{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9b3ddeed2d043b7d", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/smoke-short.ts:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/smoke-short.ts:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45c3ddb105df3069", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/Logo.tsx:18", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/Logo.tsx:18"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3dc6549d1bcae6d8", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/ZernioConnect.tsx:105", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/ZernioConnect.tsx:105"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a89b5cbdba7dbf5", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/Layout.tsx:242", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/Layout.tsx:242"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a48bfe8092fcdb8d", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/chrome.tsx:32", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/chrome.tsx:32"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f592521aa685751", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/pages/Dashboard.tsx:305", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/pages/Dashboard.tsx:305"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e2135ba2d4ae79c8", "name": "Insecure pattern 'node_child_process' in apps/api/src/services/shortVideo.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/api/src/services/shortVideo.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5fddacd357ad79d", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/visual-demo.js:151", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/visual-demo.js:151"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 62 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b06b8d86f24c77f9", "name": "Node manifest has dependencies but no lockfile: apps/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 23 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-611bcf1b287084b1", "name": "Commented-code block (5 lines) in apps/api/src/index.ts:24", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/index.ts:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71bee878820e1789", "name": "Commented-code block (7 lines) in apps/api/src/lib/plans.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/lib/plans.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16a39b3d8a45f912", "name": "Commented-code block (6 lines) in apps/api/src/routes/channels.ts:44", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/routes/channels.ts:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7929cadd8e52148", "name": "Commented-code block (5 lines) in apps/api/src/queue/workers/postCarousel.ts:63", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/queue/workers/postCarousel.ts:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d2281f2b5683298b", "name": "Commented-code block (5 lines) in apps/api/src/services/hypereal.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/services/hypereal.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-50d9478d235f03f3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/hypereal.ts:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/hypereal.ts:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8054578d22f38e9d", "name": "Commented-code block (6 lines) in apps/api/src/services/storage.ts:31", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/services/storage.ts:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4c3307f1e48e7ae5", "name": "Commented-code block (7 lines) in apps/api/src/services/shortVideo.ts:11", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/services/shortVideo.ts:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd3f7fdcc253e3ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/shortVideo.ts:44", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/shortVideo.ts:44"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-010c067dba4b13b8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/zernio.ts:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/zernio.ts:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6109aa0488ac5143", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/metrics.ts:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/metrics.ts:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f75c210bf7856a23", "name": "Commented-code block (6 lines) in apps/web/vite.config.ts:6", "shortDescription": {"text": "Commented-code block (6 lines) in apps/web/vite.config.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-242e55a44c3813c3", "name": "Commented-code block (5 lines) in apps/web/visual-demo.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/visual-demo.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94a166a21699cfd5", "name": "Commented-code block (5 lines) in apps/web/src/components/StarterKit.tsx:10", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/components/StarterKit.tsx:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2b11657881ac4d7", "name": "Commented-code block (5 lines) in apps/web/src/components/OnboardingModal.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/components/OnboardingModal.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-68b1b104fc129ecc", "name": "Commented-code block (5 lines) in apps/web/src/pages/Dashboard.tsx:141", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/pages/Dashboard.tsx:141"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bbca692f47127e99", "name": "Commented-code block (5 lines) in apps/web/src/pages/Visual.tsx:13", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/pages/Visual.tsx:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `VITE_API_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-916d67514c4d5cbe", "name": "Frontend route `/ch/:channelId` has no Link/navigate to it \u2014 apps/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/ch/:channelId` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6e9be47dc4aac43", "name": "Frontend route `/ch/:channelId/settings` has no Link/navigate to it \u2014 apps/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/ch/:channelId/settings` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9645bf2fce10f023", "name": "Frontend route `/p/:productId` has no Link/navigate to it \u2014 apps/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/p/:productId` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e23afe37d7b4511f", "name": "Frontend route `/p/:productId/settings` has no Link/navigate to it \u2014 apps/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/p/:productId/settings` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57a030d41737453e", "name": "Frontend route `/c/:carouselId` has no Link/navigate to it \u2014 apps/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/c/:carouselId` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-527ac3291ad0551f", "name": "Dangling fetch: GET https://itunes.apple.com/lookup?id=${idMatch[1]}&entity=software (apps/api/src/routes/products.ts:62", "shortDescription": {"text": "Dangling fetch: GET https://itunes.apple.com/lookup?id=${idMatch[1]}&entity=software (apps/api/src/routes/products.ts:62)"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts:62` calls `GET https://itunes.apple.com/lookup?id=${idMatch[1]}&entity=software` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/itunes.apple.com/lookup`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b28fe589a43298c7", "name": "Unused endpoint: GET /go/:slug", "shortDescription": {"text": "Unused endpoint: GET /go/:slug"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `GET /go/:slug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f022b12c08fdb63", "name": "Unused endpoint: GET /debug/overlay", "shortDescription": {"text": "Unused endpoint: GET /debug/overlay"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `GET /debug/overlay` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dde3adb27bf7eebe", "name": "Unused endpoint: USE /api", "shortDescription": {"text": "Unused endpoint: USE /api"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `USE /api` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cefe3e16e4a7273d", "name": "Unused endpoint: USE /api/products", "shortDescription": {"text": "Unused endpoint: USE /api/products"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `USE /api/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82640c3c2f97fe53", "name": "Unused endpoint: USE /api/carousels", "shortDescription": {"text": "Unused endpoint: USE /api/carousels"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `USE /api/carousels` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbeb35d232a968b6", "name": "Unused endpoint: USE /api/channels", "shortDescription": {"text": "Unused endpoint: USE /api/channels"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `USE /api/channels` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ca4664c9cda1cd6", "name": "Unused endpoint: USE /api/settings", "shortDescription": {"text": "Unused endpoint: USE /api/settings"}, "fullDescription": {"text": "`apps/api/src/index.ts` declares `USE /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11c390fda995906b", "name": "Unused endpoint: POST /:id/slides/:position/regenerate", "shortDescription": {"text": "Unused endpoint: POST /:id/slides/:position/regenerate"}, "fullDescription": {"text": "`apps/api/src/routes/carousels.ts` declares `POST /:id/slides/:position/regenerate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`apps/api/src/routes/carousels.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86272cbb5b6da0b3", "name": "Unused endpoint: POST /:id/retry", "shortDescription": {"text": "Unused endpoint: POST /:id/retry"}, "fullDescription": {"text": "`apps/api/src/routes/carousels.ts` declares `POST /:id/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a61c112b611f4bb", "name": "Unused endpoint: DELETE /:id", "shortDescription": {"text": "Unused endpoint: DELETE /:id"}, "fullDescription": {"text": "`apps/api/src/routes/carousels.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35138e2c7a047825", "name": "Unused endpoint: POST /upload-screen", "shortDescription": {"text": "Unused endpoint: POST /upload-screen"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `POST /upload-screen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7322e3eaa536d93", "name": "Unused endpoint: POST /appstore-lookup", "shortDescription": {"text": "Unused endpoint: POST /appstore-lookup"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `POST /appstore-lookup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6aa6380a7dd66dec", "name": "Unused endpoint: POST /import-screen", "shortDescription": {"text": "Unused endpoint: POST /import-screen"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `POST /import-screen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a14f8e3922aa487a", "name": "Unused endpoint: POST /analyze-website", "shortDescription": {"text": "Unused endpoint: POST /analyze-website"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `POST /analyze-website` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d5b2b188d08ca82", "name": "Unused endpoint: PUT /:id", "shortDescription": {"text": "Unused endpoint: PUT /:id"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `PUT /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3ebbf55bb0ac866", "name": "Unused endpoint: POST /:id/run-now", "shortDescription": {"text": "Unused endpoint: POST /:id/run-now"}, "fullDescription": {"text": "`apps/api/src/routes/products.ts` declares `POST /:id/run-now` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d28fa8cd6bb12f", "name": "Unused endpoint: PUT /", "shortDescription": {"text": "Unused endpoint: PUT /"}, "fullDescription": {"text": "`apps/api/src/routes/settings.ts` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f2a853fc30588d9", "name": "Unused endpoint: GET /zernio-accounts", "shortDescription": {"text": "Unused endpoint: GET /zernio-accounts"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `GET /zernio-accounts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a727e455b513ba4", "name": "Unused endpoint: POST /zernio/profiles", "shortDescription": {"text": "Unused endpoint: POST /zernio/profiles"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `POST /zernio/profiles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9abc20af70f4553", "name": "Unused endpoint: GET /zernio/connect/:platform", "shortDescription": {"text": "Unused endpoint: GET /zernio/connect/:platform"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `GET /zernio/connect/:platform` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de3336cc295fae44", "name": "Unused endpoint: GET /zernio/status", "shortDescription": {"text": "Unused endpoint: GET /zernio/status"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `GET /zernio/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f50e1b63a3d11b0f", "name": "Unused endpoint: POST /generate-persona", "shortDescription": {"text": "Unused endpoint: POST /generate-persona"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `POST /generate-persona` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87932f55d96b868c", "name": "Unused endpoint: POST /face-candidates", "shortDescription": {"text": "Unused endpoint: POST /face-candidates"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `POST /face-candidates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aae484e227b8076b", "name": "Unused endpoint: POST /upload-face", "shortDescription": {"text": "Unused endpoint: POST /upload-face"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `POST /upload-face` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f275e955c0e608e2", "name": "Unused endpoint: GET /:id/zernio/connect/:platform", "shortDescription": {"text": "Unused endpoint: GET /:id/zernio/connect/:platform"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `GET /:id/zernio/connect/:platform` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-681427b50c723958", "name": "Unused endpoint: GET /:id/zernio/status", "shortDescription": {"text": "Unused endpoint: GET /:id/zernio/status"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `GET /:id/zernio/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32dc9fad86a50518", "name": "Unused endpoint: POST /:id/zernio/verify", "shortDescription": {"text": "Unused endpoint: POST /:id/zernio/verify"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `POST /:id/zernio/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4856ee8b63ce926", "name": "Unused endpoint: POST /:id/generate-bio", "shortDescription": {"text": "Unused endpoint: POST /:id/generate-bio"}, "fullDescription": {"text": "`apps/api/src/routes/channels.ts` declares `POST /:id/generate-bio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18474"}, "properties": {"repository": "rossdelport/ai-ugc-saas", "repoUrl": "https://github.com/rossdelport/ai-ugc-saas", "branch": "main"}, "results": [{"ruleId": "scanner-9b3ddeed2d043b7d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/smoke-short.ts:11"}, "properties": {"repobilityId": "d53c1f667cb4d64a", "scanner": "scanner-primary", "fingerprint": "9b3ddeed2d043b7d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-45c3ddb105df3069", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/Logo.tsx:18"}, "properties": {"repobilityId": "1f11e254b4f78a7b", "scanner": "scanner-primary", "fingerprint": "45c3ddb105df3069", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3dc6549d1bcae6d8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/ZernioConnect.tsx:105"}, "properties": {"repobilityId": "64bee421e325e1dd", "scanner": "scanner-primary", "fingerprint": "3dc6549d1bcae6d8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3a89b5cbdba7dbf5", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/Layout.tsx:242"}, "properties": {"repobilityId": "df96fed43bdaa96d", "scanner": "scanner-primary", "fingerprint": "3a89b5cbdba7dbf5", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a48bfe8092fcdb8d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/chrome.tsx:32"}, "properties": {"repobilityId": "c886f373fe62b5c7", "scanner": "scanner-primary", "fingerprint": "a48bfe8092fcdb8d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2f592521aa685751", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/pages/Dashboard.tsx:305"}, "properties": {"repobilityId": "c27e630c27658f52", "scanner": "scanner-primary", "fingerprint": "2f592521aa685751", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e2135ba2d4ae79c8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/api/src/services/shortVideo.ts:2"}, "properties": {"repobilityId": "6d661927fd8cf171", "scanner": "scanner-primary", "fingerprint": "e2135ba2d4ae79c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/src/services/shortVideo.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-f5fddacd357ad79d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/visual-demo.js:151"}, "properties": {"repobilityId": "b5a77ae4eca889f7", "scanner": "scanner-primary", "fingerprint": "f5fddacd357ad79d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/visual-demo.js"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "aa54112513d2f7fe", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b06b8d86f24c77f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "properties": {"repobilityId": "ce77cd34ed0306d4", "scanner": "scanner-primary", "fingerprint": "b06b8d86f24c77f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "a067266408319938", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c2518fa17d5a4dc2", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "f6c1d1bd76b572dd", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "292715bccd10023e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b075f97f60415efd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-611bcf1b287084b1", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/index.ts:24"}, "properties": {"repobilityId": "40d97253b2bfc4a3", "scanner": "scanner-primary", "fingerprint": "611bcf1b287084b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71bee878820e1789", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/lib/plans.ts:3"}, "properties": {"repobilityId": "0d74fd49a64bfc44", "scanner": "scanner-primary", "fingerprint": "71bee878820e1789", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-16a39b3d8a45f912", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/routes/channels.ts:44"}, "properties": {"repobilityId": "3254f80f5022dc5e", "scanner": "scanner-primary", "fingerprint": "16a39b3d8a45f912", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e7929cadd8e52148", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/queue/workers/postCarousel.ts:63"}, "properties": {"repobilityId": "2b19002d6b275ea1", "scanner": "scanner-primary", "fingerprint": "e7929cadd8e52148", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d2281f2b5683298b", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/services/hypereal.ts:5"}, "properties": {"repobilityId": "a1230dc72802dab2", "scanner": "scanner-primary", "fingerprint": "d2281f2b5683298b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-50d9478d235f03f3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/hypereal.ts:61"}, "properties": {"repobilityId": "f0b65eeab8e944be", "scanner": "scanner-primary", "fingerprint": "50d9478d235f03f3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8054578d22f38e9d", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/services/storage.ts:31"}, "properties": {"repobilityId": "bdab26be90146c3f", "scanner": "scanner-primary", "fingerprint": "8054578d22f38e9d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4c3307f1e48e7ae5", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/services/shortVideo.ts:11"}, "properties": {"repobilityId": "9bfbb73f098d6537", "scanner": "scanner-primary", "fingerprint": "4c3307f1e48e7ae5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd3f7fdcc253e3ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/shortVideo.ts:44"}, "properties": {"repobilityId": "9921f6e311a58936", "scanner": "scanner-primary", "fingerprint": "bd3f7fdcc253e3ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-010c067dba4b13b8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/zernio.ts:37"}, "properties": {"repobilityId": "e304e043c83e3409", "scanner": "scanner-primary", "fingerprint": "010c067dba4b13b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6109aa0488ac5143", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/services/metrics.ts:34"}, "properties": {"repobilityId": "bc2c5de35199d6ba", "scanner": "scanner-primary", "fingerprint": "6109aa0488ac5143", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f75c210bf7856a23", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/web/vite.config.ts:6"}, "properties": {"repobilityId": "a4296ac9910216ef", "scanner": "scanner-primary", "fingerprint": "f75c210bf7856a23", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-242e55a44c3813c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/visual-demo.js:1"}, "properties": {"repobilityId": "c2522b747b13b11f", "scanner": "scanner-primary", "fingerprint": "242e55a44c3813c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-94a166a21699cfd5", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/components/StarterKit.tsx:10"}, "properties": {"repobilityId": "4fbc20062470f69c", "scanner": "scanner-primary", "fingerprint": "94a166a21699cfd5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a2b11657881ac4d7", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/components/OnboardingModal.tsx:3"}, "properties": {"repobilityId": "84673b7f283bd8e9", "scanner": "scanner-primary", "fingerprint": "a2b11657881ac4d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-68b1b104fc129ecc", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/pages/Dashboard.tsx:141"}, "properties": {"repobilityId": "48b976071e7d9d4d", "scanner": "scanner-primary", "fingerprint": "68b1b104fc129ecc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bbca692f47127e99", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/pages/Visual.tsx:13"}, "properties": {"repobilityId": "927004ce3df27a10", "scanner": "scanner-primary", "fingerprint": "bbca692f47127e99", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-916d67514c4d5cbe", "level": "warning", "message": {"text": "Frontend route `/ch/:channelId` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "properties": {"repobilityId": "4105e1727318d214", "scanner": "scanner-primary", "fingerprint": "916d67514c4d5cbe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-b6e9be47dc4aac43", "level": "warning", "message": {"text": "Frontend route `/ch/:channelId/settings` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "properties": {"repobilityId": "6c9e9234a8b76911", "scanner": "scanner-primary", "fingerprint": "b6e9be47dc4aac43", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-9645bf2fce10f023", "level": "warning", "message": {"text": "Frontend route `/p/:productId` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "properties": {"repobilityId": "76cc4de9426112da", "scanner": "scanner-primary", "fingerprint": "9645bf2fce10f023", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e23afe37d7b4511f", "level": "warning", "message": {"text": "Frontend route `/p/:productId/settings` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "properties": {"repobilityId": "4f86af7fda9a27c0", "scanner": "scanner-primary", "fingerprint": "e23afe37d7b4511f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-57a030d41737453e", "level": "warning", "message": {"text": "Frontend route `/c/:carouselId` has no Link/navigate to it \u2014 apps/web/src/App.tsx"}, "properties": {"repobilityId": "f64425c36e690c51", "scanner": "scanner-primary", "fingerprint": "57a030d41737453e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-527ac3291ad0551f", "level": "error", "message": {"text": "Dangling fetch: GET https://itunes.apple.com/lookup?id=${idMatch[1]}&entity=software (apps/api/src/routes/products.ts:62)"}, "properties": {"repobilityId": "b177760095f034dd", "scanner": "scanner-primary", "fingerprint": "527ac3291ad0551f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b28fe589a43298c7", "level": "note", "message": {"text": "Unused endpoint: GET /go/:slug"}, "properties": {"repobilityId": "fa9bda60361332d1", "scanner": "scanner-primary", "fingerprint": "b28fe589a43298c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f022b12c08fdb63", "level": "note", "message": {"text": "Unused endpoint: GET /debug/overlay"}, "properties": {"repobilityId": "0a795268324ee368", "scanner": "scanner-primary", "fingerprint": "5f022b12c08fdb63", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dde3adb27bf7eebe", "level": "note", "message": {"text": "Unused endpoint: USE /api"}, "properties": {"repobilityId": "282c1d529b9a1d98", "scanner": "scanner-primary", "fingerprint": "dde3adb27bf7eebe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cefe3e16e4a7273d", "level": "note", "message": {"text": "Unused endpoint: USE /api/products"}, "properties": {"repobilityId": "ba4d1ac6fa4ef112", "scanner": "scanner-primary", "fingerprint": "cefe3e16e4a7273d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-82640c3c2f97fe53", "level": "note", "message": {"text": "Unused endpoint: USE /api/carousels"}, "properties": {"repobilityId": "c436df483f579437", "scanner": "scanner-primary", "fingerprint": "82640c3c2f97fe53", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fbeb35d232a968b6", "level": "note", "message": {"text": "Unused endpoint: USE /api/channels"}, "properties": {"repobilityId": "fd398729fd162beb", "scanner": "scanner-primary", "fingerprint": "fbeb35d232a968b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ca4664c9cda1cd6", "level": "note", "message": {"text": "Unused endpoint: USE /api/settings"}, "properties": {"repobilityId": "05155f067260f3ac", "scanner": "scanner-primary", "fingerprint": "8ca4664c9cda1cd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11c390fda995906b", "level": "note", "message": {"text": "Unused endpoint: POST /:id/slides/:position/regenerate"}, "properties": {"repobilityId": "2a2dfd6e087181c3", "scanner": "scanner-primary", "fingerprint": "11c390fda995906b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "e7185ebbab0d88d3", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86272cbb5b6da0b3", "level": "note", "message": {"text": "Unused endpoint: POST /:id/retry"}, "properties": {"repobilityId": "6341d9e20fad3714", "scanner": "scanner-primary", "fingerprint": "86272cbb5b6da0b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a61c112b611f4bb", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id"}, "properties": {"repobilityId": "e9459f94287d1d3b", "scanner": "scanner-primary", "fingerprint": "7a61c112b611f4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35138e2c7a047825", "level": "note", "message": {"text": "Unused endpoint: POST /upload-screen"}, "properties": {"repobilityId": "7a43571e63277621", "scanner": "scanner-primary", "fingerprint": "35138e2c7a047825", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7322e3eaa536d93", "level": "note", "message": {"text": "Unused endpoint: POST /appstore-lookup"}, "properties": {"repobilityId": "2ec559608d236904", "scanner": "scanner-primary", "fingerprint": "f7322e3eaa536d93", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6aa6380a7dd66dec", "level": "note", "message": {"text": "Unused endpoint: POST /import-screen"}, "properties": {"repobilityId": "02270d5b7880a08d", "scanner": "scanner-primary", "fingerprint": "6aa6380a7dd66dec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a14f8e3922aa487a", "level": "note", "message": {"text": "Unused endpoint: POST /analyze-website"}, "properties": {"repobilityId": "2b6b5b16eeb81970", "scanner": "scanner-primary", "fingerprint": "a14f8e3922aa487a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "d2a0d6a3b0185302", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "a9f67f06a1263a19", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d5b2b188d08ca82", "level": "note", "message": {"text": "Unused endpoint: PUT /:id"}, "properties": {"repobilityId": "dee0945d4db5f32c", "scanner": "scanner-primary", "fingerprint": "8d5b2b188d08ca82", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3ebbf55bb0ac866", "level": "note", "message": {"text": "Unused endpoint: POST /:id/run-now"}, "properties": {"repobilityId": "bd0b739e790c2685", "scanner": "scanner-primary", "fingerprint": "c3ebbf55bb0ac866", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d28fa8cd6bb12f", "level": "note", "message": {"text": "Unused endpoint: PUT /"}, "properties": {"repobilityId": "a6cc4f83c98740b2", "scanner": "scanner-primary", "fingerprint": "67d28fa8cd6bb12f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f2a853fc30588d9", "level": "note", "message": {"text": "Unused endpoint: GET /zernio-accounts"}, "properties": {"repobilityId": "4e474eaf508cfaff", "scanner": "scanner-primary", "fingerprint": "5f2a853fc30588d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a727e455b513ba4", "level": "note", "message": {"text": "Unused endpoint: POST /zernio/profiles"}, "properties": {"repobilityId": "c56641bb7ec9888c", "scanner": "scanner-primary", "fingerprint": "6a727e455b513ba4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d9abc20af70f4553", "level": "note", "message": {"text": "Unused endpoint: GET /zernio/connect/:platform"}, "properties": {"repobilityId": "62a39db7d193460b", "scanner": "scanner-primary", "fingerprint": "d9abc20af70f4553", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-de3336cc295fae44", "level": "note", "message": {"text": "Unused endpoint: GET /zernio/status"}, "properties": {"repobilityId": "cdd00fbb614fe051", "scanner": "scanner-primary", "fingerprint": "de3336cc295fae44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f50e1b63a3d11b0f", "level": "note", "message": {"text": "Unused endpoint: POST /generate-persona"}, "properties": {"repobilityId": "46f9bc7651167e60", "scanner": "scanner-primary", "fingerprint": "f50e1b63a3d11b0f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87932f55d96b868c", "level": "note", "message": {"text": "Unused endpoint: POST /face-candidates"}, "properties": {"repobilityId": "7a17e52c96cafb35", "scanner": "scanner-primary", "fingerprint": "87932f55d96b868c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aae484e227b8076b", "level": "note", "message": {"text": "Unused endpoint: POST /upload-face"}, "properties": {"repobilityId": "41dd30273b779c8a", "scanner": "scanner-primary", "fingerprint": "aae484e227b8076b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f275e955c0e608e2", "level": "note", "message": {"text": "Unused endpoint: GET /:id/zernio/connect/:platform"}, "properties": {"repobilityId": "b159abc3f3356139", "scanner": "scanner-primary", "fingerprint": "f275e955c0e608e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-681427b50c723958", "level": "note", "message": {"text": "Unused endpoint: GET /:id/zernio/status"}, "properties": {"repobilityId": "7772ed89f4766b9b", "scanner": "scanner-primary", "fingerprint": "681427b50c723958", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32dc9fad86a50518", "level": "note", "message": {"text": "Unused endpoint: POST /:id/zernio/verify"}, "properties": {"repobilityId": "e0893ac415d749d3", "scanner": "scanner-primary", "fingerprint": "32dc9fad86a50518", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4856ee8b63ce926", "level": "note", "message": {"text": "Unused endpoint: POST /:id/generate-bio"}, "properties": {"repobilityId": "334a512aac1b21a7", "scanner": "scanner-primary", "fingerprint": "a4856ee8b63ce926", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}