POST `leech_card_endpoint` without auth dependency \u2014 routes/browse.py:385"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d3ec4ef7175cb4c6", "name": "FastAPI POST `reset_card_endpoint` without auth dependency \u2014 routes/browse.py:392", "shortDescription": {"text": "FastAPI POST `reset_card_endpoint` without auth dependency \u2014 routes/browse.py:392"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e693b2b85d2468e2", "name": "FastAPI POST `bury_card_endpoint` without auth dependency \u2014 routes/browse.py:397", "shortDescription": {"text": "FastAPI POST `bury_card_endpoint` without auth dependency \u2014 routes/browse.py:397"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac7b58d12dfe673c", "name": "FastAPI DELETE `delete_card_endpoint` without auth dependency \u2014 routes/browse.py:404", "shortDescription": {"text": "FastAPI DELETE `delete_card_endpoint` without auth dependency \u2014 routes/browse.py:404"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3070ab8739898667", "name": "FastAPI POST `bulk_bury` without auth dependency \u2014 routes/browse.py:413", "shortDescription": {"text": "FastAPI POST `bulk_bury` without auth dependency \u2014 routes/browse.py:413"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-783a0f937e6bc39d", "name": "FastAPI POST `bulk_suspend` without auth dependency \u2014 routes/browse.py:420", "shortDescription": {"text": "FastAPI POST `bulk_suspend` without auth dependency \u2014 routes/browse.py:420"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8f4ef698a0ef152", "name": "FastAPI POST `bulk_delete` without auth dependency \u2014 routes/browse.py:427", "shortDescription": {"text": "FastAPI POST `bulk_delete` without auth dependency \u2014 routes/browse.py:427"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-54c907b590938d68", "name": "FastAPI POST `move_card` without auth dependency \u2014 routes/browse.py:434", "shortDescription": {"text": "FastAPI POST `move_card` without auth dependency \u2014 routes/browse.py:434"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-26683ff2e64fbbd1", "name": "FastAPI POST `bulk_move` without auth dependency \u2014 routes/browse.py:445", "shortDescription": {"text": "FastAPI POST `bulk_move` without auth dependency \u2014 routes/browse.py:445"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b34de70a2c39e563", "name": "FastAPI POST `add_entry_to_deck` without auth dependency \u2014 routes/browse.py:454", "shortDescription": {"text": "FastAPI POST `add_entry_to_deck` without auth dependency \u2014 routes/browse.py:454"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43bf8fff2359e981", "name": "FastAPI POST `regenerate_story` without auth dependency \u2014 routes/story.py:229", "shortDescription": {"text": "FastAPI POST `regenerate_story` without auth dependency \u2014 routes/story.py:229"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e24fbfc77805dd0", "name": "FastAPI POST `speak` without auth dependency \u2014 routes/story.py:405", "shortDescription": {"text": "FastAPI POST `speak` without auth dependency \u2014 routes/story.py:405"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ef46161e1f474b58", "name": "FastAPI POST `speak_multi` without auth dependency \u2014 routes/story.py:414", "shortDescription": {"text": "FastAPI POST `speak_multi` without auth dependency \u2014 routes/story.py:414"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06d5a2bf80258081", "name": "FastAPI POST `speak_stop` without auth dependency \u2014 routes/story.py:428", "shortDescription": {"text": "FastAPI POST `speak_stop` without auth dependency \u2014 routes/story.py:428"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50600fab29a50f96", "name": "FastAPI POST `preload` without auth dependency \u2014 routes/story.py:434", "shortDescription": {"text": "FastAPI POST `preload` without auth dependency \u2014 routes/story.py:434"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-223fec08b04691ba", "name": "FastAPI POST `preload_session` without auth dependency \u2014 routes/story.py:443", "shortDescription": {"text": "FastAPI POST `preload_session` without auth dependency \u2014 routes/story.py:443"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63dcd683d9c21186", "name": "Dangling fetch: POST /api/preload-session/${rootDeckId}/unified (static/app.js:2881)", "shortDescription": {"text": "Dangling fetch: POST /api/preload-session/${rootDeckId}/unified (static/app.js:2881)"}, "fullDescription": {"text": "`static/app.js:2881` calls `POST /api/preload-session/${rootDeckId}/unified` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/preload-session/<p>/unified`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-488853bcc68f13f1", "name": "Dangling fetch: POST /api/preload-session/${firstDeckId}/unified (static/app.js:2951)", "shortDescription": {"text": "Dangling fetch: POST /api/preload-session/${firstDeckId}/unified (static/app.js:2951)"}, "fullDescription": {"text": "`static/app.js:2951` calls `POST /api/preload-session/${firstDeckId}/unified` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/preload-session/<p>/unified`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e70561f369eeef64", "name": "Dangling fetch: GET /api/story/${storyDeckId}/unified (static/app.js:3043)", "shortDescription": {"text": "Dangling fetch: GET /api/story/${storyDeckId}/unified (static/app.js:3043)"}, "fullDescription": {"text": "`static/app.js:3043` calls `GET /api/story/${storyDeckId}/unified` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/story/<p>/unified`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d2a6c6d1a026ac1", "name": "Dangling fetch: POST /api/preload-session/${storyDeckId}/unified (static/app.js:3047)", "shortDescription": {"text": "Dangling fetch: POST /api/preload-session/${storyDeckId}/unified (static/app.js:3047)"}, "fullDescription": {"text": "`static/app.js:3047` calls `POST /api/preload-session/${storyDeckId}/unified` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/preload-session/<p>/unified`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a2da680021e2602", "name": "Dangling fetch: GET /static/hsk_levels.json (static/app.js:4206)", "shortDescription": {"text": "Dangling fetch: GET /static/hsk_levels.json (static/app.js:4206)"}, "fullDescription": {"text": "`static/app.js:4206` calls `GET /static/hsk_levels.json` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/static/hsk_levels.json`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a150389b9fa495a", "name": "Unused endpoint: GET /api/today/{deck_id}/{category}", "shortDescription": {"text": "Unused endpoint: GET /api/today/{deck_id}/{category}"}, "fullDescription": {"text": "`routes/review.py` declares `GET /api/today/{deck_id}/{category}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a428cd8adfe4fe76", "name": "Unused endpoint: GET /api/today-unfinished", "shortDescription": {"text": "Unused endpoint: GET /api/today-unfinished"}, "fullDescription": {"text": "`routes/review.py` declares `GET /api/today-unfinished` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f012f92967d5e46b", "name": "Unused endpoint: GET /api/today-unfinished-decks", "shortDescription": {"text": "Unused endpoint: GET /api/today-unfinished-decks"}, "fullDescription": {"text": "`routes/review.py` declares `GET /api/today-unfinished-decks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fc24a0b341e6090", "name": "Unused endpoint: GET /api/today-mixed/{deck_id}", "shortDescription": {"text": "Unused endpoint: GET /api/today-mixed/{deck_id}"}, "fullDescription": {"text": "`routes/review.py` declares `GET /api/today-mixed/{deck_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab6f23e840707c3", "name": "Unused endpoint: POST /api/review", "shortDescription": {"text": "Unused endpoint: POST /api/review"}, "fullDescription": {"text": "`routes/review.py` declares `POST /api/review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a44e8c195245f5e", "name": "Unused endpoint: POST /api/review/undo", "shortDescription": {"text": "Unused endpoint: POST /api/review/undo"}, "fullDescription": {"text": "`routes/review.py` declares `POST /api/review/undo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8999ee3ca1966cfd", "name": "Unused endpoint: POST /api/cards/{card_id}/bury", "shortDescription": {"text": "Unused endpoint: POST /api/cards/{card_id}/bury"}, "fullDescription": {"text": "`routes/review.py` declares `POST /api/cards/{card_id}/bury` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-985cea48267af0e6", "name": "Unused endpoint: POST /api/cards/{card_id}/unbury", "shortDescription": {"text": "Unused endpoint: POST /api/cards/{card_id}/unbury"}, "fullDescription": {"text": "`routes/review.py` declares `POST /api/cards/{card_id}/unbury` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-421d15b684edec8f", "name": "Unused endpoint: GET /api/cards/{card_id}/calendar", "shortDescription": {"text": "Unused endpoint: GET /api/cards/{card_id}/calendar"}, "fullDescription": {"text": "`routes/review.py` declares `GET /api/cards/{card_id}/calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1637f28d9faf8601", "name": "Unused endpoint: GET /api/cards/{card_id}/timeline", "shortDescription": {"text": "Unused endpoint: GET /api/cards/{card_id}/timeline"}, "fullDescription": {"text": "`routes/review.py` declares `GET /api/cards/{card_id}/timeline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67689312cc46d055", "name": "Unused endpoint: POST /api/session-timelines", "shortDescription": {"text": "Unused endpoint: POST /api/session-timelines"}, "fullDescription": {"text": "`routes/review.py` declares `POST /api/session-timelines` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-105dc05772ad3704", "name": "Unused endpoint: POST /api/quick-add-word", "shortDescription": {"text": "Unused endpoint: POST /api/quick-add-word"}, "fullDescription": {"text": "`routes/imports.py` declares `POST /api/quick-add-word` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37a35e38d302bff6", "name": "Unused endpoint: POST /api/decks", "shortDescription": {"text": "Unused endpoint: POST /api/decks"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6de4ee32a40b4982", "name": "Unused endpoint: DELETE /api/decks/{deck_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/decks/{deck_id}"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/decks/{deck_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee2ef5f146a9fd05", "name": "Unused endpoint: DELETE /api/decks/{deck_id}/cards", "shortDescription": {"text": "Unused endpoint: DELETE /api/decks/{deck_id}/cards"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/decks/{deck_id}/cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a980efae5cb10c5", "name": "Unused endpoint: GET /api/trash", "shortDescription": {"text": "Unused endpoint: GET /api/trash"}, "fullDescription": {"text": "`routes/decks.py` declares `GET /api/trash` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a279b3202077b41a", "name": "Unused endpoint: POST /api/trash/{deck_id}/restore", "shortDescription": {"text": "Unused endpoint: POST /api/trash/{deck_id}/restore"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/trash/{deck_id}/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9b0d65c133d22f2", "name": "Unused endpoint: DELETE /api/trash/{deck_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/trash/{deck_id}"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/trash/{deck_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e631091e495831f6", "name": "Unused endpoint: POST /api/decks/{deck_id}/creating/toggle-suspension", "shortDescription": {"text": "Unused endpoint: POST /api/decks/{deck_id}/creating/toggle-suspension"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks/{deck_id}/creating/toggle-suspension` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6229ea67dbde5d7f", "name": "Unused endpoint: POST /api/decks/{deck_id}/categories/{category}/toggle-suspension", "shortDescription": {"text": "Unused endpoint: POST /api/decks/{deck_id}/categories/{category}/toggle-suspension"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks/{deck_id}/categories/{category}/toggle-suspension` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb8c85011e2ec1e2", "name": "Unused endpoint: POST /api/decks/{deck_id}/toggle-all-suspension", "shortDescription": {"text": "Unused endpoint: POST /api/decks/{deck_id}/toggle-all-suspension"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks/{deck_id}/toggle-all-suspension` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e7c0a5662744268", "name": "Unused endpoint: POST /api/trash/cards/{card_id}/restore", "shortDescription": {"text": "Unused endpoint: POST /api/trash/cards/{card_id}/restore"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/trash/cards/{card_id}/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1e45d55e461e96a", "name": "Unused endpoint: DELETE /api/trash/cards/{card_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/trash/cards/{card_id}"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/trash/cards/{card_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6160fc231608d52d", "name": "Unused endpoint: DELETE /api/trash/{deck_id}/cards", "shortDescription": {"text": "Unused endpoint: DELETE /api/trash/{deck_id}/cards"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/trash/{deck_id}/cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52a87478cbc32c51", "name": "Unused endpoint: DELETE /api/trash/{deck_id}/cards/{card_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/trash/{deck_id}/cards/{card_id}"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/trash/{deck_id}/cards/{card_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5aa0a1e9ab4119b", "name": "Unused endpoint: DELETE /api/trash", "shortDescription": {"text": "Unused endpoint: DELETE /api/trash"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/trash` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e67c5b8c8f9af160", "name": "Unused endpoint: PUT /api/decks/{deck_id}", "shortDescription": {"text": "Unused endpoint: PUT /api/decks/{deck_id}"}, "fullDescription": {"text": "`routes/decks.py` declares `PUT /api/decks/{deck_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9776d2893644070b", "name": "Unused endpoint: GET /api/presets", "shortDescription": {"text": "Unused endpoint: GET /api/presets"}, "fullDescription": {"text": "`routes/decks.py` declares `GET /api/presets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-474c7bb7a9ad0e2e", "name": "Unused endpoint: POST /api/presets", "shortDescription": {"text": "Unused endpoint: POST /api/presets"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/presets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a911366c03f267e", "name": "Unused endpoint: DELETE /api/presets/{preset_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/presets/{preset_id}"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/presets/{preset_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54093ee8ee0c251a", "name": "Unused endpoint: GET /api/decks/{deck_id}/preset", "shortDescription": {"text": "Unused endpoint: GET /api/decks/{deck_id}/preset"}, "fullDescription": {"text": "`routes/decks.py` declares `GET /api/decks/{deck_id}/preset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9732c9fd9e1c3cb", "name": "Unused endpoint: PUT /api/decks/{deck_id}/preset", "shortDescription": {"text": "Unused endpoint: PUT /api/decks/{deck_id}/preset"}, "fullDescription": {"text": "`routes/decks.py` declares `PUT /api/decks/{deck_id}/preset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-729224d437d4b773", "name": "Unused endpoint: PUT /api/decks/{deck_id}/preset/assign", "shortDescription": {"text": "Unused endpoint: PUT /api/decks/{deck_id}/preset/assign"}, "fullDescription": {"text": "`routes/decks.py` declares `PUT /api/decks/{deck_id}/preset/assign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db9cca2c82c28bfe", "name": "Unused endpoint: POST /api/decks/{deck_id}/preset/toggle-bury", "shortDescription": {"text": "Unused endpoint: POST /api/decks/{deck_id}/preset/toggle-bury"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks/{deck_id}/preset/toggle-bury` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b0f84fa4b000086", "name": "Unused endpoint: POST /api/decks/{deck_id}/preset/toggle-mix", "shortDescription": {"text": "Unused endpoint: POST /api/decks/{deck_id}/preset/toggle-mix"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks/{deck_id}/preset/toggle-mix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56afd5b07e7423f4", "name": "Unused endpoint: POST /api/decks/{deck_id}/preset/set-default", "shortDescription": {"text": "Unused endpoint: POST /api/decks/{deck_id}/preset/set-default"}, "fullDescription": {"text": "`routes/decks.py` declares `POST /api/decks/{deck_id}/preset/set-default` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a508e054d167735", "name": "Unused endpoint: GET /api/presets/{preset_id}/categories", "shortDescription": {"text": "Unused endpoint: GET /api/presets/{preset_id}/categories"}, "fullDescription": {"text": "`routes/decks.py` declares `GET /api/presets/{preset_id}/categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c9598c06bd63083", "name": "Unused endpoint: GET /api/presets/{preset_id}/categories/{category}", "shortDescription": {"text": "Unused endpoint: GET /api/presets/{preset_id}/categories/{category}"}, "fullDescription": {"text": "`routes/decks.py` declares `GET /api/presets/{preset_id}/categories/{category}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61dec779ac41713c", "name": "Unused endpoint: PUT /api/presets/{preset_id}/categories/{category}", "shortDescription": {"text": "Unused endpoint: PUT /api/presets/{preset_id}/categories/{category}"}, "fullDescription": {"text": "`routes/decks.py` declares `PUT /api/presets/{preset_id}/categories/{category}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1380189a97dd769c", "name": "Unused endpoint: DELETE /api/presets/{preset_id}/categories/{category}", "shortDescription": {"text": "Unused endpoint: DELETE /api/presets/{preset_id}/categories/{category}"}, "fullDescription": {"text": "`routes/decks.py` declares `DELETE /api/presets/{preset_id}/categories/{category}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee9829911d5cd293", "name": "Unused endpoint: POST /api/import", "shortDescription": {"text": "Unused endpoint: POST /api/import"}, "fullDescription": {"text": "`routes/browse.py` declares `POST /api/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd720e0a51da85d0", "name": "Unused endpoint: PUT /api/word/{word_id}", "shortDescription": {"text": "Unused endpoint: PUT /api/word/{word_id}"}, "fullDescription": {"text": "`routes/browse.py` declares `PUT /api/word/{word_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a095199c6143e89f", "name": "Unused endpoint: POST /api/word/{word_id}/regenerate-fields", "shortDescription": {"text": "Unused endpoint: POST /api/word/{word_id}/regenerate-fields"}, "fullDescription": {"text": "`routes/browse.py` declares `POST /api/word/{word_id}/regenerate-fields` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9571307662a6565", "name": "Unused endpoint: POST /api/word/{word_id}/apply-regen-result", "shortDescription": {"text": "Unused endpoint: POST /api/word/{word_id}/apply-regen-result"}, "fullDescription": {"text": "`routes/browse.py` declares `POST /api/word/{word_id}/apply-regen-result` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de19da0d6dc7112f", "name": "Unused endpoint: POST /api/word/{word_id}/ai-enrich", "shortDescription": {"text": "Unused endpoint: POST /api/word/{word_id}/ai-enrich"}, "fullDescription": {"text": "`routes/browse.py` declares `POST /api/word/{word_id}/ai-enrich` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-174b63c70f5410c8", "name": "Unused endpoint: GET /api/browse-words", "shortDescription": {"text": "Unused endpoint: GET /api/browse-words"}, "fullDescription": {"text": "`routes/browse.py` declares `GET /api/browse-words` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f0321d3943d80d3", "name": "Unused endpoint: GET /api/words/random", "shortDescription": {"text": "Unused endpoint: GET /api/words/random"}, "fullDescription": {"text": "`routes/browse.py` declares `GET /api/words/random` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39369e17ac723178", "name": "Unused endpoint: GET /api/hanzi", "shortDescription": {"text": "Unused endpoint: GET /api/hanzi"}, "fullDescription": {"text": "`routes/browse.py` declares `GET /api/hanzi` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e045d810b53bd99b", "name": "Unused endpoint: GET /api/hanzi/{char_id}", "shortDescription": {"text": "Unused endpoint: GET /api/hanzi/{char_id}"}, "fullDescription": {"text": "`routes/browse.py` declares `GET /api/hanzi/{char_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25213"}, "properties": {"repository": "daniel4828/AnkiAdvanced", "repoUrl": "https://github.com/daniel4828/AnkiAdvanced", "branch": "main"}, "results": [{"ruleId": "scanner-8b7fd72c319e7242", "level": "note", "message": {"text": "Possibly dead Python function: translate_zh_en"}, "properties": {"repobilityId": "16a117a5b629f44f", "scanner": "scanner-primary", "fingerprint": "8b7fd72c319e7242", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "translator.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca428149fbc9b2b6", "level": "note", "message": {"text": "Possibly dead Python function: import_kouyu_yaml"}, "properties": {"repobilityId": "97d876b49588c709", "scanner": "scanner-primary", "fingerprint": "ca428149fbc9b2b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "importer.py:91"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd195630c281c6da", "level": "note", "message": {"text": "Possibly dead Python function: toggle_deck_creating_suspension"}, "properties": {"repobilityId": "b6dc99133868675d", "scanner": "scanner-primary", "fingerprint": "cd195630c281c6da", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "database/cards.py:1036"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f76ccb5ed03bfe4", "level": "note", "message": {"text": "Possibly dead Python function: delete_card"}, "properties": {"repobilityId": "6eb016710a2d8cc5", "scanner": "scanner-primary", "fingerprint": "9f76ccb5ed03bfe4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "database/browse.py:164"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-715819dceab6b3f9", "level": "note", "message": {"text": "Possibly dead Python function: run_single_query"}, "properties": {"repobilityId": "1056c4dff9b57a73", "scanner": "scanner-primary", "fingerprint": "715819dceab6b3f9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/scripts/run_eval.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b56e49c7eee93ff2", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "b56e49c7eee93ff2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/eval-viewer/generate_review.py:332"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1bc39eb7cb0b0ee", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "d1bc39eb7cb0b0ee", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/eval-viewer/generate_review.py:361"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba2c89fda31fa436", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "ba2c89fda31fa436", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/eval-viewer/generate_review.py:382"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ade34d2f9ee7f8e2", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 static/app.js:2057"}, "properties": {"repobilityId": "4e2cf2bda8ec4859", "scanner": "scanner-primary", "fingerprint": "ade34d2f9ee7f8e2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-9c6aaf32c39ad502", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/app.js:3881"}, "properties": {"repobilityId": "59ba33ff2299d9c8", "scanner": "scanner-primary", "fingerprint": "9c6aaf32c39ad502", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f766e1edc8208aec", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/app.js:241"}, "properties": {"repobilityId": "25869ecb6dadc3f6", "scanner": "scanner-primary", "fingerprint": "f766e1edc8208aec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/app.js"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-953160adb7e8b774", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in static/app.js:3798"}, "properties": {"repobilityId": "8d6ff78b8c8349fc", "scanner": "scanner-primary", "fingerprint": "953160adb7e8b774", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/app.js"}, "region": {"startLine": 3798}}}]}, {"ruleId": "scanner-415f37be0a28bebb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in .claude/skills/skill-creator/skills/skill-creator/eval-viewer/viewer.html:766"}, "properties": {"repobilityId": "1376697fb762be13", "scanner": "scanner-primary", "fingerprint": "415f37be0a28bebb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/eval-viewer/viewer.html"}, "region": {"startLine": 766}}}]}, {"ruleId": "scanner-4aff7eba1bcf337f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in .claude/skills/skill-creator/skills/skill-creator/assets/eval_review.html:69"}, "properties": {"repobilityId": "f8830ebf7deb4b43", "scanner": "scanner-primary", "fingerprint": "4aff7eba1bcf337f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/assets/eval_review.html"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f57d208548fcef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-d0fa3efa277aed28", "level": "note", "message": {"text": "Very large file: static/app.js (7815 lines)"}, "properties": {"repobilityId": "1c051419cfdea300", "scanner": "scanner-primary", "fingerprint": "d0fa3efa277aed28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0d4d825f299b62f9", "level": "note", "message": {"text": "Very large file: database/cards.py (1661 lines)"}, "properties": {"repobilityId": "497deafc7a9062c9", "scanner": "scanner-primary", "fingerprint": "0d4d825f299b62f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8b162263e6c37b88", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c2ab215a530c89de", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ecb0d2c55ed6875d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "properties": {"repobilityId": "d8bae33a6d517bf0", "scanner": "scanner-primary", "fingerprint": "ecb0d2c55ed6875d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-806d74aa357a00c9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/commit-push-pr.md"}, "properties": {"repobilityId": "f53f967c414ca3c6", "scanner": "scanner-primary", "fingerprint": "806d74aa357a00c9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/commit-commands/commands/commit-push-pr.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23a1d958251248df", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/commit.md"}, "properties": {"repobilityId": "74a1a4fd49aac642", "scanner": "scanner-primary", "fingerprint": "23a1d958251248df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/commit-commands/commands/commit.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c77063d914dc9ea", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/commit-commands/commands/clean_gone.md"}, "properties": {"repobilityId": "1ff8365fb533def7", "scanner": "scanner-primary", "fingerprint": "7c77063d914dc9ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/commit-commands/commands/clean_gone.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-192852eb3a456dc8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/SKILL.md"}, "properties": {"repobilityId": "07d83482eb53e664", "scanner": "scanner-primary", "fingerprint": "192852eb3a456dc8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-29918f018056f8b0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/agents/comparator.md"}, "properties": {"repobilityId": "f15385e6409974b9", "scanner": "scanner-primary", "fingerprint": "29918f018056f8b0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/agents/comparator.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-adb5f4b281c731cb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/skill-creator/skills/skill-creator/references/schemas.md"}, "properties": {"repobilityId": "3f61d405d49328f4", "scanner": "scanner-primary", "fingerprint": "adb5f4b281c731cb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/skill-creator/skills/skill-creator/references/schemas.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0efe259e39dbfdce", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tts.py:224"}, "properties": {"repobilityId": "d8fffb4ab65349a0", "scanner": "scanner-primary", "fingerprint": "0efe259e39dbfdce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-99acc05432952e39", "level": "none", "message": {"text": "Commented-code block (6 lines) in static/app.js:285"}, "properties": {"repobilityId": "dfc6a614f05e4c24", "scanner": "scanner-primary", "fingerprint": "99acc05432952e39", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a8e055e8304bff04", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/app.js:693"}, "properties": {"repobilityId": "5b51c47e52659341", "scanner": "scanner-primary", "fingerprint": "a8e055e8304bff04", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4adf05687b0a86e9", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/skill-creator/skills/skill-creator/scripts/run_eval.py:85"}, "properties": {"repobilityId": "bbeb024bc29c2602", "scanner": "scanner-primary", "fingerprint": "4adf05687b0a86e9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "754b17e8917ecf8e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8507aa560771ab6e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f89121bdc6d5c0f3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b2b86cca0d200523", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8e885c6807b0df51", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c2e022c2af5fd1be", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-d40e97facc8a66cc", "level": "error", "message": {"text": "FastAPI POST `log_ui_action` without auth dependency \u2014 main.py:224"}, "properties": {"repobilityId": "05cc0835dd90a72c", "scanner": "scanner-primary", "fingerprint": "d40e97facc8a66cc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-f54e5925fbfcc18d", "level": "error", "message": {"text": "FastAPI POST `restart_server` without auth dependency \u2014 main.py:229"}, "properties": {"repobilityId": "78d6a632b11aef7e", "scanner": "scanner-primary", "fingerprint": "f54e5925fbfcc18d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-4b67b96899b30366", "level": "error", "message": {"text": "FastAPI POST `submit_review` without auth dependency \u2014 routes/review.py:99"}, "properties": {"repobilityId": "77e223c4fcc19095", "scanner": "scanner-primary", "fingerprint": "4b67b96899b30366", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/review.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-7dd5c04e9d537e62", "level": "error", "message": {"text": "FastAPI POST `undo_review` without auth dependency \u2014 routes/review.py:259"}, "properties": {"repobilityId": "e47524903b8abfcd", "scanner": "scanner-primary", "fingerprint": "7dd5c04e9d537e62", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/review.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-7db30ab02667819e", "level": "error", "message": {"text": "FastAPI POST `bury_card` without auth dependency \u2014 routes/review.py:314"}, "properties": {"repobilityId": "f5a81b0d6f525bd7", "scanner": "scanner-primary", "fingerprint": "7db30ab02667819e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/review.py"}, "region": {"startLine": 314}}}]}, {"ruleId": "scanner-9c1c1bf0f2a0b953", "level": "error", "message": {"text": "FastAPI POST `unbury_card` without auth dependency \u2014 routes/review.py:320"}, "properties": {"repobilityId": "a29f61a5262a0597", "scanner": "scanner-primary", "fingerprint": "9c1c1bf0f2a0b953", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/review.py"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-185cc84da720c4ff", "level": "error", "message": {"text": "FastAPI POST `session_timelines` without auth dependency \u2014 routes/review.py:336"}, "properties": {"repobilityId": "146bd12875dcacc9", "scanner": "scanner-primary", "fingerprint": "185cc84da720c4ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/review.py"}, "region": {"startLine": 336}}}]}, {"ruleId": "scanner-dfebf597a19b0eb9", "level": "error", "message": {"text": "FastAPI POST `preview_import` without auth dependency \u2014 routes/imports.py:15"}, "properties": {"repobilityId": "0c838041c355bf7f", "scanner": "scanner-primary", "fingerprint": "dfebf597a19b0eb9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/imports.py"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-f3835844efba4a02", "level": "error", "message": {"text": "FastAPI POST `upload_import` without auth dependency \u2014 routes/imports.py:22"}, "properties": {"repobilityId": "734ca2172bc723b3", "scanner": "scanner-primary", "fingerprint": "f3835844efba4a02", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/imports.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-d34af03f6b9d6847", "level": "error", "message": {"text": "FastAPI POST `import_from_directory` without auth dependency \u2014 routes/imports.py:92"}, "properties": {"repobilityId": "24c9cb729dd80ab1", "scanner": "scanner-primary", "fingerprint": "d34af03f6b9d6847", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/imports.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-b30e2e84ffee8232", "level": "error", "message": {"text": "FastAPI POST `quick_add_word` without auth dependency \u2014 routes/imports.py:168"}, "properties": {"repobilityId": "9df8d34609a45431", "scanner": "scanner-primary", "fingerprint": "b30e2e84ffee8232", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/imports.py"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-0ce7900d92a5d725", "level": "error", "message": {"text": "FastAPI POST `create_deck` without auth dependency \u2014 routes/decks.py:99"}, "properties": {"repobilityId": "3b83fb214933a161", "scanner": "scanner-primary", "fingerprint": "0ce7900d92a5d725", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-3a9208706842dbea", "level": "error", "message": {"text": "FastAPI DELETE `delete_deck` without auth dependency \u2014 routes/decks.py:112"}, "properties": {"repobilityId": "224332f33c48223b", "scanner": "scanner-primary", "fingerprint": "3a9208706842dbea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-e880c7a6ee1a8a51", "level": "error", "message": {"text": "FastAPI DELETE `clear_deck_cards` without auth dependency \u2014 routes/decks.py:121"}, "properties": {"repobilityId": "c645a32d2f2ef135", "scanner": "scanner-primary", "fingerprint": "e880c7a6ee1a8a51", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-ffbd2262159e2adb", "level": "error", "message": {"text": "FastAPI POST `restore_deck` without auth dependency \u2014 routes/decks.py:133"}, "properties": {"repobilityId": "7fc684c890ced304", "scanner": "scanner-primary", "fingerprint": "ffbd2262159e2adb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-831b23d15cead3b3", "level": "error", "message": {"text": "FastAPI DELETE `purge_deck` without auth dependency \u2014 routes/decks.py:139"}, "properties": {"repobilityId": "e15789bb77f9cda1", "scanner": "scanner-primary", "fingerprint": "831b23d15cead3b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-10c1547228df1fe2", "level": "error", "message": {"text": "FastAPI POST `toggle_creating_suspension` without auth dependency \u2014 routes/decks.py:145"}, "properties": {"repobilityId": "ce549d9a9936d017", "scanner": "scanner-primary", "fingerprint": "10c1547228df1fe2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-de110efdf054c9bf", "level": "error", "message": {"text": "FastAPI POST `toggle_category_suspension` without auth dependency \u2014 routes/decks.py:150"}, "properties": {"repobilityId": "7c198642c8e3ec7f", "scanner": "scanner-primary", "fingerprint": "de110efdf054c9bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-43903e18792d2d0c", "level": "error", "message": {"text": "FastAPI POST `toggle_deck_all_suspension` without auth dependency \u2014 routes/decks.py:155"}, "properties": {"repobilityId": "cc8f5a6e80d74a4a", "scanner": "scanner-primary", "fingerprint": "43903e18792d2d0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-5bc5631f76b984ef", "level": "error", "message": {"text": "FastAPI POST `restore_trashed_card` without auth dependency \u2014 routes/decks.py:160"}, "properties": {"repobilityId": "29dbe1331183213f", "scanner": "scanner-primary", "fingerprint": "5bc5631f76b984ef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-5121f0dc24b36ba4", "level": "error", "message": {"text": "FastAPI DELETE `purge_trashed_card` without auth dependency \u2014 routes/decks.py:166"}, "properties": {"repobilityId": "50e926272c20d125", "scanner": "scanner-primary", "fingerprint": "5121f0dc24b36ba4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-b1894e1917386b89", "level": "error", "message": {"text": "FastAPI DELETE `purge_all_cards_from_trash_deck` without auth dependency \u2014 routes/decks.py:172"}, "properties": {"repobilityId": "d3a437c384004480", "scanner": "scanner-primary", "fingerprint": "b1894e1917386b89", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-7f16a9ed069bae8e", "level": "error", "message": {"text": "FastAPI DELETE `purge_card_from_trash_deck` without auth dependency \u2014 routes/decks.py:178"}, "properties": {"repobilityId": "d9330b4ab12c29ef", "scanner": "scanner-primary", "fingerprint": "7f16a9ed069bae8e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-e4693be9251ca598", "level": "error", "message": {"text": "FastAPI DELETE `empty_trash` without auth dependency \u2014 routes/decks.py:184"}, "properties": {"repobilityId": "25f7cef947daedc2", "scanner": "scanner-primary", "fingerprint": "e4693be9251ca598", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-e8474c704c10fde4", "level": "error", "message": {"text": "FastAPI PUT `update_deck` without auth dependency \u2014 routes/decks.py:193"}, "properties": {"repobilityId": "c95c45af668720a4", "scanner": "scanner-primary", "fingerprint": "e8474c704c10fde4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-8cc0fab27f6f763e", "level": "error", "message": {"text": "FastAPI POST `create_preset` without auth dependency \u2014 routes/decks.py:209"}, "properties": {"repobilityId": "a3cda20325b93efe", "scanner": "scanner-primary", "fingerprint": "8cc0fab27f6f763e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-b21fa56573faa4f8", "level": "error", "message": {"text": "FastAPI DELETE `delete_preset` without auth dependency \u2014 routes/decks.py:219"}, "properties": {"repobilityId": "6fe16ba1b33b537e", "scanner": "scanner-primary", "fingerprint": "b21fa56573faa4f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 219}}}]}, {"ruleId": "scanner-60f1fad75a4a646e", "level": "error", "message": {"text": "FastAPI PUT `update_deck_preset` without auth dependency \u2014 routes/decks.py:235"}, "properties": {"repobilityId": "b8214affe1fe9d6a", "scanner": "scanner-primary", "fingerprint": "60f1fad75a4a646e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-5b400f8e43a839be", "level": "error", "message": {"text": "FastAPI PUT `assign_preset_to_deck` without auth dependency \u2014 routes/decks.py:243"}, "properties": {"repobilityId": "4b218efa389cf99d", "scanner": "scanner-primary", "fingerprint": "5b400f8e43a839be", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-b65a9eb958063d1b", "level": "error", "message": {"text": "FastAPI POST `toggle_bury_siblings` without auth dependency \u2014 routes/decks.py:249"}, "properties": {"repobilityId": "e5cbceb4d77500cc", "scanner": "scanner-primary", "fingerprint": "b65a9eb958063d1b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 249}}}]}, {"ruleId": "scanner-4f803af39c1e9e76", "level": "error", "message": {"text": "FastAPI POST `toggle_new_review_order` without auth dependency \u2014 routes/decks.py:261"}, "properties": {"repobilityId": "c2153d78b01cfcab", "scanner": "scanner-primary", "fingerprint": "4f803af39c1e9e76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-9db174e0be36bc5a", "level": "error", "message": {"text": "FastAPI POST `set_deck_preset_as_default` without auth dependency \u2014 routes/decks.py:273"}, "properties": {"repobilityId": "32461ed99257a7a8", "scanner": "scanner-primary", "fingerprint": "9db174e0be36bc5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-f380b720a50c9a69", "level": "error", "message": {"text": "FastAPI PUT `set_preset_category_override` without auth dependency \u2014 routes/decks.py:300"}, "properties": {"repobilityId": "fc10fff748d5d7ba", "scanner": "scanner-primary", "fingerprint": "f380b720a50c9a69", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-30335c98a8c81108", "level": "error", "message": {"text": "FastAPI DELETE `delete_preset_category_override` without auth dependency \u2014 routes/decks.py:310"}, "properties": {"repobilityId": "3263fd78656f0df3", "scanner": "scanner-primary", "fingerprint": "30335c98a8c81108", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/decks.py"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-b0978bcbd110a268", "level": "error", "message": {"text": "FastAPI POST `trigger_import` without auth dependency \u2014 routes/browse.py:16"}, "properties": {"repobilityId": "13021a5849999172", "scanner": "scanner-primary", "fingerprint": "b0978bcbd110a268", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-0244f06de26fc414", "level": "error", "message": {"text": "FastAPI PUT `update_word` without auth dependency \u2014 routes/browse.py:29"}, "properties": {"repobilityId": "114c525ae5e5d64b", "scanner": "scanner-primary", "fingerprint": "0244f06de26fc414", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-03cb5917463883c2", "level": "error", "message": {"text": "FastAPI POST `regenerate_word_fields` without auth dependency \u2014 routes/browse.py:223"}, "properties": {"repobilityId": "a15aa08039a2daf6", "scanner": "scanner-primary", "fingerprint": "03cb5917463883c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-14248c4fb83141c1", "level": "error", "message": {"text": "FastAPI POST `apply_regen_result` without auth dependency \u2014 routes/browse.py:257"}, "properties": {"repobilityId": "29d75c739047bd53", "scanner": "scanner-primary", "fingerprint": "14248c4fb83141c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-bb3ef0cfb000ce8d", "level": "error", "message": {"text": "FastAPI POST `ai_enrich_word` without auth dependency \u2014 routes/browse.py:278"}, "properties": {"repobilityId": "2938d3c5f76bb22b", "scanner": "scanner-primary", "fingerprint": "bb3ef0cfb000ce8d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-5d8337b41a98bd3d", "level": "error", "message": {"text": "FastAPI POST `regenerate_hanzi_info` without auth dependency \u2014 routes/browse.py:324"}, "properties": {"repobilityId": "8ac14a40dff4b536", "scanner": "scanner-primary", "fingerprint": "5d8337b41a98bd3d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 324}}}]}, {"ruleId": "scanner-f98997d579621893", "level": "error", "message": {"text": "FastAPI PUT `update_hanzi` without auth dependency \u2014 routes/browse.py:348"}, "properties": {"repobilityId": "b3539c18e89220ee", "scanner": "scanner-primary", "fingerprint": "f98997d579621893", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-98d447d538d5e4ff", "level": "error", "message": {"text": "FastAPI POST `toggle_suspend` without auth dependency \u2014 routes/browse.py:380"}, "properties": {"repobilityId": "bd5a96978a075ea8", "scanner": "scanner-primary", "fingerprint": "98d447d538d5e4ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 380}}}]}, {"ruleId": "scanner-22cfc230fe5db9ea", "level": "error", "message": {"text": "FastAPI POST `leech_card_endpoint` without auth dependency \u2014 routes/browse.py:385"}, "properties": {"repobilityId": "6a90d1651e15a4ce", "scanner": "scanner-primary", "fingerprint": "22cfc230fe5db9ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 385}}}]}, {"ruleId": "scanner-d3ec4ef7175cb4c6", "level": "error", "message": {"text": "FastAPI POST `reset_card_endpoint` without auth dependency \u2014 routes/browse.py:392"}, "properties": {"repobilityId": "221e901a143b5aa7", "scanner": "scanner-primary", "fingerprint": "d3ec4ef7175cb4c6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 392}}}]}, {"ruleId": "scanner-e693b2b85d2468e2", "level": "error", "message": {"text": "FastAPI POST `bury_card_endpoint` without auth dependency \u2014 routes/browse.py:397"}, "properties": {"repobilityId": "bd375ccb10075988", "scanner": "scanner-primary", "fingerprint": "e693b2b85d2468e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 397}}}]}, {"ruleId": "scanner-ac7b58d12dfe673c", "level": "error", "message": {"text": "FastAPI DELETE `delete_card_endpoint` without auth dependency \u2014 routes/browse.py:404"}, "properties": {"repobilityId": "e86ac2c85ad92ac4", "scanner": "scanner-primary", "fingerprint": "ac7b58d12dfe673c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 404}}}]}, {"ruleId": "scanner-3070ab8739898667", "level": "error", "message": {"text": "FastAPI POST `bulk_bury` without auth dependency \u2014 routes/browse.py:413"}, "properties": {"repobilityId": "144e22a4fed413f9", "scanner": "scanner-primary", "fingerprint": "3070ab8739898667", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 413}}}]}, {"ruleId": "scanner-783a0f937e6bc39d", "level": "error", "message": {"text": "FastAPI POST `bulk_suspend` without auth dependency \u2014 routes/browse.py:420"}, "properties": {"repobilityId": "c4eb0bbe84526527", "scanner": "scanner-primary", "fingerprint": "783a0f937e6bc39d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 420}}}]}, {"ruleId": "scanner-c8f4ef698a0ef152", "level": "error", "message": {"text": "FastAPI POST `bulk_delete` without auth dependency \u2014 routes/browse.py:427"}, "properties": {"repobilityId": "1ae1f1c599612ebc", "scanner": "scanner-primary", "fingerprint": "c8f4ef698a0ef152", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 427}}}]}, {"ruleId": "scanner-54c907b590938d68", "level": "error", "message": {"text": "FastAPI POST `move_card` without auth dependency \u2014 routes/browse.py:434"}, "properties": {"repobilityId": "e0296641bf31644b", "scanner": "scanner-primary", "fingerprint": "54c907b590938d68", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 434}}}]}, {"ruleId": "scanner-26683ff2e64fbbd1", "level": "error", "message": {"text": "FastAPI POST `bulk_move` without auth dependency \u2014 routes/browse.py:445"}, "properties": {"repobilityId": "902bf7164e15aa77", "scanner": "scanner-primary", "fingerprint": "26683ff2e64fbbd1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 445}}}]}, {"ruleId": "scanner-b34de70a2c39e563", "level": "error", "message": {"text": "FastAPI POST `add_entry_to_deck` without auth dependency \u2014 routes/browse.py:454"}, "properties": {"repobilityId": "55c766ce2e598ee9", "scanner": "scanner-primary", "fingerprint": "b34de70a2c39e563", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/browse.py"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-43bf8fff2359e981", "level": "error", "message": {"text": "FastAPI POST `regenerate_story` without auth dependency \u2014 routes/story.py:229"}, "properties": {"repobilityId": "4bd064f56395faba", "scanner": "scanner-primary", "fingerprint": "43bf8fff2359e981", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/story.py"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-4e24fbfc77805dd0", "level": "error", "message": {"text": "FastAPI POST `speak` without auth dependency \u2014 routes/story.py:405"}, "properties": {"repobilityId": "d721fed25e2acca7", "scanner": "scanner-primary", "fingerprint": "4e24fbfc77805dd0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/story.py"}, "region": {"startLine": 405}}}]}, {"ruleId": "scanner-ef46161e1f474b58", "level": "error", "message": {"text": "FastAPI POST `speak_multi` without auth dependency \u2014 routes/story.py:414"}, "properties": {"repobilityId": "5040c28e6941176a", "scanner": "scanner-primary", "fingerprint": "ef46161e1f474b58", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/story.py"}, "region": {"startLine": 414}}}]}, {"ruleId": "scanner-06d5a2bf80258081", "level": "error", "message": {"text": "FastAPI POST `speak_stop` without auth dependency \u2014 routes/story.py:428"}, "properties": {"repobilityId": "482bc9261579309d", "scanner": "scanner-primary", "fingerprint": "06d5a2bf80258081", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/story.py"}, "region": {"startLine": 428}}}]}, {"ruleId": "scanner-50600fab29a50f96", "level": "error", "message": {"text": "FastAPI POST `preload` without auth dependency \u2014 routes/story.py:434"}, "properties": {"repobilityId": "601b1cefe1bd85b2", "scanner": "scanner-primary", "fingerprint": "50600fab29a50f96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/story.py"}, "region": {"startLine": 434}}}]}, {"ruleId": "scanner-223fec08b04691ba", "level": "error", "message": {"text": "FastAPI POST `preload_session` without auth dependency \u2014 routes/story.py:443"}, "properties": {"repobilityId": "dda1b55dfa5c0901", "scanner": "scanner-primary", "fingerprint": "223fec08b04691ba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "routes/story.py"}, "region": {"startLine": 443}}}]}, {"ruleId": "scanner-63dcd683d9c21186", "level": "error", "message": {"text": "Dangling fetch: POST /api/preload-session/${rootDeckId}/unified (static/app.js:2881)"}, "properties": {"repobilityId": "f1c5a3cdac997d15", "scanner": "scanner-primary", "fingerprint": "63dcd683d9c21186", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-488853bcc68f13f1", "level": "error", "message": {"text": "Dangling fetch: POST /api/preload-session/${firstDeckId}/unified (static/app.js:2951)"}, "properties": {"repobilityId": "8570b2588f446118", "scanner": "scanner-primary", "fingerprint": "488853bcc68f13f1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e70561f369eeef64", "level": "error", "message": {"text": "Dangling fetch: GET /api/story/${storyDeckId}/unified (static/app.js:3043)"}, "properties": {"repobilityId": "2d396d5dfb76d1da", "scanner": "scanner-primary", "fingerprint": "e70561f369eeef64", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6d2a6c6d1a026ac1", "level": "error", "message": {"text": "Dangling fetch: POST /api/preload-session/${storyDeckId}/unified (static/app.js:3047)"}, "properties": {"repobilityId": "f236cbc1abe3fe2a", "scanner": "scanner-primary", "fingerprint": "6d2a6c6d1a026ac1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0a2da680021e2602", "level": "error", "message": {"text": "Dangling fetch: GET /static/hsk_levels.json (static/app.js:4206)"}, "properties": {"repobilityId": "48cd44e1b74f63dd", "scanner": "scanner-primary", "fingerprint": "0a2da680021e2602", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "6b8de433dc23649f", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a150389b9fa495a", "level": "note", "message": {"text": "Unused endpoint: GET /api/today/{deck_id}/{category}"}, "properties": {"repobilityId": "c66de4d8b52bf241", "scanner": "scanner-primary", "fingerprint": "4a150389b9fa495a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a428cd8adfe4fe76", "level": "note", "message": {"text": "Unused endpoint: GET /api/today-unfinished"}, "properties": {"repobilityId": "92d99f8e26076349", "scanner": "scanner-primary", "fingerprint": "a428cd8adfe4fe76", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f012f92967d5e46b", "level": "note", "message": {"text": "Unused endpoint: GET /api/today-unfinished-decks"}, "properties": {"repobilityId": "f1bc21eda81ad34d", "scanner": "scanner-primary", "fingerprint": "f012f92967d5e46b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9fc24a0b341e6090", "level": "note", "message": {"text": "Unused endpoint: GET /api/today-mixed/{deck_id}"}, "properties": {"repobilityId": "2b56ead01870cac4", "scanner": "scanner-primary", "fingerprint": "9fc24a0b341e6090", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ab6f23e840707c3", "level": "note", "message": {"text": "Unused endpoint: POST /api/review"}, "properties": {"repobilityId": "84736d12bfa20f88", "scanner": "scanner-primary", "fingerprint": "3ab6f23e840707c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a44e8c195245f5e", "level": "note", "message": {"text": "Unused endpoint: POST /api/review/undo"}, "properties": {"repobilityId": "7ac18d9a2de15fbf", "scanner": "scanner-primary", "fingerprint": "4a44e8c195245f5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8999ee3ca1966cfd", "level": "note", "message": {"text": "Unused endpoint: POST /api/cards/{card_id}/bury"}, "properties": {"repobilityId": "61ee8299f8589a07", "scanner": "scanner-primary", "fingerprint": "8999ee3ca1966cfd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-985cea48267af0e6", "level": "note", "message": {"text": "Unused endpoint: POST /api/cards/{card_id}/unbury"}, "properties": {"repobilityId": "aaaf689ae93728a9", "scanner": "scanner-primary", "fingerprint": "985cea48267af0e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-421d15b684edec8f", "level": "note", "message": {"text": "Unused endpoint: GET /api/cards/{card_id}/calendar"}, "properties": {"repobilityId": "9f18d1df83264daf", "scanner": "scanner-primary", "fingerprint": "421d15b684edec8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1637f28d9faf8601", "level": "note", "message": {"text": "Unused endpoint: GET /api/cards/{card_id}/timeline"}, "properties": {"repobilityId": "1cc59d814f8a712a", "scanner": "scanner-primary", "fingerprint": "1637f28d9faf8601", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67689312cc46d055", "level": "note", "message": {"text": "Unused endpoint: POST /api/session-timelines"}, "properties": {"repobilityId": "ae35b2ca6b362080", "scanner": "scanner-primary", "fingerprint": "67689312cc46d055", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-105dc05772ad3704", "level": "note", "message": {"text": "Unused endpoint: POST /api/quick-add-word"}, "properties": {"repobilityId": "bd6a32e7bc964661", "scanner": "scanner-primary", "fingerprint": "105dc05772ad3704", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-37a35e38d302bff6", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks"}, "properties": {"repobilityId": "1b7530c8e26be83c", "scanner": "scanner-primary", "fingerprint": "37a35e38d302bff6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6de4ee32a40b4982", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/decks/{deck_id}"}, "properties": {"repobilityId": "6536a8adfb11e4ce", "scanner": "scanner-primary", "fingerprint": "6de4ee32a40b4982", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee2ef5f146a9fd05", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/decks/{deck_id}/cards"}, "properties": {"repobilityId": "e6d0520270fd448d", "scanner": "scanner-primary", "fingerprint": "ee2ef5f146a9fd05", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a980efae5cb10c5", "level": "note", "message": {"text": "Unused endpoint: GET /api/trash"}, "properties": {"repobilityId": "34a2fd4074465e7c", "scanner": "scanner-primary", "fingerprint": "3a980efae5cb10c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a279b3202077b41a", "level": "note", "message": {"text": "Unused endpoint: POST /api/trash/{deck_id}/restore"}, "properties": {"repobilityId": "2adadb16c34b85aa", "scanner": "scanner-primary", "fingerprint": "a279b3202077b41a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b9b0d65c133d22f2", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/trash/{deck_id}"}, "properties": {"repobilityId": "a98d84acb5013452", "scanner": "scanner-primary", "fingerprint": "b9b0d65c133d22f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e631091e495831f6", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks/{deck_id}/creating/toggle-suspension"}, "properties": {"repobilityId": "c43b5e4f548670cf", "scanner": "scanner-primary", "fingerprint": "e631091e495831f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6229ea67dbde5d7f", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks/{deck_id}/categories/{category}/toggle-suspension"}, "properties": {"repobilityId": "2d0892a92cd24a63", "scanner": "scanner-primary", "fingerprint": "6229ea67dbde5d7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb8c85011e2ec1e2", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks/{deck_id}/toggle-all-suspension"}, "properties": {"repobilityId": "401acf340d3b6df4", "scanner": "scanner-primary", "fingerprint": "eb8c85011e2ec1e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e7c0a5662744268", "level": "note", "message": {"text": "Unused endpoint: POST /api/trash/cards/{card_id}/restore"}, "properties": {"repobilityId": "0b449d3d841aac83", "scanner": "scanner-primary", "fingerprint": "0e7c0a5662744268", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1e45d55e461e96a", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/trash/cards/{card_id}"}, "properties": {"repobilityId": "7645fe7aae6398d1", "scanner": "scanner-primary", "fingerprint": "e1e45d55e461e96a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6160fc231608d52d", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/trash/{deck_id}/cards"}, "properties": {"repobilityId": "4b5387c4564dd409", "scanner": "scanner-primary", "fingerprint": "6160fc231608d52d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52a87478cbc32c51", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/trash/{deck_id}/cards/{card_id}"}, "properties": {"repobilityId": "e61c6fb4a4af0eb7", "scanner": "scanner-primary", "fingerprint": "52a87478cbc32c51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f5aa0a1e9ab4119b", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/trash"}, "properties": {"repobilityId": "e99ca5417fc96f6c", "scanner": "scanner-primary", "fingerprint": "f5aa0a1e9ab4119b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e67c5b8c8f9af160", "level": "note", "message": {"text": "Unused endpoint: PUT /api/decks/{deck_id}"}, "properties": {"repobilityId": "31a0e117a8e21d75", "scanner": "scanner-primary", "fingerprint": "e67c5b8c8f9af160", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9776d2893644070b", "level": "note", "message": {"text": "Unused endpoint: GET /api/presets"}, "properties": {"repobilityId": "4d7b3d9f7e30bfb1", "scanner": "scanner-primary", "fingerprint": "9776d2893644070b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-474c7bb7a9ad0e2e", "level": "note", "message": {"text": "Unused endpoint: POST /api/presets"}, "properties": {"repobilityId": "353042c278199931", "scanner": "scanner-primary", "fingerprint": "474c7bb7a9ad0e2e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a911366c03f267e", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/presets/{preset_id}"}, "properties": {"repobilityId": "7ad360b4996ff328", "scanner": "scanner-primary", "fingerprint": "3a911366c03f267e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-54093ee8ee0c251a", "level": "note", "message": {"text": "Unused endpoint: GET /api/decks/{deck_id}/preset"}, "properties": {"repobilityId": "3e7f22a182b508ae", "scanner": "scanner-primary", "fingerprint": "54093ee8ee0c251a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9732c9fd9e1c3cb", "level": "note", "message": {"text": "Unused endpoint: PUT /api/decks/{deck_id}/preset"}, "properties": {"repobilityId": "3846bce0d1370293", "scanner": "scanner-primary", "fingerprint": "f9732c9fd9e1c3cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-729224d437d4b773", "level": "note", "message": {"text": "Unused endpoint: PUT /api/decks/{deck_id}/preset/assign"}, "properties": {"repobilityId": "71357a9e7ce7b442", "scanner": "scanner-primary", "fingerprint": "729224d437d4b773", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db9cca2c82c28bfe", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks/{deck_id}/preset/toggle-bury"}, "properties": {"repobilityId": "bc764e10b5c6cb94", "scanner": "scanner-primary", "fingerprint": "db9cca2c82c28bfe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9b0f84fa4b000086", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks/{deck_id}/preset/toggle-mix"}, "properties": {"repobilityId": "0a85685343a5cf3d", "scanner": "scanner-primary", "fingerprint": "9b0f84fa4b000086", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-56afd5b07e7423f4", "level": "note", "message": {"text": "Unused endpoint: POST /api/decks/{deck_id}/preset/set-default"}, "properties": {"repobilityId": "ade68564e1ee218a", "scanner": "scanner-primary", "fingerprint": "56afd5b07e7423f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5a508e054d167735", "level": "note", "message": {"text": "Unused endpoint: GET /api/presets/{preset_id}/categories"}, "properties": {"repobilityId": "93dc1ecbef2b2640", "scanner": "scanner-primary", "fingerprint": "5a508e054d167735", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c9598c06bd63083", "level": "note", "message": {"text": "Unused endpoint: GET /api/presets/{preset_id}/categories/{category}"}, "properties": {"repobilityId": "d4fe639b9a6c0c6e", "scanner": "scanner-primary", "fingerprint": "4c9598c06bd63083", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61dec779ac41713c", "level": "note", "message": {"text": "Unused endpoint: PUT /api/presets/{preset_id}/categories/{category}"}, "properties": {"repobilityId": "80a8f291d5733529", "scanner": "scanner-primary", "fingerprint": "61dec779ac41713c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1380189a97dd769c", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/presets/{preset_id}/categories/{category}"}, "properties": {"repobilityId": "ccd83cedc6bcf594", "scanner": "scanner-primary", "fingerprint": "1380189a97dd769c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee9829911d5cd293", "level": "note", "message": {"text": "Unused endpoint: POST /api/import"}, "properties": {"repobilityId": "2c223adf00ee3bf7", "scanner": "scanner-primary", "fingerprint": "ee9829911d5cd293", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd720e0a51da85d0", "level": "note", "message": {"text": "Unused endpoint: PUT /api/word/{word_id}"}, "properties": {"repobilityId": "4d20d93358b4bdbc", "scanner": "scanner-primary", "fingerprint": "fd720e0a51da85d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a095199c6143e89f", "level": "note", "message": {"text": "Unused endpoint: POST /api/word/{word_id}/regenerate-fields"}, "properties": {"repobilityId": "f508183414057acc", "scanner": "scanner-primary", "fingerprint": "a095199c6143e89f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b9571307662a6565", "level": "note", "message": {"text": "Unused endpoint: POST /api/word/{word_id}/apply-regen-result"}, "properties": {"repobilityId": "63dd9cab444f40d9", "scanner": "scanner-primary", "fingerprint": "b9571307662a6565", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-de19da0d6dc7112f", "level": "note", "message": {"text": "Unused endpoint: POST /api/word/{word_id}/ai-enrich"}, "properties": {"repobilityId": "3fd7782f75dcff73", "scanner": "scanner-primary", "fingerprint": "de19da0d6dc7112f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-174b63c70f5410c8", "level": "note", "message": {"text": "Unused endpoint: GET /api/browse-words"}, "properties": {"repobilityId": "36553533f8b77a5a", "scanner": "scanner-primary", "fingerprint": "174b63c70f5410c8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f0321d3943d80d3", "level": "note", "message": {"text": "Unused endpoint: GET /api/words/random"}, "properties": {"repobilityId": "9e78c38c93e8418b", "scanner": "scanner-primary", "fingerprint": "3f0321d3943d80d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-39369e17ac723178", "level": "note", "message": {"text": "Unused endpoint: GET /api/hanzi"}, "properties": {"repobilityId": "4cb59ca4b8b4087a", "scanner": "scanner-primary", "fingerprint": "39369e17ac723178", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e045d810b53bd99b", "level": "note", "message": {"text": "Unused endpoint: GET /api/hanzi/{char_id}"}, "properties": {"repobilityId": "06959859dfcaace2", "scanner": "scanner-primary", "fingerprint": "e045d810b53bd99b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}