{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d46a322d5de36cd6", "name": "Possibly dead Python function: batch_sentiment", "shortDescription": {"text": "Possibly dead Python function: batch_sentiment"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05931db12353a025", "name": "Possibly dead Python function: reset_backend", "shortDescription": {"text": "Possibly dead Python function: reset_backend"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19d0c77731ff6a0c", "name": "Possibly dead Python function: cache_delete", "shortDescription": {"text": "Possibly dead Python function: cache_delete"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fbff45dff22d805", "name": "Possibly dead Python function: batch_insider_signals", "shortDescription": {"text": "Possibly dead Python function: batch_insider_signals"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-682b4f70d997908b", "name": "Possibly dead Python function: check_async_await", "shortDescription": {"text": "Possibly dead Python function: check_async_await"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eeef4827a5c5e162", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cddd22bd1b6f91fe", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-093dfc96b7368862", "name": "Privileged port 21 in use", "shortDescription": {"text": "Privileged port 21 in use"}, "fullDescription": {"text": "Port 21 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d53f3a199b29a9d", "name": "Insecure pattern 'direct_innerhtml_assignment' in miniapp/index.html:2936", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in miniapp/index.html:2936"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-145f48f6f30145ef", "name": "Insecure pattern 'direct_outerhtml_assignment' in miniapp/index.html:4226", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in miniapp/index.html:4226"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32b799094b51c66f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-940f14cc6e3e909a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a2cffc83ca4aa0f", "name": "Very large file: bot_commands.py (2440 lines)", "shortDescription": {"text": "Very large file: bot_commands.py (2440 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aec4b824712a0def", "name": "Very large file: screener.py (1510 lines)", "shortDescription": {"text": "Very large file: screener.py (1510 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-395935989704b31c", "name": "Very large file: formatters.py (1188 lines)", "shortDescription": {"text": "Very large file: formatters.py (1188 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-524b9c333a13ae37", "name": "Very large file: agent.py (4543 lines)", "shortDescription": {"text": "Very large file: agent.py (4543 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e59d9bc3bb3ddaf6", "name": "Very large file: cmd_market.py (1390 lines)", "shortDescription": {"text": "Very large file: cmd_market.py (1390 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3cf0fc23fd961c2a", "name": "Very large file: webhook.py (3962 lines)", "shortDescription": {"text": "Very large file: webhook.py (3962 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3864d652245be99b", "name": "Very large file: cmd_trades.py (2514 lines)", "shortDescription": {"text": "Very large file: cmd_trades.py (2514 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8413fc8af544d177", "name": "Very large file: ai_analyzer.py (1716 lines)", "shortDescription": {"text": "Very large file: ai_analyzer.py (1716 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 606 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15e333808588f9ef", "name": "Commented-code block (5 lines) in screener.py:279", "shortDescription": {"text": "Commented-code block (5 lines) in screener.py:279"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3892f36134e58d03", "name": "Network/subprocess call without timeout or try/except \u2014 webhook.py:142", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 webhook.py:142"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00df6c81f6990641", "name": "Commented-code block (6 lines) in ai_analyzer.py:27", "shortDescription": {"text": "Commented-code block (6 lines) in ai_analyzer.py:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ddf90e42e77efec3", "name": "Commented-code block (11 lines) in tests/test_agent_helpers.py:58", "shortDescription": {"text": "Commented-code block (11 lines) in tests/test_agent_helpers.py:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ceedfaf96feb732", "name": "Legacy-named symbol `days_old` in tests/test_config_manager.py:317", "shortDescription": {"text": "Legacy-named symbol `days_old` in tests/test_config_manager.py:317"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncard_generator.py:txt, card_generator.py:txt\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nstorage.py:read, storage.py:read, storage.py:read\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f734226eafd1b7d", "name": "Flask mutation route `trigger_morning` without `@login_required` \u2014 webhook.py:90", "shortDescription": {"text": "Flask mutation route `trigger_morning` without `@login_required` \u2014 webhook.py:90"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fa8ef308b14fcdb", "name": "Flask mutation route `trigger_prescreener` without `@login_required` \u2014 webhook.py:155", "shortDescription": {"text": "Flask mutation route `trigger_prescreener` without `@login_required` \u2014 webhook.py:155"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be5ac40468ecff18", "name": "Flask mutation route `trigger_mode` without `@login_required` \u2014 webhook.py:213", "shortDescription": {"text": "Flask mutation route `trigger_mode` without `@login_required` \u2014 webhook.py:213"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d67d64ab60d26754", "name": "Flask mutation route `webhook` without `@login_required` \u2014 webhook.py:289", "shortDescription": {"text": "Flask mutation route `webhook` without `@login_required` \u2014 webhook.py:289"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01ce3b64b07cc450", "name": "Flask mutation route `admin_approve_user` without `@login_required` \u2014 webhook.py:1179", "shortDescription": {"text": "Flask mutation route `admin_approve_user` without `@login_required` \u2014 webhook.py:1179"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa361823ab845b3c", "name": "Flask mutation route `admin_reject_user` without `@login_required` \u2014 webhook.py:1192", "shortDescription": {"text": "Flask mutation route `admin_reject_user` without `@login_required` \u2014 webhook.py:1192"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-423deac56b8b23b6", "name": "Flask mutation route `admin_ban_user` without `@login_required` \u2014 webhook.py:1204", "shortDescription": {"text": "Flask mutation route `admin_ban_user` without `@login_required` \u2014 webhook.py:1204"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff266f8b29c4d294", "name": "Flask mutation route `admin_unban_user` without `@login_required` \u2014 webhook.py:1215", "shortDescription": {"text": "Flask mutation route `admin_unban_user` without `@login_required` \u2014 webhook.py:1215"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-000abb4f0089856e", "name": "Flask mutation route `admin_message_user` without `@login_required` \u2014 webhook.py:1224", "shortDescription": {"text": "Flask mutation route `admin_message_user` without `@login_required` \u2014 webhook.py:1224"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e66cdba145a7d615", "name": "Flask mutation route `admin_broadcast` without `@login_required` \u2014 webhook.py:1234", "shortDescription": {"text": "Flask mutation route `admin_broadcast` without `@login_required` \u2014 webhook.py:1234"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cb6e8cf249837ab7", "name": "Flask mutation route `admin_run_agent` without `@login_required` \u2014 webhook.py:1251", "shortDescription": {"text": "Flask mutation route `admin_run_agent` without `@login_required` \u2014 webhook.py:1251"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8aaa34eef3d59cae", "name": "Flask mutation route `admin_fix_ticker` without `@login_required` \u2014 webhook.py:1279", "shortDescription": {"text": "Flask mutation route `admin_fix_ticker` without `@login_required` \u2014 webhook.py:1279"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8570764ebcde5d20", "name": "Flask mutation route `miniapp_seed_backtest` without `@login_required` \u2014 webhook.py:1534", "shortDescription": {"text": "Flask mutation route `miniapp_seed_backtest` without `@login_required` \u2014 webhook.py:1534"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b71a19598f69d00", "name": "Flask mutation route `miniapp_log_bought` without `@login_required` \u2014 webhook.py:1568", "shortDescription": {"text": "Flask mutation route `miniapp_log_bought` without `@login_required` \u2014 webhook.py:1568"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ccb20df5f7969372", "name": "Flask mutation route `miniapp_unlog_bought` without `@login_required` \u2014 webhook.py:1615", "shortDescription": {"text": "Flask mutation route `miniapp_unlog_bought` without `@login_required` \u2014 webhook.py:1615"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-801c55582d336b90", "name": "Flask mutation route `miniapp_settings_update` without `@login_required` \u2014 webhook.py:1666", "shortDescription": {"text": "Flask mutation route `miniapp_settings_update` without `@login_required` \u2014 webhook.py:1666"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3781fb3d360eda03", "name": "Flask mutation route `miniapp_close_position` without `@login_required` \u2014 webhook.py:1778", "shortDescription": {"text": "Flask mutation route `miniapp_close_position` without `@login_required` \u2014 webhook.py:1778"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa3f0caefc564d9f", "name": "Flask mutation route `miniapp_remove_position` without `@login_required` \u2014 webhook.py:1800", "shortDescription": {"text": "Flask mutation route `miniapp_remove_position` without `@login_required` \u2014 webhook.py:1800"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-24392fbb69a882ae", "name": "Flask mutation route `miniapp_toggle_paused` without `@login_required` \u2014 webhook.py:1815", "shortDescription": {"text": "Flask mutation route `miniapp_toggle_paused` without `@login_required` \u2014 webhook.py:1815"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-526d0e11ba8b7639", "name": "Flask mutation route `miniapp_feedback` without `@login_required` \u2014 webhook.py:1831", "shortDescription": {"text": "Flask mutation route `miniapp_feedback` without `@login_required` \u2014 webhook.py:1831"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d992b99f68bcff81", "name": "Flask mutation route `miniapp_alerts_post` without `@login_required` \u2014 webhook.py:1955", "shortDescription": {"text": "Flask mutation route `miniapp_alerts_post` without `@login_required` \u2014 webhook.py:1955"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6164fc8ecf7f6e9", "name": "Flask mutation route `miniapp_add_alert` without `@login_required` \u2014 webhook.py:2183", "shortDescription": {"text": "Flask mutation route `miniapp_add_alert` without `@login_required` \u2014 webhook.py:2183"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d76f01c82964d31c", "name": "Flask mutation route `miniapp_remove_alert` without `@login_required` \u2014 webhook.py:2205", "shortDescription": {"text": "Flask mutation route `miniapp_remove_alert` without `@login_required` \u2014 webhook.py:2205"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04953d4b6e6ac19d", "name": "Flask mutation route `miniapp_clear_alerts` without `@login_required` \u2014 webhook.py:2221", "shortDescription": {"text": "Flask mutation route `miniapp_clear_alerts` without `@login_required` \u2014 webhook.py:2221"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-639eed903e01a7bf", "name": "Flask mutation route `miniapp_update_settings` without `@login_required` \u2014 webhook.py:2257", "shortDescription": {"text": "Flask mutation route `miniapp_update_settings` without `@login_required` \u2014 webhook.py:2257"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f8a60833eff64930", "name": "Flask mutation route `miniapp_update_position` without `@login_required` \u2014 webhook.py:2484", "shortDescription": {"text": "Flask mutation route `miniapp_update_position` without `@login_required` \u2014 webhook.py:2484"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72e66ad075bf406c", "name": "Flask mutation route `miniapp_run_command` without `@login_required` \u2014 webhook.py:3101", "shortDescription": {"text": "Flask mutation route `miniapp_run_command` without `@login_required` \u2014 webhook.py:3101"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-58d036f77bc5758c", "name": "Flask mutation route `miniapp_watchlist_add` without `@login_required` \u2014 webhook.py:3359", "shortDescription": {"text": "Flask mutation route `miniapp_watchlist_add` without `@login_required` \u2014 webhook.py:3359"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-866b09a29cb09eb7", "name": "Flask mutation route `miniapp_watchlist_remove` without `@login_required` \u2014 webhook.py:3404", "shortDescription": {"text": "Flask mutation route `miniapp_watchlist_remove` without `@login_required` \u2014 webhook.py:3404"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8dd9420fead59993", "name": "Flask mutation route `miniapp_update_watchlist` without `@login_required` \u2014 webhook.py:3565", "shortDescription": {"text": "Flask mutation route `miniapp_update_watchlist` without `@login_required` \u2014 webhook.py:3565"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-720eec0f90f7a29f", "name": "Flask mutation route `miniapp_update_exclusions` without `@login_required` \u2014 webhook.py:3595", "shortDescription": {"text": "Flask mutation route `miniapp_update_exclusions` without `@login_required` \u2014 webhook.py:3595"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-24247fab9cdaa358", "name": "Flask mutation route `miniapp_paper_buy` without `@login_required` \u2014 webhook.py:3620", "shortDescription": {"text": "Flask mutation route `miniapp_paper_buy` without `@login_required` \u2014 webhook.py:3620"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-facaefab46250a10", "name": "Flask mutation route `miniapp_paper_sell` without `@login_required` \u2014 webhook.py:3662", "shortDescription": {"text": "Flask mutation route `miniapp_paper_sell` without `@login_required` \u2014 webhook.py:3662"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-89e4d038e6952d49", "name": "Flask mutation route `miniapp_paper_cancel` without `@login_required` \u2014 webhook.py:3689", "shortDescription": {"text": "Flask mutation route `miniapp_paper_cancel` without `@login_required` \u2014 webhook.py:3689"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1fa106d997270a44", "name": "Flask mutation route `miniapp_paper_add_cash` without `@login_required` \u2014 webhook.py:3707", "shortDescription": {"text": "Flask mutation route `miniapp_paper_add_cash` without `@login_required` \u2014 webhook.py:3707"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-904a4eba2b4ed555", "name": "Flask mutation route `miniapp_paper_reset` without `@login_required` \u2014 webhook.py:3733", "shortDescription": {"text": "Flask mutation route `miniapp_paper_reset` without `@login_required` \u2014 webhook.py:3733"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a4a23a08db246b3", "name": "Unused endpoint: ANY /trigger/morning", "shortDescription": {"text": "Unused endpoint: ANY /trigger/morning"}, "fullDescription": {"text": "`webhook.py` declares `ANY /trigger/morning` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10b81bdf58a760a3", "name": "Unused endpoint: ANY /trigger/prescreener", "shortDescription": {"text": "Unused endpoint: ANY /trigger/prescreener"}, "fullDescription": {"text": "`webhook.py` declares `ANY /trigger/prescreener` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e585c5b1573d560", "name": "Unused endpoint: ANY /trigger/<mode>", "shortDescription": {"text": "Unused endpoint: ANY /trigger/<mode>"}, "fullDescription": {"text": "`webhook.py` declares `ANY /trigger/<mode>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68c9d5e17d04d050", "name": "Unused endpoint: ANY /webhook", "shortDescription": {"text": "Unused endpoint: ANY /webhook"}, "fullDescription": {"text": "`webhook.py` declares `ANY /webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed2cb1702f1f600d", "name": "Unused endpoint: ANY /register", "shortDescription": {"text": "Unused endpoint: ANY /register"}, "fullDescription": {"text": "`webhook.py` declares `ANY /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`webhook.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-478720614672aa9f", "name": "Unused endpoint: ANY /admin/login", "shortDescription": {"text": "Unused endpoint: ANY /admin/login"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e84e992fa82838f", "name": "Unused endpoint: ANY /admin/github", "shortDescription": {"text": "Unused endpoint: ANY /admin/github"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/github` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10d3177527dc1361", "name": "Unused endpoint: ANY /admin/callback", "shortDescription": {"text": "Unused endpoint: ANY /admin/callback"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68bc2ac4bf5f0856", "name": "Unused endpoint: ANY /admin/logout", "shortDescription": {"text": "Unused endpoint: ANY /admin/logout"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98356fa7ff420a14", "name": "Unused endpoint: ANY /admin", "shortDescription": {"text": "Unused endpoint: ANY /admin"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95a8354238176689", "name": "Unused endpoint: ANY /admin/data", "shortDescription": {"text": "Unused endpoint: ANY /admin/data"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a220e627245b378", "name": "Unused endpoint: ANY /admin/user/<chat_id>", "shortDescription": {"text": "Unused endpoint: ANY /admin/user/<chat_id>"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/user/<chat_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f270b719ebfa9a5", "name": "Unused endpoint: ANY /admin/user/<chat_id>/approve", "shortDescription": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/approve"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/user/<chat_id>/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eac3add729066ad", "name": "Unused endpoint: ANY /admin/user/<chat_id>/reject", "shortDescription": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/reject"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/user/<chat_id>/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-249fa002979fb379", "name": "Unused endpoint: ANY /admin/user/<chat_id>/ban", "shortDescription": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/ban"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/user/<chat_id>/ban` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03ee92ff0153abcc", "name": "Unused endpoint: ANY /admin/user/<chat_id>/unban", "shortDescription": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/unban"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/user/<chat_id>/unban` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11b724c7478cdefb", "name": "Unused endpoint: ANY /admin/user/<chat_id>/message", "shortDescription": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/message"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/user/<chat_id>/message` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87c515610f26849e", "name": "Unused endpoint: ANY /admin/broadcast", "shortDescription": {"text": "Unused endpoint: ANY /admin/broadcast"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/broadcast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cac11d6b352ed3ed", "name": "Unused endpoint: ANY /admin/run_agent", "shortDescription": {"text": "Unused endpoint: ANY /admin/run_agent"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/run_agent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0be7275d93b54db7", "name": "Unused endpoint: ANY /admin/fix_ticker", "shortDescription": {"text": "Unused endpoint: ANY /admin/fix_ticker"}, "fullDescription": {"text": "`webhook.py` declares `ANY /admin/fix_ticker` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd267fa1f83f9712", "name": "Unused endpoint: ANY /miniapp", "shortDescription": {"text": "Unused endpoint: ANY /miniapp"}, "fullDescription": {"text": "`webhook.py` declares `ANY /miniapp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df8c0d782c7a080e", "name": "Unused endpoint: ANY /miniapp/manifest.json", "shortDescription": {"text": "Unused endpoint: ANY /miniapp/manifest.json"}, "fullDescription": {"text": "`webhook.py` declares `ANY /miniapp/manifest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d930a17015dccc3", "name": "Unused endpoint: ANY /api/miniapp/picks", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/picks"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/picks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f25727e9d496ffa", "name": "Unused endpoint: ANY /api/miniapp/picks/history", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/picks/history"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/picks/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfd36f51767ce304", "name": "Unused endpoint: ANY /api/miniapp/positions", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/positions"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/positions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d562ffd5e7ce07b", "name": "Unused endpoint: ANY /api/miniapp/seed_backtest", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/seed_backtest"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/seed_backtest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53f689c68323ffb7", "name": "Unused endpoint: ANY /api/miniapp/log_bought", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/log_bought"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/log_bought` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-648ebbafbba8e693", "name": "Unused endpoint: ANY /api/miniapp/unlog_bought", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/unlog_bought"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/unlog_bought` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0aa2068d37530cff", "name": "Unused endpoint: ANY /api/miniapp/settings", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/settings"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eccf08e28e0c19e", "name": "Unused endpoint: ANY /api/miniapp/settings/update", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/settings/update"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/settings/update` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81ac9cd1acdcb202", "name": "Unused endpoint: ANY /api/miniapp/chart/<ticker>", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/chart/<ticker>"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/chart/<ticker>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76c6472403c9f758", "name": "Unused endpoint: ANY /api/miniapp/define", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/define"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/define` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ffcb2b18a6657e5", "name": "Unused endpoint: ANY /api/miniapp/close_position", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/close_position"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/close_position` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-210858a143295504", "name": "Unused endpoint: ANY /api/miniapp/remove_position", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/remove_position"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/remove_position` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f7e9c10674f0ba6", "name": "Unused endpoint: ANY /api/miniapp/toggle_paused", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/toggle_paused"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/toggle_paused` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-174fc6891619e96f", "name": "Unused endpoint: ANY /api/miniapp/feedback", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/feedback"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8942ce6ceee4ab84", "name": "Unused endpoint: ANY /api/miniapp/history", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/history"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac8ec8fd11e543db", "name": "Unused endpoint: ANY /api/miniapp/pnl_history", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/pnl_history"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/pnl_history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af11ffa14a523810", "name": "Unused endpoint: ANY /api/miniapp/alerts", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/alerts"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bb64d9dfd219e7b", "name": "Unused endpoint: ANY /api/miniapp/names", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/names"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/names` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d77c4be1bdabbcd", "name": "Unused endpoint: ANY /api/miniapp/quote", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/quote"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/quote` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad9ef50c4933be6a", "name": "Unused endpoint: ANY /api/miniapp/news/<ticker>", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/news/<ticker>"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/news/<ticker>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9a862ba421cb2f8", "name": "Unused endpoint: ANY /api/miniapp/add_alert", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/add_alert"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/add_alert` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d3fcf7000f6d96a", "name": "Unused endpoint: ANY /api/miniapp/remove_alert", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/remove_alert"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/remove_alert` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd94e5b9c501c977", "name": "Unused endpoint: ANY /api/miniapp/clear_alerts", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/clear_alerts"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/clear_alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41b097cc288f0398", "name": "Unused endpoint: ANY /api/miniapp/paper", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/paper"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/paper` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86dea99925e9fa9c", "name": "Unused endpoint: ANY /api/miniapp/update_settings", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/update_settings"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/update_settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-904daed8605e707a", "name": "Unused endpoint: ANY /api/miniapp/live_prices", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/live_prices"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/live_prices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14dc7c5340ac2545", "name": "Unused endpoint: ANY /api/miniapp/markets", "shortDescription": {"text": "Unused endpoint: ANY /api/miniapp/markets"}, "fullDescription": {"text": "`webhook.py` declares `ANY /api/miniapp/markets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22435"}, "properties": {"repository": "vsanil/stockpulz", "repoUrl": "https://github.com/vsanil/stockpulz", "branch": "main"}, "results": [{"ruleId": "scanner-d46a322d5de36cd6", "level": "note", "message": {"text": "Possibly dead Python function: batch_sentiment"}, "properties": {"repobilityId": "e7a3364a274d0fec", "scanner": "scanner-primary", "fingerprint": "d46a322d5de36cd6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sentiment_analyzer.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05931db12353a025", "level": "note", "message": {"text": "Possibly dead Python function: reset_backend"}, "properties": {"repobilityId": "5ff42e4a1f07eb95", "scanner": "scanner-primary", "fingerprint": "05931db12353a025", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "storage.py:197"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-19d0c77731ff6a0c", "level": "note", "message": {"text": "Possibly dead Python function: cache_delete"}, "properties": {"repobilityId": "87e5e23cfb43476f", "scanner": "scanner-primary", "fingerprint": "19d0c77731ff6a0c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cache_layer.py:208"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fbff45dff22d805", "level": "note", "message": {"text": "Possibly dead Python function: batch_insider_signals"}, "properties": {"repobilityId": "1e5c0891b3965a36", "scanner": "scanner-primary", "fingerprint": "7fbff45dff22d805", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "insider_tracker.py:188"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-682b4f70d997908b", "level": "note", "message": {"text": "Possibly dead Python function: check_async_await"}, "properties": {"repobilityId": "4eb1ead84b974188", "scanner": "scanner-primary", "fingerprint": "682b4f70d997908b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check_js.py:311"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eeef4827a5c5e162", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "eeef4827a5c5e162", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/keepwarm.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cddd22bd1b6f91fe", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "cddd22bd1b6f91fe", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/keepwarm.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-093dfc96b7368862", "level": "warning", "message": {"text": "Privileged port 21 in use"}, "properties": {"repobilityId": "d920b7cd1b1a16dc", "scanner": "scanner-primary", "fingerprint": "093dfc96b7368862", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/keepwarm.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-9d53f3a199b29a9d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in miniapp/index.html:2936"}, "properties": {"repobilityId": "aacccff909f9199f", "scanner": "scanner-primary", "fingerprint": "9d53f3a199b29a9d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "miniapp/index.html"}, "region": {"startLine": 2936}}}]}, {"ruleId": "scanner-145f48f6f30145ef", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in miniapp/index.html:4226"}, "properties": {"repobilityId": "4fe2eab3d5b5be57", "scanner": "scanner-primary", "fingerprint": "145f48f6f30145ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "miniapp/index.html"}, "region": {"startLine": 4226}}}]}, {"ruleId": "scanner-32b799094b51c66f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5561f1092b89cf45", "scanner": "scanner-primary", "fingerprint": "32b799094b51c66f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_run.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-32b799094b51c66f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10b0de79c7da349a", "scanner": "scanner-primary", "fingerprint": "32b799094b51c66f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_run.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-32b799094b51c66f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c939d005ecb3c6cf", "scanner": "scanner-primary", "fingerprint": "32b799094b51c66f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily_run.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-940f14cc6e3e909a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c04e7dfd4fa0f6a1", "scanner": "scanner-primary", "fingerprint": "940f14cc6e3e909a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/price_alerts.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-940f14cc6e3e909a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5fad09f1fd0bc13", "scanner": "scanner-primary", "fingerprint": "940f14cc6e3e909a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/price_alerts.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-940f14cc6e3e909a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4014ca75830ebf0", "scanner": "scanner-primary", "fingerprint": "940f14cc6e3e909a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/price_alerts.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-9a2cffc83ca4aa0f", "level": "note", "message": {"text": "Very large file: bot_commands.py (2440 lines)"}, "properties": {"repobilityId": "b1b2e37ee506bb6a", "scanner": "scanner-primary", "fingerprint": "9a2cffc83ca4aa0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aec4b824712a0def", "level": "note", "message": {"text": "Very large file: screener.py (1510 lines)"}, "properties": {"repobilityId": "efd7003da7c61376", "scanner": "scanner-primary", "fingerprint": "aec4b824712a0def", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-395935989704b31c", "level": "note", "message": {"text": "Very large file: formatters.py (1188 lines)"}, "properties": {"repobilityId": "32422496f2c2a108", "scanner": "scanner-primary", "fingerprint": "395935989704b31c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-524b9c333a13ae37", "level": "note", "message": {"text": "Very large file: agent.py (4543 lines)"}, "properties": {"repobilityId": "e43b471060129228", "scanner": "scanner-primary", "fingerprint": "524b9c333a13ae37", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e59d9bc3bb3ddaf6", "level": "note", "message": {"text": "Very large file: cmd_market.py (1390 lines)"}, "properties": {"repobilityId": "12b102d52414f267", "scanner": "scanner-primary", "fingerprint": "e59d9bc3bb3ddaf6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3cf0fc23fd961c2a", "level": "note", "message": {"text": "Very large file: webhook.py (3962 lines)"}, "properties": {"repobilityId": "9d955f657682be10", "scanner": "scanner-primary", "fingerprint": "3cf0fc23fd961c2a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3864d652245be99b", "level": "note", "message": {"text": "Very large file: cmd_trades.py (2514 lines)"}, "properties": {"repobilityId": "4bcaf825340994d0", "scanner": "scanner-primary", "fingerprint": "3864d652245be99b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8413fc8af544d177", "level": "note", "message": {"text": "Very large file: ai_analyzer.py (1716 lines)"}, "properties": {"repobilityId": "a61647900b00c2bf", "scanner": "scanner-primary", "fingerprint": "8413fc8af544d177", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "028349700ac3847b", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9a3ee9267ce5b7b0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "11493556f06300a7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "18f74ffa02766950", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "58bd7d36b9ead9b6", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f7f9a1e448789f33", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-15e333808588f9ef", "level": "none", "message": {"text": "Commented-code block (5 lines) in screener.py:279"}, "properties": {"repobilityId": "63774dacae0b9820", "scanner": "scanner-primary", "fingerprint": "15e333808588f9ef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3892f36134e58d03", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 webhook.py:142"}, "properties": {"repobilityId": "b1e2ebdcf30164a2", "scanner": "scanner-primary", "fingerprint": "3892f36134e58d03", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-00df6c81f6990641", "level": "none", "message": {"text": "Commented-code block (6 lines) in ai_analyzer.py:27"}, "properties": {"repobilityId": "fb2e5324a8e4a48a", "scanner": "scanner-primary", "fingerprint": "00df6c81f6990641", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ddf90e42e77efec3", "level": "none", "message": {"text": "Commented-code block (11 lines) in tests/test_agent_helpers.py:58"}, "properties": {"repobilityId": "d6de631d2985077d", "scanner": "scanner-primary", "fingerprint": "ddf90e42e77efec3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ceedfaf96feb732", "level": "note", "message": {"text": "Legacy-named symbol `days_old` in tests/test_config_manager.py:317"}, "properties": {"repobilityId": "4a33adf49f1d87d2", "scanner": "scanner-primary", "fingerprint": "0ceedfaf96feb732", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "72310a1558d85817", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "4e1365e60488d3a4", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ceeb5b2ad6083b8f", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "05494916f2026428", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b2d65574c7d8696a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "bdf9e62190e93e92", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d1c67c5047e68149", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "cdb632f8795acc24", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f238c5b351290304", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "84a1f2b95ace9fc2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1ef661eaa7534386", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "59ce58e13c5e9cb7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a461fcd87a8324b1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-7f734226eafd1b7d", "level": "error", "message": {"text": "Flask mutation route `trigger_morning` without `@login_required` \u2014 webhook.py:90"}, "properties": {"repobilityId": "ae0c90994a699437", "scanner": "scanner-primary", "fingerprint": "7f734226eafd1b7d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-5fa8ef308b14fcdb", "level": "error", "message": {"text": "Flask mutation route `trigger_prescreener` without `@login_required` \u2014 webhook.py:155"}, "properties": {"repobilityId": "be635114c7511c8f", "scanner": "scanner-primary", "fingerprint": "5fa8ef308b14fcdb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-be5ac40468ecff18", "level": "error", "message": {"text": "Flask mutation route `trigger_mode` without `@login_required` \u2014 webhook.py:213"}, "properties": {"repobilityId": "54eaa894eb1ad1df", "scanner": "scanner-primary", "fingerprint": "be5ac40468ecff18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-d67d64ab60d26754", "level": "error", "message": {"text": "Flask mutation route `webhook` without `@login_required` \u2014 webhook.py:289"}, "properties": {"repobilityId": "d916d6ec0e647cb4", "scanner": "scanner-primary", "fingerprint": "d67d64ab60d26754", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-01ce3b64b07cc450", "level": "error", "message": {"text": "Flask mutation route `admin_approve_user` without `@login_required` \u2014 webhook.py:1179"}, "properties": {"repobilityId": "b7a9895c6d844dbb", "scanner": "scanner-primary", "fingerprint": "01ce3b64b07cc450", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1179}}}]}, {"ruleId": "scanner-aa361823ab845b3c", "level": "error", "message": {"text": "Flask mutation route `admin_reject_user` without `@login_required` \u2014 webhook.py:1192"}, "properties": {"repobilityId": "0dfb3ccd7fdf40d2", "scanner": "scanner-primary", "fingerprint": "aa361823ab845b3c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1192}}}]}, {"ruleId": "scanner-423deac56b8b23b6", "level": "error", "message": {"text": "Flask mutation route `admin_ban_user` without `@login_required` \u2014 webhook.py:1204"}, "properties": {"repobilityId": "808596f2e4bceedd", "scanner": "scanner-primary", "fingerprint": "423deac56b8b23b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1204}}}]}, {"ruleId": "scanner-ff266f8b29c4d294", "level": "error", "message": {"text": "Flask mutation route `admin_unban_user` without `@login_required` \u2014 webhook.py:1215"}, "properties": {"repobilityId": "bf2003e57250df04", "scanner": "scanner-primary", "fingerprint": "ff266f8b29c4d294", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1215}}}]}, {"ruleId": "scanner-000abb4f0089856e", "level": "error", "message": {"text": "Flask mutation route `admin_message_user` without `@login_required` \u2014 webhook.py:1224"}, "properties": {"repobilityId": "0dc26b1b9f9c9ae1", "scanner": "scanner-primary", "fingerprint": "000abb4f0089856e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1224}}}]}, {"ruleId": "scanner-e66cdba145a7d615", "level": "error", "message": {"text": "Flask mutation route `admin_broadcast` without `@login_required` \u2014 webhook.py:1234"}, "properties": {"repobilityId": "20cf6ff5774a5c55", "scanner": "scanner-primary", "fingerprint": "e66cdba145a7d615", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1234}}}]}, {"ruleId": "scanner-cb6e8cf249837ab7", "level": "error", "message": {"text": "Flask mutation route `admin_run_agent` without `@login_required` \u2014 webhook.py:1251"}, "properties": {"repobilityId": "6ff1dff1ad88b878", "scanner": "scanner-primary", "fingerprint": "cb6e8cf249837ab7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1251}}}]}, {"ruleId": "scanner-8aaa34eef3d59cae", "level": "error", "message": {"text": "Flask mutation route `admin_fix_ticker` without `@login_required` \u2014 webhook.py:1279"}, "properties": {"repobilityId": "eea3bdde645c0f92", "scanner": "scanner-primary", "fingerprint": "8aaa34eef3d59cae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1279}}}]}, {"ruleId": "scanner-8570764ebcde5d20", "level": "error", "message": {"text": "Flask mutation route `miniapp_seed_backtest` without `@login_required` \u2014 webhook.py:1534"}, "properties": {"repobilityId": "2dbe186ebad13082", "scanner": "scanner-primary", "fingerprint": "8570764ebcde5d20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1534}}}]}, {"ruleId": "scanner-4b71a19598f69d00", "level": "error", "message": {"text": "Flask mutation route `miniapp_log_bought` without `@login_required` \u2014 webhook.py:1568"}, "properties": {"repobilityId": "868e3883d2a2d9bd", "scanner": "scanner-primary", "fingerprint": "4b71a19598f69d00", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1568}}}]}, {"ruleId": "scanner-ccb20df5f7969372", "level": "error", "message": {"text": "Flask mutation route `miniapp_unlog_bought` without `@login_required` \u2014 webhook.py:1615"}, "properties": {"repobilityId": "795467e2250e3194", "scanner": "scanner-primary", "fingerprint": "ccb20df5f7969372", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1615}}}]}, {"ruleId": "scanner-801c55582d336b90", "level": "error", "message": {"text": "Flask mutation route `miniapp_settings_update` without `@login_required` \u2014 webhook.py:1666"}, "properties": {"repobilityId": "5b742721d453af68", "scanner": "scanner-primary", "fingerprint": "801c55582d336b90", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1666}}}]}, {"ruleId": "scanner-3781fb3d360eda03", "level": "error", "message": {"text": "Flask mutation route `miniapp_close_position` without `@login_required` \u2014 webhook.py:1778"}, "properties": {"repobilityId": "5f62e0f7fe687dea", "scanner": "scanner-primary", "fingerprint": "3781fb3d360eda03", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1778}}}]}, {"ruleId": "scanner-fa3f0caefc564d9f", "level": "error", "message": {"text": "Flask mutation route `miniapp_remove_position` without `@login_required` \u2014 webhook.py:1800"}, "properties": {"repobilityId": "af808899dedf69f3", "scanner": "scanner-primary", "fingerprint": "fa3f0caefc564d9f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1800}}}]}, {"ruleId": "scanner-24392fbb69a882ae", "level": "error", "message": {"text": "Flask mutation route `miniapp_toggle_paused` without `@login_required` \u2014 webhook.py:1815"}, "properties": {"repobilityId": "38a6c3cb504ae2b3", "scanner": "scanner-primary", "fingerprint": "24392fbb69a882ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1815}}}]}, {"ruleId": "scanner-526d0e11ba8b7639", "level": "error", "message": {"text": "Flask mutation route `miniapp_feedback` without `@login_required` \u2014 webhook.py:1831"}, "properties": {"repobilityId": "28c1a1740279d979", "scanner": "scanner-primary", "fingerprint": "526d0e11ba8b7639", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1831}}}]}, {"ruleId": "scanner-d992b99f68bcff81", "level": "error", "message": {"text": "Flask mutation route `miniapp_alerts_post` without `@login_required` \u2014 webhook.py:1955"}, "properties": {"repobilityId": "04e30d4aedff8bb2", "scanner": "scanner-primary", "fingerprint": "d992b99f68bcff81", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 1955}}}]}, {"ruleId": "scanner-d6164fc8ecf7f6e9", "level": "error", "message": {"text": "Flask mutation route `miniapp_add_alert` without `@login_required` \u2014 webhook.py:2183"}, "properties": {"repobilityId": "7a94332e89ac8969", "scanner": "scanner-primary", "fingerprint": "d6164fc8ecf7f6e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 2183}}}]}, {"ruleId": "scanner-d76f01c82964d31c", "level": "error", "message": {"text": "Flask mutation route `miniapp_remove_alert` without `@login_required` \u2014 webhook.py:2205"}, "properties": {"repobilityId": "53ca7d77ef0d6543", "scanner": "scanner-primary", "fingerprint": "d76f01c82964d31c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 2205}}}]}, {"ruleId": "scanner-04953d4b6e6ac19d", "level": "error", "message": {"text": "Flask mutation route `miniapp_clear_alerts` without `@login_required` \u2014 webhook.py:2221"}, "properties": {"repobilityId": "ce480122c56748c4", "scanner": "scanner-primary", "fingerprint": "04953d4b6e6ac19d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 2221}}}]}, {"ruleId": "scanner-639eed903e01a7bf", "level": "error", "message": {"text": "Flask mutation route `miniapp_update_settings` without `@login_required` \u2014 webhook.py:2257"}, "properties": {"repobilityId": "c7aac9939b2f1d4f", "scanner": "scanner-primary", "fingerprint": "639eed903e01a7bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 2257}}}]}, {"ruleId": "scanner-f8a60833eff64930", "level": "error", "message": {"text": "Flask mutation route `miniapp_update_position` without `@login_required` \u2014 webhook.py:2484"}, "properties": {"repobilityId": "77d42440b48dab10", "scanner": "scanner-primary", "fingerprint": "f8a60833eff64930", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 2484}}}]}, {"ruleId": "scanner-72e66ad075bf406c", "level": "error", "message": {"text": "Flask mutation route `miniapp_run_command` without `@login_required` \u2014 webhook.py:3101"}, "properties": {"repobilityId": "ad94a0039e7539de", "scanner": "scanner-primary", "fingerprint": "72e66ad075bf406c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3101}}}]}, {"ruleId": "scanner-58d036f77bc5758c", "level": "error", "message": {"text": "Flask mutation route `miniapp_watchlist_add` without `@login_required` \u2014 webhook.py:3359"}, "properties": {"repobilityId": "1562c5ab63918d77", "scanner": "scanner-primary", "fingerprint": "58d036f77bc5758c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3359}}}]}, {"ruleId": "scanner-866b09a29cb09eb7", "level": "error", "message": {"text": "Flask mutation route `miniapp_watchlist_remove` without `@login_required` \u2014 webhook.py:3404"}, "properties": {"repobilityId": "5a6a3772f1ee5786", "scanner": "scanner-primary", "fingerprint": "866b09a29cb09eb7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3404}}}]}, {"ruleId": "scanner-8dd9420fead59993", "level": "error", "message": {"text": "Flask mutation route `miniapp_update_watchlist` without `@login_required` \u2014 webhook.py:3565"}, "properties": {"repobilityId": "b25472806d7410f9", "scanner": "scanner-primary", "fingerprint": "8dd9420fead59993", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3565}}}]}, {"ruleId": "scanner-720eec0f90f7a29f", "level": "error", "message": {"text": "Flask mutation route `miniapp_update_exclusions` without `@login_required` \u2014 webhook.py:3595"}, "properties": {"repobilityId": "07e75377c13e6612", "scanner": "scanner-primary", "fingerprint": "720eec0f90f7a29f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3595}}}]}, {"ruleId": "scanner-24247fab9cdaa358", "level": "error", "message": {"text": "Flask mutation route `miniapp_paper_buy` without `@login_required` \u2014 webhook.py:3620"}, "properties": {"repobilityId": "5165347790e2ff7a", "scanner": "scanner-primary", "fingerprint": "24247fab9cdaa358", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3620}}}]}, {"ruleId": "scanner-facaefab46250a10", "level": "error", "message": {"text": "Flask mutation route `miniapp_paper_sell` without `@login_required` \u2014 webhook.py:3662"}, "properties": {"repobilityId": "6a2d8dbce6155dbb", "scanner": "scanner-primary", "fingerprint": "facaefab46250a10", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3662}}}]}, {"ruleId": "scanner-89e4d038e6952d49", "level": "error", "message": {"text": "Flask mutation route `miniapp_paper_cancel` without `@login_required` \u2014 webhook.py:3689"}, "properties": {"repobilityId": "f1b36e3b417bcddd", "scanner": "scanner-primary", "fingerprint": "89e4d038e6952d49", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3689}}}]}, {"ruleId": "scanner-1fa106d997270a44", "level": "error", "message": {"text": "Flask mutation route `miniapp_paper_add_cash` without `@login_required` \u2014 webhook.py:3707"}, "properties": {"repobilityId": "2535cce4bf02c829", "scanner": "scanner-primary", "fingerprint": "1fa106d997270a44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3707}}}]}, {"ruleId": "scanner-904a4eba2b4ed555", "level": "error", "message": {"text": "Flask mutation route `miniapp_paper_reset` without `@login_required` \u2014 webhook.py:3733"}, "properties": {"repobilityId": "331c4f3bfda51f5d", "scanner": "scanner-primary", "fingerprint": "904a4eba2b4ed555", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webhook.py"}, "region": {"startLine": 3733}}}]}, {"ruleId": "scanner-1a4a23a08db246b3", "level": "note", "message": {"text": "Unused endpoint: ANY /trigger/morning"}, "properties": {"repobilityId": "3f8ed6afafa023e2", "scanner": "scanner-primary", "fingerprint": "1a4a23a08db246b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10b81bdf58a760a3", "level": "note", "message": {"text": "Unused endpoint: ANY /trigger/prescreener"}, "properties": {"repobilityId": "4ad83c24ff24e17b", "scanner": "scanner-primary", "fingerprint": "10b81bdf58a760a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e585c5b1573d560", "level": "note", "message": {"text": "Unused endpoint: ANY /trigger/<mode>"}, "properties": {"repobilityId": "96559f60205eb351", "scanner": "scanner-primary", "fingerprint": "0e585c5b1573d560", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68c9d5e17d04d050", "level": "note", "message": {"text": "Unused endpoint: ANY /webhook"}, "properties": {"repobilityId": "48d289e6b939ce04", "scanner": "scanner-primary", "fingerprint": "68c9d5e17d04d050", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed2cb1702f1f600d", "level": "note", "message": {"text": "Unused endpoint: ANY /register"}, "properties": {"repobilityId": "e5797da356adca37", "scanner": "scanner-primary", "fingerprint": "ed2cb1702f1f600d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "6b1e714cbc599dbd", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-478720614672aa9f", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/login"}, "properties": {"repobilityId": "e233e542cc3cec68", "scanner": "scanner-primary", "fingerprint": "478720614672aa9f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e84e992fa82838f", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/github"}, "properties": {"repobilityId": "140d56aa5c4e2bf2", "scanner": "scanner-primary", "fingerprint": "8e84e992fa82838f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10d3177527dc1361", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/callback"}, "properties": {"repobilityId": "b7bc6c835823a3bb", "scanner": "scanner-primary", "fingerprint": "10d3177527dc1361", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68bc2ac4bf5f0856", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/logout"}, "properties": {"repobilityId": "9933ce3f83072e9c", "scanner": "scanner-primary", "fingerprint": "68bc2ac4bf5f0856", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98356fa7ff420a14", "level": "note", "message": {"text": "Unused endpoint: ANY /admin"}, "properties": {"repobilityId": "e7fed7f6d2b40156", "scanner": "scanner-primary", "fingerprint": "98356fa7ff420a14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-95a8354238176689", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/data"}, "properties": {"repobilityId": "2e0df99d00a160ed", "scanner": "scanner-primary", "fingerprint": "95a8354238176689", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5a220e627245b378", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/user/<chat_id>"}, "properties": {"repobilityId": "c3e14ff24f19c4c1", "scanner": "scanner-primary", "fingerprint": "5a220e627245b378", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f270b719ebfa9a5", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/approve"}, "properties": {"repobilityId": "ce975018a8da1eea", "scanner": "scanner-primary", "fingerprint": "5f270b719ebfa9a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eac3add729066ad", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/reject"}, "properties": {"repobilityId": "fe205d4d7c41ea9e", "scanner": "scanner-primary", "fingerprint": "6eac3add729066ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-249fa002979fb379", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/ban"}, "properties": {"repobilityId": "837fc88f42b929f8", "scanner": "scanner-primary", "fingerprint": "249fa002979fb379", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-03ee92ff0153abcc", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/unban"}, "properties": {"repobilityId": "156051e7ba7e3f89", "scanner": "scanner-primary", "fingerprint": "03ee92ff0153abcc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11b724c7478cdefb", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/user/<chat_id>/message"}, "properties": {"repobilityId": "6260aafa6a5ddb54", "scanner": "scanner-primary", "fingerprint": "11b724c7478cdefb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87c515610f26849e", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/broadcast"}, "properties": {"repobilityId": "639981f5ef08f714", "scanner": "scanner-primary", "fingerprint": "87c515610f26849e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cac11d6b352ed3ed", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/run_agent"}, "properties": {"repobilityId": "81cf5407200aed50", "scanner": "scanner-primary", "fingerprint": "cac11d6b352ed3ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0be7275d93b54db7", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/fix_ticker"}, "properties": {"repobilityId": "e877b167eb39b302", "scanner": "scanner-primary", "fingerprint": "0be7275d93b54db7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd267fa1f83f9712", "level": "note", "message": {"text": "Unused endpoint: ANY /miniapp"}, "properties": {"repobilityId": "df4c95ee5c477728", "scanner": "scanner-primary", "fingerprint": "bd267fa1f83f9712", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-df8c0d782c7a080e", "level": "note", "message": {"text": "Unused endpoint: ANY /miniapp/manifest.json"}, "properties": {"repobilityId": "279e484269dc1128", "scanner": "scanner-primary", "fingerprint": "df8c0d782c7a080e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d930a17015dccc3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/picks"}, "properties": {"repobilityId": "dcec41e8257701a9", "scanner": "scanner-primary", "fingerprint": "1d930a17015dccc3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f25727e9d496ffa", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/picks/history"}, "properties": {"repobilityId": "f5f9e769194dc2d6", "scanner": "scanner-primary", "fingerprint": "1f25727e9d496ffa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dfd36f51767ce304", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/positions"}, "properties": {"repobilityId": "3efa2a2d9a0b745d", "scanner": "scanner-primary", "fingerprint": "dfd36f51767ce304", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d562ffd5e7ce07b", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/seed_backtest"}, "properties": {"repobilityId": "205074f979f3ff79", "scanner": "scanner-primary", "fingerprint": "1d562ffd5e7ce07b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-53f689c68323ffb7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/log_bought"}, "properties": {"repobilityId": "3a46eede34865268", "scanner": "scanner-primary", "fingerprint": "53f689c68323ffb7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-648ebbafbba8e693", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/unlog_bought"}, "properties": {"repobilityId": "253cc3c22ed2d603", "scanner": "scanner-primary", "fingerprint": "648ebbafbba8e693", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0aa2068d37530cff", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/settings"}, "properties": {"repobilityId": "55ef54258afe3350", "scanner": "scanner-primary", "fingerprint": "0aa2068d37530cff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7eccf08e28e0c19e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/settings/update"}, "properties": {"repobilityId": "545c540b0dbc202b", "scanner": "scanner-primary", "fingerprint": "7eccf08e28e0c19e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81ac9cd1acdcb202", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/chart/<ticker>"}, "properties": {"repobilityId": "d0aedcbe370b765f", "scanner": "scanner-primary", "fingerprint": "81ac9cd1acdcb202", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76c6472403c9f758", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/define"}, "properties": {"repobilityId": "a81478e1dd2e90b1", "scanner": "scanner-primary", "fingerprint": "76c6472403c9f758", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ffcb2b18a6657e5", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/close_position"}, "properties": {"repobilityId": "3f2f3de4ec0b86d9", "scanner": "scanner-primary", "fingerprint": "3ffcb2b18a6657e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-210858a143295504", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/remove_position"}, "properties": {"repobilityId": "766d8fdd3e1d2485", "scanner": "scanner-primary", "fingerprint": "210858a143295504", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f7e9c10674f0ba6", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/toggle_paused"}, "properties": {"repobilityId": "9a7582fca39e5eb4", "scanner": "scanner-primary", "fingerprint": "5f7e9c10674f0ba6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-174fc6891619e96f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/feedback"}, "properties": {"repobilityId": "5e112a6766e8355a", "scanner": "scanner-primary", "fingerprint": "174fc6891619e96f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8942ce6ceee4ab84", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/history"}, "properties": {"repobilityId": "8962bfa329d7c104", "scanner": "scanner-primary", "fingerprint": "8942ce6ceee4ab84", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac8ec8fd11e543db", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/pnl_history"}, "properties": {"repobilityId": "425f1899c7361a18", "scanner": "scanner-primary", "fingerprint": "ac8ec8fd11e543db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af11ffa14a523810", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/alerts"}, "properties": {"repobilityId": "c33e02c06d219b7e", "scanner": "scanner-primary", "fingerprint": "af11ffa14a523810", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8bb64d9dfd219e7b", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/names"}, "properties": {"repobilityId": "e9494a8f0ea9727d", "scanner": "scanner-primary", "fingerprint": "8bb64d9dfd219e7b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2d77c4be1bdabbcd", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/quote"}, "properties": {"repobilityId": "177df65b62dcc4b1", "scanner": "scanner-primary", "fingerprint": "2d77c4be1bdabbcd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ad9ef50c4933be6a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/news/<ticker>"}, "properties": {"repobilityId": "ac62d5b4c964f8cb", "scanner": "scanner-primary", "fingerprint": "ad9ef50c4933be6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d9a862ba421cb2f8", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/add_alert"}, "properties": {"repobilityId": "f1630dbed6a0e1d2", "scanner": "scanner-primary", "fingerprint": "d9a862ba421cb2f8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3d3fcf7000f6d96a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/remove_alert"}, "properties": {"repobilityId": "fe78d3fef16ec6dd", "scanner": "scanner-primary", "fingerprint": "3d3fcf7000f6d96a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd94e5b9c501c977", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/clear_alerts"}, "properties": {"repobilityId": "36542657f1daa04d", "scanner": "scanner-primary", "fingerprint": "fd94e5b9c501c977", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41b097cc288f0398", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/paper"}, "properties": {"repobilityId": "64c99e059a2e503d", "scanner": "scanner-primary", "fingerprint": "41b097cc288f0398", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86dea99925e9fa9c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/update_settings"}, "properties": {"repobilityId": "1a588965979e8799", "scanner": "scanner-primary", "fingerprint": "86dea99925e9fa9c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-904daed8605e707a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/live_prices"}, "properties": {"repobilityId": "c24551dedbc0c419", "scanner": "scanner-primary", "fingerprint": "904daed8605e707a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14dc7c5340ac2545", "level": "note", "message": {"text": "Unused endpoint: ANY /api/miniapp/markets"}, "properties": {"repobilityId": "924771a3f45fce1f", "scanner": "scanner-primary", "fingerprint": "14dc7c5340ac2545", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}