{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0b3046646f2e4685", "name": "Possibly dead Python function: generate_password", "shortDescription": {"text": "Possibly dead Python function: generate_password"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b87ae6bef8e45a1", "name": "Possibly dead Python function: as_postgresql", "shortDescription": {"text": "Possibly dead Python function: as_postgresql"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3218b0dbce952234", "name": "Possibly dead Python function: as_sqlite", "shortDescription": {"text": "Possibly dead Python function: as_sqlite"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e81011ef199f990c", "name": "Possibly dead Python function: call_api", "shortDescription": {"text": "Possibly dead Python function: call_api"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c88a193b6b90ab6", "name": "Possibly dead Python function: call_text_gemini", "shortDescription": {"text": "Possibly dead Python function: call_text_gemini"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c016ffcbbb9a3b2", "name": "Possibly dead Python function: call_text_claude", "shortDescription": {"text": "Possibly dead Python function: call_text_claude"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb01685893110a6c", "name": "Possibly dead Python function: call_text_openai", "shortDescription": {"text": "Possibly dead Python function: call_text_openai"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-561f70cca8365ede", "name": "Possibly dead Python function: call_image_gemini", "shortDescription": {"text": "Possibly dead Python function: call_image_gemini"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b6019a923ae8117", "name": "Possibly dead Python function: call_image_claude", "shortDescription": {"text": "Possibly dead Python function: call_image_claude"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3dfdfb04aece8269", "name": "Possibly dead Python function: call_image_openai", "shortDescription": {"text": "Possibly dead Python function: call_image_openai"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e999e86c69fc3e4c", "name": "Possibly dead Python function: call_api", "shortDescription": {"text": "Possibly dead Python function: call_api"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b0554d14b4c92ce", "name": "Possible secret in backend/tools/credentials.sh", "shortDescription": {"text": "Possible secret in backend/tools/credentials.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d404b3a0f48d39ba", "name": "Insecure pattern 'local_storage_auth_token' in website/src/pages/ResetPasswordPage.tsx:55", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in website/src/pages/ResetPasswordPage.tsx:55"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f18855cd347e27d", "name": "Insecure pattern 'local_storage_auth_token' in website/src/pages/LoginPage.tsx:28", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in website/src/pages/LoginPage.tsx:28"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a23519216b02f3a", "name": "Insecure pattern 'local_storage_auth_token' in website/src/pages/RegisterPage.tsx:55", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in website/src/pages/RegisterPage.tsx:55"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12ce06245bde6b3e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a624e856cc357318", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf95dca2d4eb0c34", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd053160247fe258", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-921298b183f5782d", "name": "Very large file: backend/user_system/views.py (1567 lines)", "shortDescription": {"text": "Very large file: backend/user_system/views.py (1567 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8227e835b19db95", "name": "Commented-code block (5 lines) in backend/user_system/admin.py:47", "shortDescription": {"text": "Commented-code block (5 lines) in backend/user_system/admin.py:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-089eae412c8a1040", "name": "Commented-code block (5 lines) in backend/user_system/views.py:1412", "shortDescription": {"text": "Commented-code block (5 lines) in backend/user_system/views.py:1412"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a78f6076b01756e", "name": "Commented-code block (5 lines) in backend/user_system/models.py:74", "shortDescription": {"text": "Commented-code block (5 lines) in backend/user_system/models.py:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85c09d6ac2abcd52", "name": "Commented-code block (5 lines) in backend/user_system/tests/test_like_comment_view.py:19", "shortDescription": {"text": "Commented-code block (5 lines) in backend/user_system/tests/test_like_comment_view.py:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52ed874830fdca73", "name": "Commented-code block (5 lines) in backend/user_system/tests/test_login_remember_me_view.py:20", "shortDescription": {"text": "Commented-code block (5 lines) in backend/user_system/tests/test_login_remember_me_view.py:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-969fc88bd5ebc44e", "name": "Commented-code block (5 lines) in backend/user_system/classifiers/classifier_constants.py:11", "shortDescription": {"text": "Commented-code block (5 lines) in backend/user_system/classifiers/classifier_constants.py:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28758cc0ec252100", "name": "Commented-code block (5 lines) in website/src/components/CharacterCounter.tsx:10", "shortDescription": {"text": "Commented-code block (5 lines) in website/src/components/CharacterCounter.tsx:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d56fd8204621c9bc", "name": "Commented-code block (6 lines) in website/src/pages/PostDetailPage.tsx:94", "shortDescription": {"text": "Commented-code block (6 lines) in website/src/pages/PostDetailPage.tsx:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/user_system/views.py:get_user_with_username_and_email, backend/user_system/views.py:get_user_with_username\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5c267a258b0dc26", "name": "Frontend route `/post/:postId` has no Link/navigate to it \u2014 website/src/pages/ProfilePage.test.tsx", "shortDescription": {"text": "Frontend route `/post/:postId` has no Link/navigate to it \u2014 website/src/pages/ProfilePage.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-643cd1b247522cb1", "name": "Frontend route `/profile/:username` has no Link/navigate to it \u2014 website/src/pages/ProfilePage.test.tsx", "shortDescription": {"text": "Frontend route `/profile/:username` has no Link/navigate to it \u2014 website/src/pages/ProfilePage.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6eda0923cd4e040b", "name": "Django view `verify_identity` may be unauthenticated \u2014 backend/user_system/views.py:329", "shortDescription": {"text": "Django view `verify_identity` may be unauthenticated \u2014 backend/user_system/views.py:329"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d27a8531253f742", "name": "Django view `delete_user` may be unauthenticated \u2014 backend/user_system/views.py:535", "shortDescription": {"text": "Django view `delete_user` may be unauthenticated \u2014 backend/user_system/views.py:535"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-162868969e6519bf", "name": "Django view `request_reset` may be unauthenticated \u2014 backend/user_system/views.py:557", "shortDescription": {"text": "Django view `request_reset` may be unauthenticated \u2014 backend/user_system/views.py:557"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe8a066cc68c258c", "name": "Django view `verify_reset` may be unauthenticated \u2014 backend/user_system/views.py:599", "shortDescription": {"text": "Django view `verify_reset` may be unauthenticated \u2014 backend/user_system/views.py:599"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b2f8e7fc3666b7e", "name": "Django view `make_post` may be unauthenticated \u2014 backend/user_system/views.py:751", "shortDescription": {"text": "Django view `make_post` may be unauthenticated \u2014 backend/user_system/views.py:751"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5af9d8e0dfd38f33", "name": "Django view `delete_post` may be unauthenticated \u2014 backend/user_system/views.py:803", "shortDescription": {"text": "Django view `delete_post` may be unauthenticated \u2014 backend/user_system/views.py:803"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4aada92525b9381", "name": "Django view `report_post` may be unauthenticated \u2014 backend/user_system/views.py:823", "shortDescription": {"text": "Django view `report_post` may be unauthenticated \u2014 backend/user_system/views.py:823"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2780ade4cf101b5", "name": "Django view `like_post` may be unauthenticated \u2014 backend/user_system/views.py:869", "shortDescription": {"text": "Django view `like_post` may be unauthenticated \u2014 backend/user_system/views.py:869"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a13a6cd720a55c0", "name": "Django view `unlike_post` may be unauthenticated \u2014 backend/user_system/views.py:899", "shortDescription": {"text": "Django view `unlike_post` may be unauthenticated \u2014 backend/user_system/views.py:899"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f1ee58e6c2a0ce9", "name": "Django view `get_posts_in_feed` may be unauthenticated \u2014 backend/user_system/views.py:931", "shortDescription": {"text": "Django view `get_posts_in_feed` may be unauthenticated \u2014 backend/user_system/views.py:931"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0894228368ce386e", "name": "Django view `get_posts_for_followed_users` may be unauthenticated \u2014 backend/user_system/views.py:965", "shortDescription": {"text": "Django view `get_posts_for_followed_users` may be unauthenticated \u2014 backend/user_system/views.py:965"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0021cebc0eb2569d", "name": "Django view `get_posts_for_user` may be unauthenticated \u2014 backend/user_system/views.py:1002", "shortDescription": {"text": "Django view `get_posts_for_user` may be unauthenticated \u2014 backend/user_system/views.py:1002"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d54508c94c59e615", "name": "Django view `get_post_details` may be unauthenticated \u2014 backend/user_system/views.py:1043", "shortDescription": {"text": "Django view `get_post_details` may be unauthenticated \u2014 backend/user_system/views.py:1043"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a3433aa39cbce44", "name": "Django view `comment_on_post` may be unauthenticated \u2014 backend/user_system/views.py:1073", "shortDescription": {"text": "Django view `comment_on_post` may be unauthenticated \u2014 backend/user_system/views.py:1073"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27ee54c76381c990", "name": "Django view `reply_to_comment_thread` may be unauthenticated \u2014 backend/user_system/views.py:1113", "shortDescription": {"text": "Django view `reply_to_comment_thread` may be unauthenticated \u2014 backend/user_system/views.py:1113"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68a191df643ccca5", "name": "Django view `like_comment` may be unauthenticated \u2014 backend/user_system/views.py:1156", "shortDescription": {"text": "Django view `like_comment` may be unauthenticated \u2014 backend/user_system/views.py:1156"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83385cdf1edc8640", "name": "Django view `unlike_comment` may be unauthenticated \u2014 backend/user_system/views.py:1196", "shortDescription": {"text": "Django view `unlike_comment` may be unauthenticated \u2014 backend/user_system/views.py:1196"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-677f68a17f8db9c3", "name": "Django view `delete_comment` may be unauthenticated \u2014 backend/user_system/views.py:1236", "shortDescription": {"text": "Django view `delete_comment` may be unauthenticated \u2014 backend/user_system/views.py:1236"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e515a3b3e2b00587", "name": "Django view `report_comment` may be unauthenticated \u2014 backend/user_system/views.py:1272", "shortDescription": {"text": "Django view `report_comment` may be unauthenticated \u2014 backend/user_system/views.py:1272"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e8dcc8e9d00318a", "name": "Django view `get_users_matching_fragment` may be unauthenticated \u2014 backend/user_system/views.py:1400", "shortDescription": {"text": "Django view `get_users_matching_fragment` may be unauthenticated \u2014 backend/user_system/views.py:1400"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4888a4f727b8a91f", "name": "Django view `follow_user` may be unauthenticated \u2014 backend/user_system/views.py:1435", "shortDescription": {"text": "Django view `follow_user` may be unauthenticated \u2014 backend/user_system/views.py:1435"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a09ae0193a5dcd8b", "name": "Django view `unfollow_user` may be unauthenticated \u2014 backend/user_system/views.py:1460", "shortDescription": {"text": "Django view `unfollow_user` may be unauthenticated \u2014 backend/user_system/views.py:1460"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d38717d590254f4", "name": "Django view `toggle_block` may be unauthenticated \u2014 backend/user_system/views.py:1482", "shortDescription": {"text": "Django view `toggle_block` may be unauthenticated \u2014 backend/user_system/views.py:1482"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5864eca66201423", "name": "Django view `get_profile_details` may be unauthenticated \u2014 backend/user_system/views.py:1515", "shortDescription": {"text": "Django view `get_profile_details` may be unauthenticated \u2014 backend/user_system/views.py:1515"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c20e301da91c004", "name": "Django view `health` may be unauthenticated \u2014 backend/pos_backend/views.py:4", "shortDescription": {"text": "Django view `health` may be unauthenticated \u2014 backend/pos_backend/views.py:4"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf2370ef9478ffcf", "name": "Django view `ratelimited` may be unauthenticated \u2014 backend/pos_backend/views.py:9", "shortDescription": {"text": "Django view `ratelimited` may be unauthenticated \u2014 backend/pos_backend/views.py:9"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24187"}, "properties": {"repository": "andrewkatson/pos", "repoUrl": "https://github.com/andrewkatson/pos", "branch": "main"}, "results": [{"ruleId": "scanner-0b3046646f2e4685", "level": "note", "message": {"text": "Possibly dead Python function: generate_password"}, "properties": {"repobilityId": "23eb6ca3b7bc7308", "scanner": "scanner-primary", "fingerprint": "0b3046646f2e4685", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/utils.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b87ae6bef8e45a1", "level": "note", "message": {"text": "Possibly dead Python function: as_postgresql"}, "properties": {"repobilityId": "5eef351f59b1ca3d", "scanner": "scanner-primary", "fingerprint": "2b87ae6bef8e45a1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/feed_algorithm/feed_algorithm.py:19"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3218b0dbce952234", "level": "note", "message": {"text": "Possibly dead Python function: as_sqlite"}, "properties": {"repobilityId": "c8c5ed3a6546ed23", "scanner": "scanner-primary", "fingerprint": "3218b0dbce952234", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/feed_algorithm/feed_algorithm.py:26"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e81011ef199f990c", "level": "note", "message": {"text": "Possibly dead Python function: call_api"}, "properties": {"repobilityId": "4717019311934649", "scanner": "scanner-primary", "fingerprint": "e81011ef199f990c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/text_classifier.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c88a193b6b90ab6", "level": "note", "message": {"text": "Possibly dead Python function: call_text_gemini"}, "properties": {"repobilityId": "0809a1fe7fc76d1c", "scanner": "scanner-primary", "fingerprint": "6c88a193b6b90ab6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/classifier_utils.py:126"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c016ffcbbb9a3b2", "level": "note", "message": {"text": "Possibly dead Python function: call_text_claude"}, "properties": {"repobilityId": "b3cb647a96c67756", "scanner": "scanner-primary", "fingerprint": "3c016ffcbbb9a3b2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/classifier_utils.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb01685893110a6c", "level": "note", "message": {"text": "Possibly dead Python function: call_text_openai"}, "properties": {"repobilityId": "0bd8c95c97b0cc2d", "scanner": "scanner-primary", "fingerprint": "cb01685893110a6c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/classifier_utils.py:146"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-561f70cca8365ede", "level": "note", "message": {"text": "Possibly dead Python function: call_image_gemini"}, "properties": {"repobilityId": "9a857313fa03bbe9", "scanner": "scanner-primary", "fingerprint": "561f70cca8365ede", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/classifier_utils.py:164"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b6019a923ae8117", "level": "note", "message": {"text": "Possibly dead Python function: call_image_claude"}, "properties": {"repobilityId": "5ef6b4f85033ebcc", "scanner": "scanner-primary", "fingerprint": "2b6019a923ae8117", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/classifier_utils.py:171"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3dfdfb04aece8269", "level": "note", "message": {"text": "Possibly dead Python function: call_image_openai"}, "properties": {"repobilityId": "4642ec1906a34979", "scanner": "scanner-primary", "fingerprint": "3dfdfb04aece8269", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/classifier_utils.py:189"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e999e86c69fc3e4c", "level": "note", "message": {"text": "Possibly dead Python function: call_api"}, "properties": {"repobilityId": "4717019311934649", "scanner": "scanner-primary", "fingerprint": "e999e86c69fc3e4c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/classifiers/image_classifier.py:104"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b0554d14b4c92ce", "level": "error", "message": {"text": "Possible secret in backend/tools/credentials.sh"}, "properties": {"repobilityId": "58b54f00c14a8a9c", "scanner": "scanner-primary", "fingerprint": "4b0554d14b4c92ce", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/tools/credentials.sh"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-d404b3a0f48d39ba", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in website/src/pages/ResetPasswordPage.tsx:55"}, "properties": {"repobilityId": "36945321b9757f09", "scanner": "scanner-primary", "fingerprint": "d404b3a0f48d39ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/pages/ResetPasswordPage.tsx"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-4f18855cd347e27d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in website/src/pages/LoginPage.tsx:28"}, "properties": {"repobilityId": "74f5755ef5766a46", "scanner": "scanner-primary", "fingerprint": "4f18855cd347e27d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/pages/LoginPage.tsx"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-3a23519216b02f3a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in website/src/pages/RegisterPage.tsx:55"}, "properties": {"repobilityId": "068d2acda88c4f7f", "scanner": "scanner-primary", "fingerprint": "3a23519216b02f3a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/pages/RegisterPage.tsx"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da45b5bbb376e445", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ef549e9d06ca3e1", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "affaee88db168987", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "affaee88db168987", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da45b5bbb376e445", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "07a7a7753fe0840e", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b9156bffd48767a7", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-12ce06245bde6b3e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "affaee88db168987", "scanner": "scanner-primary", "fingerprint": "12ce06245bde6b3e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-tests.yml"}, "region": {"startLine": 275}}}]}, {"ruleId": "scanner-a624e856cc357318", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "33569a630a025b73", "scanner": "scanner-primary", "fingerprint": "a624e856cc357318", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-tests.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-cf95dca2d4eb0c34", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6be7d9507caaa46", "scanner": "scanner-primary", "fingerprint": "cf95dca2d4eb0c34", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/backend-tests.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8a52c296cc086e43", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce1f13b4fe9708a5", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d86069ddefd82cb9", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8a52c296cc086e43", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce1f13b4fe9708a5", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d86069ddefd82cb9", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "003638e459a1998f", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-dd053160247fe258", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ab4c0c50804e8ba", "scanner": "scanner-primary", "fingerprint": "dd053160247fe258", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/android-tests.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-921298b183f5782d", "level": "note", "message": {"text": "Very large file: backend/user_system/views.py (1567 lines)"}, "properties": {"repobilityId": "344d325314d859ff", "scanner": "scanner-primary", "fingerprint": "921298b183f5782d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "eb4c7bc91fa120cb", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b8227e835b19db95", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/user_system/admin.py:47"}, "properties": {"repobilityId": "21df719b8d82ba0a", "scanner": "scanner-primary", "fingerprint": "b8227e835b19db95", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-089eae412c8a1040", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/user_system/views.py:1412"}, "properties": {"repobilityId": "75d16a5cf87ae01a", "scanner": "scanner-primary", "fingerprint": "089eae412c8a1040", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a78f6076b01756e", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/user_system/models.py:74"}, "properties": {"repobilityId": "0caab6761a167698", "scanner": "scanner-primary", "fingerprint": "7a78f6076b01756e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85c09d6ac2abcd52", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/user_system/tests/test_like_comment_view.py:19"}, "properties": {"repobilityId": "4d2608b047579dbb", "scanner": "scanner-primary", "fingerprint": "85c09d6ac2abcd52", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52ed874830fdca73", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/user_system/tests/test_login_remember_me_view.py:20"}, "properties": {"repobilityId": "8ab2769040c50a83", "scanner": "scanner-primary", "fingerprint": "52ed874830fdca73", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-969fc88bd5ebc44e", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/user_system/classifiers/classifier_constants.py:11"}, "properties": {"repobilityId": "f1e3f5bd6f5c901e", "scanner": "scanner-primary", "fingerprint": "969fc88bd5ebc44e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28758cc0ec252100", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/src/components/CharacterCounter.tsx:10"}, "properties": {"repobilityId": "2baa25b2a399dd76", "scanner": "scanner-primary", "fingerprint": "28758cc0ec252100", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d56fd8204621c9bc", "level": "none", "message": {"text": "Commented-code block (6 lines) in website/src/pages/PostDetailPage.tsx:94"}, "properties": {"repobilityId": "6d370eb46999905b", "scanner": "scanner-primary", "fingerprint": "d56fd8204621c9bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4cbedb2fd50472cc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-b5c267a258b0dc26", "level": "warning", "message": {"text": "Frontend route `/post/:postId` has no Link/navigate to it \u2014 website/src/pages/ProfilePage.test.tsx"}, "properties": {"repobilityId": "dfe5fb137e4bca1d", "scanner": "scanner-primary", "fingerprint": "b5c267a258b0dc26", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-643cd1b247522cb1", "level": "warning", "message": {"text": "Frontend route `/profile/:username` has no Link/navigate to it \u2014 website/src/pages/ProfilePage.test.tsx"}, "properties": {"repobilityId": "b34329f04f688fe0", "scanner": "scanner-primary", "fingerprint": "643cd1b247522cb1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6eda0923cd4e040b", "level": "warning", "message": {"text": "Django view `verify_identity` may be unauthenticated \u2014 backend/user_system/views.py:329"}, "properties": {"repobilityId": "7d67c03fb51e248b", "scanner": "scanner-primary", "fingerprint": "6eda0923cd4e040b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 329}}}]}, {"ruleId": "scanner-2d27a8531253f742", "level": "warning", "message": {"text": "Django view `delete_user` may be unauthenticated \u2014 backend/user_system/views.py:535"}, "properties": {"repobilityId": "82a22a5ad54bb176", "scanner": "scanner-primary", "fingerprint": "2d27a8531253f742", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 535}}}]}, {"ruleId": "scanner-162868969e6519bf", "level": "warning", "message": {"text": "Django view `request_reset` may be unauthenticated \u2014 backend/user_system/views.py:557"}, "properties": {"repobilityId": "a07fb7610cb6b917", "scanner": "scanner-primary", "fingerprint": "162868969e6519bf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 557}}}]}, {"ruleId": "scanner-fe8a066cc68c258c", "level": "warning", "message": {"text": "Django view `verify_reset` may be unauthenticated \u2014 backend/user_system/views.py:599"}, "properties": {"repobilityId": "e92f53ce1bd11011", "scanner": "scanner-primary", "fingerprint": "fe8a066cc68c258c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 599}}}]}, {"ruleId": "scanner-9b2f8e7fc3666b7e", "level": "warning", "message": {"text": "Django view `make_post` may be unauthenticated \u2014 backend/user_system/views.py:751"}, "properties": {"repobilityId": "99f0a8dbde7d8111", "scanner": "scanner-primary", "fingerprint": "9b2f8e7fc3666b7e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 751}}}]}, {"ruleId": "scanner-5af9d8e0dfd38f33", "level": "warning", "message": {"text": "Django view `delete_post` may be unauthenticated \u2014 backend/user_system/views.py:803"}, "properties": {"repobilityId": "ad5a9a86373cf4bc", "scanner": "scanner-primary", "fingerprint": "5af9d8e0dfd38f33", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 803}}}]}, {"ruleId": "scanner-a4aada92525b9381", "level": "warning", "message": {"text": "Django view `report_post` may be unauthenticated \u2014 backend/user_system/views.py:823"}, "properties": {"repobilityId": "aacfa5e16f8c7f2d", "scanner": "scanner-primary", "fingerprint": "a4aada92525b9381", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 823}}}]}, {"ruleId": "scanner-c2780ade4cf101b5", "level": "warning", "message": {"text": "Django view `like_post` may be unauthenticated \u2014 backend/user_system/views.py:869"}, "properties": {"repobilityId": "e484bc4c7fdab5a3", "scanner": "scanner-primary", "fingerprint": "c2780ade4cf101b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 869}}}]}, {"ruleId": "scanner-1a13a6cd720a55c0", "level": "warning", "message": {"text": "Django view `unlike_post` may be unauthenticated \u2014 backend/user_system/views.py:899"}, "properties": {"repobilityId": "cc24a1598028ce79", "scanner": "scanner-primary", "fingerprint": "1a13a6cd720a55c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 899}}}]}, {"ruleId": "scanner-1f1ee58e6c2a0ce9", "level": "warning", "message": {"text": "Django view `get_posts_in_feed` may be unauthenticated \u2014 backend/user_system/views.py:931"}, "properties": {"repobilityId": "3d595f84a43c958b", "scanner": "scanner-primary", "fingerprint": "1f1ee58e6c2a0ce9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 931}}}]}, {"ruleId": "scanner-0894228368ce386e", "level": "warning", "message": {"text": "Django view `get_posts_for_followed_users` may be unauthenticated \u2014 backend/user_system/views.py:965"}, "properties": {"repobilityId": "359c758bb6b44dcb", "scanner": "scanner-primary", "fingerprint": "0894228368ce386e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 965}}}]}, {"ruleId": "scanner-0021cebc0eb2569d", "level": "warning", "message": {"text": "Django view `get_posts_for_user` may be unauthenticated \u2014 backend/user_system/views.py:1002"}, "properties": {"repobilityId": "2865df5bab23e30b", "scanner": "scanner-primary", "fingerprint": "0021cebc0eb2569d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1002}}}]}, {"ruleId": "scanner-d54508c94c59e615", "level": "warning", "message": {"text": "Django view `get_post_details` may be unauthenticated \u2014 backend/user_system/views.py:1043"}, "properties": {"repobilityId": "73fe6d9cda399b47", "scanner": "scanner-primary", "fingerprint": "d54508c94c59e615", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1043}}}]}, {"ruleId": "scanner-1a3433aa39cbce44", "level": "warning", "message": {"text": "Django view `comment_on_post` may be unauthenticated \u2014 backend/user_system/views.py:1073"}, "properties": {"repobilityId": "52632a84eb222dc0", "scanner": "scanner-primary", "fingerprint": "1a3433aa39cbce44", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1073}}}]}, {"ruleId": "scanner-27ee54c76381c990", "level": "warning", "message": {"text": "Django view `reply_to_comment_thread` may be unauthenticated \u2014 backend/user_system/views.py:1113"}, "properties": {"repobilityId": "e42c98ba09614832", "scanner": "scanner-primary", "fingerprint": "27ee54c76381c990", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1113}}}]}, {"ruleId": "scanner-68a191df643ccca5", "level": "warning", "message": {"text": "Django view `like_comment` may be unauthenticated \u2014 backend/user_system/views.py:1156"}, "properties": {"repobilityId": "e3a2779d8d944023", "scanner": "scanner-primary", "fingerprint": "68a191df643ccca5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1156}}}]}, {"ruleId": "scanner-83385cdf1edc8640", "level": "warning", "message": {"text": "Django view `unlike_comment` may be unauthenticated \u2014 backend/user_system/views.py:1196"}, "properties": {"repobilityId": "ebfab6d164603227", "scanner": "scanner-primary", "fingerprint": "83385cdf1edc8640", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1196}}}]}, {"ruleId": "scanner-677f68a17f8db9c3", "level": "warning", "message": {"text": "Django view `delete_comment` may be unauthenticated \u2014 backend/user_system/views.py:1236"}, "properties": {"repobilityId": "b182b5f5d1be86c6", "scanner": "scanner-primary", "fingerprint": "677f68a17f8db9c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1236}}}]}, {"ruleId": "scanner-e515a3b3e2b00587", "level": "warning", "message": {"text": "Django view `report_comment` may be unauthenticated \u2014 backend/user_system/views.py:1272"}, "properties": {"repobilityId": "106f784f89e7d62f", "scanner": "scanner-primary", "fingerprint": "e515a3b3e2b00587", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1272}}}]}, {"ruleId": "scanner-4e8dcc8e9d00318a", "level": "warning", "message": {"text": "Django view `get_users_matching_fragment` may be unauthenticated \u2014 backend/user_system/views.py:1400"}, "properties": {"repobilityId": "e0841a382bdf7e16", "scanner": "scanner-primary", "fingerprint": "4e8dcc8e9d00318a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1400}}}]}, {"ruleId": "scanner-4888a4f727b8a91f", "level": "warning", "message": {"text": "Django view `follow_user` may be unauthenticated \u2014 backend/user_system/views.py:1435"}, "properties": {"repobilityId": "70fd8f1ccec3a755", "scanner": "scanner-primary", "fingerprint": "4888a4f727b8a91f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1435}}}]}, {"ruleId": "scanner-a09ae0193a5dcd8b", "level": "warning", "message": {"text": "Django view `unfollow_user` may be unauthenticated \u2014 backend/user_system/views.py:1460"}, "properties": {"repobilityId": "cb62eef1f19b67c7", "scanner": "scanner-primary", "fingerprint": "a09ae0193a5dcd8b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1460}}}]}, {"ruleId": "scanner-2d38717d590254f4", "level": "warning", "message": {"text": "Django view `toggle_block` may be unauthenticated \u2014 backend/user_system/views.py:1482"}, "properties": {"repobilityId": "3e5eba999e658382", "scanner": "scanner-primary", "fingerprint": "2d38717d590254f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1482}}}]}, {"ruleId": "scanner-c5864eca66201423", "level": "warning", "message": {"text": "Django view `get_profile_details` may be unauthenticated \u2014 backend/user_system/views.py:1515"}, "properties": {"repobilityId": "055ca92e519b8ae5", "scanner": "scanner-primary", "fingerprint": "c5864eca66201423", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/user_system/views.py"}, "region": {"startLine": 1515}}}]}, {"ruleId": "scanner-8c20e301da91c004", "level": "warning", "message": {"text": "Django view `health` may be unauthenticated \u2014 backend/pos_backend/views.py:4"}, "properties": {"repobilityId": "3e3e22b3c640b121", "scanner": "scanner-primary", "fingerprint": "8c20e301da91c004", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/pos_backend/views.py"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-cf2370ef9478ffcf", "level": "warning", "message": {"text": "Django view `ratelimited` may be unauthenticated \u2014 backend/pos_backend/views.py:9"}, "properties": {"repobilityId": "868abbe76942ea3d", "scanner": "scanner-primary", "fingerprint": "cf2370ef9478ffcf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/pos_backend/views.py"}, "region": {"startLine": 9}}}]}]}]}