{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f4c410793b59fdd4", "name": "Insecure pattern 'cors_wildcard' in TauriApp/python-sidecar/api_server.py:25", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in TauriApp/python-sidecar/api_server.py:25"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 42 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5707a82bcc73cd8", "name": "Node manifest has dependencies but no lockfile: TauriApp/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: TauriApp/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 12 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-01a5f43c61fa9247", "name": "`fetch()` without try/.catch or AbortSignal \u2014 TauriApp/src/api/client.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 TauriApp/src/api/client.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nTauriApp/python-sidecar/scrna.py:status, TauriApp/python-sidecar/microbiome.py:status, TauriApp/python-sidecar/spatial.py:status, TauriApp/python-sidecar/rnaseq.py:status\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-595a02d484f9c111", "name": "FastAPI POST `run_r` without auth dependency \u2014 TauriApp/python-sidecar/r_bridge.py:223", "shortDescription": {"text": "FastAPI POST `run_r` without auth dependency \u2014 TauriApp/python-sidecar/r_bridge.py:223"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-199a1ee68ab73c5b", "name": "FastAPI POST `run_console` without auth dependency \u2014 TauriApp/python-sidecar/r_bridge.py:295", "shortDescription": {"text": "FastAPI POST `run_console` without auth dependency \u2014 TauriApp/python-sidecar/r_bridge.py:295"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1d144fdddea78cd", "name": "FastAPI POST `warmup` without auth dependency \u2014 TauriApp/python-sidecar/api_server.py:64", "shortDescription": {"text": "FastAPI POST `warmup` without auth dependency \u2014 TauriApp/python-sidecar/api_server.py:64"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0912cc1c5a5e01f4", "name": "FastAPI POST `install_packages` without auth dependency \u2014 TauriApp/python-sidecar/r_packages.py:225", "shortDescription": {"text": "FastAPI POST `install_packages` without auth dependency \u2014 TauriApp/python-sidecar/r_packages.py:225"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7986c4f0cb340b3e", "name": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/scrna.py:179", "shortDescription": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/scrna.py:179"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03ac745f80530bb1", "name": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/microbiome.py:205", "shortDescription": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/microbiome.py:205"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52ba35370dc02b1f", "name": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/spatial.py:110", "shortDescription": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/spatial.py:110"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82ac247045387045", "name": "FastAPI POST `export` without auth dependency \u2014 TauriApp/python-sidecar/platemap.py:78", "shortDescription": {"text": "FastAPI POST `export` without auth dependency \u2014 TauriApp/python-sidecar/platemap.py:78"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f6c727ac68072e9", "name": "FastAPI POST `set_rscript` without auth dependency \u2014 TauriApp/python-sidecar/r_settings.py:82", "shortDescription": {"text": "FastAPI POST `set_rscript` without auth dependency \u2014 TauriApp/python-sidecar/r_settings.py:82"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b64cf2506673e2f5", "name": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:83", "shortDescription": {"text": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:83"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-941beed6fd8453db", "name": "FastAPI POST `process` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:145", "shortDescription": {"text": "FastAPI POST `process` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:145"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e6817c503e115b13", "name": "FastAPI POST `bar_stats` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:206", "shortDescription": {"text": "FastAPI POST `bar_stats` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:206"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62898882c915660f", "name": "FastAPI POST `plot_line` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:271", "shortDescription": {"text": "FastAPI POST `plot_line` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:271"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-09fe50a2bcb3a74a", "name": "FastAPI POST `plot_bar` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:330", "shortDescription": {"text": "FastAPI POST `plot_bar` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:330"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af87397ccb23850a", "name": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:53", "shortDescription": {"text": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:53"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-647ae13df9da3693", "name": "FastAPI POST `analyze` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:110", "shortDescription": {"text": "FastAPI POST `analyze` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:110"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6ea7143cd3425dd5", "name": "FastAPI POST `plot` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:231", "shortDescription": {"text": "FastAPI POST `plot` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:231"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c52883cad9c155c", "name": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/rnaseq.py:36", "shortDescription": {"text": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/rnaseq.py:36"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-def6cf890a6a1fdd", "name": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/rnaseq.py:157", "shortDescription": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/rnaseq.py:157"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e420ba9609792087", "name": "Unused endpoint: GET /api/analysis/check-r", "shortDescription": {"text": "Unused endpoint: GET /api/analysis/check-r"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_bridge.py` declares `GET /api/analysis/check-r` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac8def18c7a46c11", "name": "Unused endpoint: POST /api/analysis/run-r", "shortDescription": {"text": "Unused endpoint: POST /api/analysis/run-r"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_bridge.py` declares `POST /api/analysis/run-r` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4092f80379bfb986", "name": "Unused endpoint: POST /api/analysis/run-console", "shortDescription": {"text": "Unused endpoint: POST /api/analysis/run-console"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_bridge.py` declares `POST /api/analysis/run-console` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`TauriApp/python-sidecar/api_server.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c2507f3182299a0", "name": "Unused endpoint: GET /api/version", "shortDescription": {"text": "Unused endpoint: GET /api/version"}, "fullDescription": {"text": "`TauriApp/python-sidecar/api_server.py` declares `GET /api/version` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b5d8553f8577bf2", "name": "Unused endpoint: POST /api/analysis/warmup", "shortDescription": {"text": "Unused endpoint: POST /api/analysis/warmup"}, "fullDescription": {"text": "`TauriApp/python-sidecar/api_server.py` declares `POST /api/analysis/warmup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ef983ab882316d3", "name": "Unused endpoint: GET /api/analysis/packages", "shortDescription": {"text": "Unused endpoint: GET /api/analysis/packages"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_packages.py` declares `GET /api/analysis/packages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9249a3ec15017ca", "name": "Unused endpoint: GET /api/analysis/check-packages", "shortDescription": {"text": "Unused endpoint: GET /api/analysis/check-packages"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_packages.py` declares `GET /api/analysis/check-packages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34e2b52ba467a81e", "name": "Unused endpoint: POST /api/analysis/install-packages", "shortDescription": {"text": "Unused endpoint: POST /api/analysis/install-packages"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_packages.py` declares `POST /api/analysis/install-packages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e0073db3c73b13c", "name": "Unused endpoint: GET /api/analysis/install-status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/analysis/install-status/{job_id}"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_packages.py` declares `GET /api/analysis/install-status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8f2044f0ab86117", "name": "Unused endpoint: POST /api/scrna/register", "shortDescription": {"text": "Unused endpoint: POST /api/scrna/register"}, "fullDescription": {"text": "`TauriApp/python-sidecar/scrna.py` declares `POST /api/scrna/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-079f5d8bfa7fbe85", "name": "Unused endpoint: POST /api/scrna/run", "shortDescription": {"text": "Unused endpoint: POST /api/scrna/run"}, "fullDescription": {"text": "`TauriApp/python-sidecar/scrna.py` declares `POST /api/scrna/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4c376ece27bebe9", "name": "Unused endpoint: GET /api/scrna/status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/scrna/status/{job_id}"}, "fullDescription": {"text": "`TauriApp/python-sidecar/scrna.py` declares `GET /api/scrna/status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab4fc11414f41215", "name": "Unused endpoint: POST /api/microbiome/register", "shortDescription": {"text": "Unused endpoint: POST /api/microbiome/register"}, "fullDescription": {"text": "`TauriApp/python-sidecar/microbiome.py` declares `POST /api/microbiome/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fda2caf003eaa25f", "name": "Unused endpoint: POST /api/microbiome/run", "shortDescription": {"text": "Unused endpoint: POST /api/microbiome/run"}, "fullDescription": {"text": "`TauriApp/python-sidecar/microbiome.py` declares `POST /api/microbiome/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25e083a882d4ede1", "name": "Unused endpoint: GET /api/microbiome/status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/microbiome/status/{job_id}"}, "fullDescription": {"text": "`TauriApp/python-sidecar/microbiome.py` declares `GET /api/microbiome/status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4216552d236fe936", "name": "Unused endpoint: POST /api/spatial/register", "shortDescription": {"text": "Unused endpoint: POST /api/spatial/register"}, "fullDescription": {"text": "`TauriApp/python-sidecar/spatial.py` declares `POST /api/spatial/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98cef4b9ceb01cf8", "name": "Unused endpoint: POST /api/spatial/run", "shortDescription": {"text": "Unused endpoint: POST /api/spatial/run"}, "fullDescription": {"text": "`TauriApp/python-sidecar/spatial.py` declares `POST /api/spatial/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-415ecb6299d06e21", "name": "Unused endpoint: GET /api/spatial/status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/spatial/status/{job_id}"}, "fullDescription": {"text": "`TauriApp/python-sidecar/spatial.py` declares `GET /api/spatial/status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-336faba1f191330d", "name": "Unused endpoint: GET /api/platemap/plates", "shortDescription": {"text": "Unused endpoint: GET /api/platemap/plates"}, "fullDescription": {"text": "`TauriApp/python-sidecar/platemap.py` declares `GET /api/platemap/plates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4daa1ece8698ea3", "name": "Unused endpoint: POST /api/platemap/export", "shortDescription": {"text": "Unused endpoint: POST /api/platemap/export"}, "fullDescription": {"text": "`TauriApp/python-sidecar/platemap.py` declares `POST /api/platemap/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f47ac7f62d04c1d7", "name": "Unused endpoint: GET /api/analysis/get-settings", "shortDescription": {"text": "Unused endpoint: GET /api/analysis/get-settings"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_settings.py` declares `GET /api/analysis/get-settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ac03af8c10261ed", "name": "Unused endpoint: POST /api/analysis/set-rscript", "shortDescription": {"text": "Unused endpoint: POST /api/analysis/set-rscript"}, "fullDescription": {"text": "`TauriApp/python-sidecar/r_settings.py` declares `POST /api/analysis/set-rscript` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9551c74c01a2c43a", "name": "Unused endpoint: POST /api/xcelligence/upload", "shortDescription": {"text": "Unused endpoint: POST /api/xcelligence/upload"}, "fullDescription": {"text": "`TauriApp/python-sidecar/xcelligence.py` declares `POST /api/xcelligence/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e60a77e7d70f670", "name": "Unused endpoint: POST /api/xcelligence/process", "shortDescription": {"text": "Unused endpoint: POST /api/xcelligence/process"}, "fullDescription": {"text": "`TauriApp/python-sidecar/xcelligence.py` declares `POST /api/xcelligence/process` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6493d73d180bdd2a", "name": "Unused endpoint: POST /api/xcelligence/bar-stats", "shortDescription": {"text": "Unused endpoint: POST /api/xcelligence/bar-stats"}, "fullDescription": {"text": "`TauriApp/python-sidecar/xcelligence.py` declares `POST /api/xcelligence/bar-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d93b2366507405d0", "name": "Unused endpoint: POST /api/xcelligence/plot-line", "shortDescription": {"text": "Unused endpoint: POST /api/xcelligence/plot-line"}, "fullDescription": {"text": "`TauriApp/python-sidecar/xcelligence.py` declares `POST /api/xcelligence/plot-line` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ccc201b9229e4a2", "name": "Unused endpoint: POST /api/xcelligence/plot-bar", "shortDescription": {"text": "Unused endpoint: POST /api/xcelligence/plot-bar"}, "fullDescription": {"text": "`TauriApp/python-sidecar/xcelligence.py` declares `POST /api/xcelligence/plot-bar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e57fb1e61c884c8d", "name": "Unused endpoint: POST /api/qpcr/upload", "shortDescription": {"text": "Unused endpoint: POST /api/qpcr/upload"}, "fullDescription": {"text": "`TauriApp/python-sidecar/qpcr.py` declares `POST /api/qpcr/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7565b09e659935f", "name": "Unused endpoint: POST /api/qpcr/analyze", "shortDescription": {"text": "Unused endpoint: POST /api/qpcr/analyze"}, "fullDescription": {"text": "`TauriApp/python-sidecar/qpcr.py` declares `POST /api/qpcr/analyze` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1716e0451ac3aef3", "name": "Unused endpoint: POST /api/qpcr/plot", "shortDescription": {"text": "Unused endpoint: POST /api/qpcr/plot"}, "fullDescription": {"text": "`TauriApp/python-sidecar/qpcr.py` declares `POST /api/qpcr/plot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5644654d9135b27", "name": "Unused endpoint: POST /api/rnaseq/upload", "shortDescription": {"text": "Unused endpoint: POST /api/rnaseq/upload"}, "fullDescription": {"text": "`TauriApp/python-sidecar/rnaseq.py` declares `POST /api/rnaseq/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-890b1e493b867e67", "name": "Unused endpoint: POST /api/rnaseq/run", "shortDescription": {"text": "Unused endpoint: POST /api/rnaseq/run"}, "fullDescription": {"text": "`TauriApp/python-sidecar/rnaseq.py` declares `POST /api/rnaseq/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e0fd28a422c9b20", "name": "Unused endpoint: GET /api/rnaseq/status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/rnaseq/status/{job_id}"}, "fullDescription": {"text": "`TauriApp/python-sidecar/rnaseq.py` declares `GET /api/rnaseq/status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23640"}, "properties": {"repository": "zhuojianlook/lab-analysis-suite", "repoUrl": "https://github.com/zhuojianlook/lab-analysis-suite", "branch": "main"}, "results": [{"ruleId": "scanner-f4c410793b59fdd4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in TauriApp/python-sidecar/api_server.py:25"}, "properties": {"repobilityId": "379575797c2ce9cf", "scanner": "scanner-primary", "fingerprint": "f4c410793b59fdd4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/api_server.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "bb512ea1fff3ac22", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-a5707a82bcc73cd8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: TauriApp/package.json"}, "properties": {"repobilityId": "e510dfaa4f74e1ae", "scanner": "scanner-primary", "fingerprint": "a5707a82bcc73cd8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1cafd65e236ea534", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "2f156c505fbf2759", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "1a90d93d6eb348f9", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "af03023edfb3d7b1", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9a347bef0335ca2d", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-01a5f43c61fa9247", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 TauriApp/src/api/client.ts:49"}, "properties": {"repobilityId": "c14b8518967d9b90", "scanner": "scanner-primary", "fingerprint": "01a5f43c61fa9247", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "16b811451b446103", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-595a02d484f9c111", "level": "error", "message": {"text": "FastAPI POST `run_r` without auth dependency \u2014 TauriApp/python-sidecar/r_bridge.py:223"}, "properties": {"repobilityId": "e9f64713a8dd404f", "scanner": "scanner-primary", "fingerprint": "595a02d484f9c111", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/r_bridge.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-199a1ee68ab73c5b", "level": "error", "message": {"text": "FastAPI POST `run_console` without auth dependency \u2014 TauriApp/python-sidecar/r_bridge.py:295"}, "properties": {"repobilityId": "a4302dcc36201e68", "scanner": "scanner-primary", "fingerprint": "199a1ee68ab73c5b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/r_bridge.py"}, "region": {"startLine": 295}}}]}, {"ruleId": "scanner-d1d144fdddea78cd", "level": "error", "message": {"text": "FastAPI POST `warmup` without auth dependency \u2014 TauriApp/python-sidecar/api_server.py:64"}, "properties": {"repobilityId": "f9fe975442806eda", "scanner": "scanner-primary", "fingerprint": "d1d144fdddea78cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/api_server.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-0912cc1c5a5e01f4", "level": "error", "message": {"text": "FastAPI POST `install_packages` without auth dependency \u2014 TauriApp/python-sidecar/r_packages.py:225"}, "properties": {"repobilityId": "61ed4cf84e905f8e", "scanner": "scanner-primary", "fingerprint": "0912cc1c5a5e01f4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/r_packages.py"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-7986c4f0cb340b3e", "level": "error", "message": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/scrna.py:179"}, "properties": {"repobilityId": "4f5656646ab408f1", "scanner": "scanner-primary", "fingerprint": "7986c4f0cb340b3e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/scrna.py"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-03ac745f80530bb1", "level": "error", "message": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/microbiome.py:205"}, "properties": {"repobilityId": "28729d8daa44a072", "scanner": "scanner-primary", "fingerprint": "03ac745f80530bb1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/microbiome.py"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-52ba35370dc02b1f", "level": "error", "message": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/spatial.py:110"}, "properties": {"repobilityId": "a966bdd04394c70d", "scanner": "scanner-primary", "fingerprint": "52ba35370dc02b1f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/spatial.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-82ac247045387045", "level": "error", "message": {"text": "FastAPI POST `export` without auth dependency \u2014 TauriApp/python-sidecar/platemap.py:78"}, "properties": {"repobilityId": "97e985ad9e7571b0", "scanner": "scanner-primary", "fingerprint": "82ac247045387045", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/platemap.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-8f6c727ac68072e9", "level": "error", "message": {"text": "FastAPI POST `set_rscript` without auth dependency \u2014 TauriApp/python-sidecar/r_settings.py:82"}, "properties": {"repobilityId": "818bfcfa48c2f554", "scanner": "scanner-primary", "fingerprint": "8f6c727ac68072e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/r_settings.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-b64cf2506673e2f5", "level": "error", "message": {"text": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:83"}, "properties": {"repobilityId": "6cf324bdc722d4a3", "scanner": "scanner-primary", "fingerprint": "b64cf2506673e2f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/xcelligence.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-941beed6fd8453db", "level": "error", "message": {"text": "FastAPI POST `process` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:145"}, "properties": {"repobilityId": "baba7cf598f3fccf", "scanner": "scanner-primary", "fingerprint": "941beed6fd8453db", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/xcelligence.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-e6817c503e115b13", "level": "error", "message": {"text": "FastAPI POST `bar_stats` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:206"}, "properties": {"repobilityId": "7f99988681ca9859", "scanner": "scanner-primary", "fingerprint": "e6817c503e115b13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/xcelligence.py"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-62898882c915660f", "level": "error", "message": {"text": "FastAPI POST `plot_line` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:271"}, "properties": {"repobilityId": "10ae491889c84c14", "scanner": "scanner-primary", "fingerprint": "62898882c915660f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/xcelligence.py"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-09fe50a2bcb3a74a", "level": "error", "message": {"text": "FastAPI POST `plot_bar` without auth dependency \u2014 TauriApp/python-sidecar/xcelligence.py:330"}, "properties": {"repobilityId": "2cb35f30ed867be1", "scanner": "scanner-primary", "fingerprint": "09fe50a2bcb3a74a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/xcelligence.py"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-af87397ccb23850a", "level": "error", "message": {"text": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:53"}, "properties": {"repobilityId": "3f081df11ddf13fb", "scanner": "scanner-primary", "fingerprint": "af87397ccb23850a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/qpcr.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-647ae13df9da3693", "level": "error", "message": {"text": "FastAPI POST `analyze` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:110"}, "properties": {"repobilityId": "0aa0b35781bb0434", "scanner": "scanner-primary", "fingerprint": "647ae13df9da3693", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/qpcr.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-6ea7143cd3425dd5", "level": "error", "message": {"text": "FastAPI POST `plot` without auth dependency \u2014 TauriApp/python-sidecar/qpcr.py:231"}, "properties": {"repobilityId": "b1e35710c1b48229", "scanner": "scanner-primary", "fingerprint": "6ea7143cd3425dd5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/qpcr.py"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-3c52883cad9c155c", "level": "error", "message": {"text": "FastAPI POST `upload` without auth dependency \u2014 TauriApp/python-sidecar/rnaseq.py:36"}, "properties": {"repobilityId": "8e0cbbf3506a6fa5", "scanner": "scanner-primary", "fingerprint": "3c52883cad9c155c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/rnaseq.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-def6cf890a6a1fdd", "level": "error", "message": {"text": "FastAPI POST `run` without auth dependency \u2014 TauriApp/python-sidecar/rnaseq.py:157"}, "properties": {"repobilityId": "5fb130f9c53dc33f", "scanner": "scanner-primary", "fingerprint": "def6cf890a6a1fdd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TauriApp/python-sidecar/rnaseq.py"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-e420ba9609792087", "level": "note", "message": {"text": "Unused endpoint: GET /api/analysis/check-r"}, "properties": {"repobilityId": "2fe1b018ab21d1b1", "scanner": "scanner-primary", "fingerprint": "e420ba9609792087", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac8def18c7a46c11", "level": "note", "message": {"text": "Unused endpoint: POST /api/analysis/run-r"}, "properties": {"repobilityId": "07f100cb6885697a", "scanner": "scanner-primary", "fingerprint": "ac8def18c7a46c11", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4092f80379bfb986", "level": "note", "message": {"text": "Unused endpoint: POST /api/analysis/run-console"}, "properties": {"repobilityId": "0da8572dcde0178a", "scanner": "scanner-primary", "fingerprint": "4092f80379bfb986", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "d44a85cb5fa79699", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c2507f3182299a0", "level": "note", "message": {"text": "Unused endpoint: GET /api/version"}, "properties": {"repobilityId": "482e007eab984eb2", "scanner": "scanner-primary", "fingerprint": "6c2507f3182299a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b5d8553f8577bf2", "level": "note", "message": {"text": "Unused endpoint: POST /api/analysis/warmup"}, "properties": {"repobilityId": "afb10a636ca46d28", "scanner": "scanner-primary", "fingerprint": "3b5d8553f8577bf2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ef983ab882316d3", "level": "note", "message": {"text": "Unused endpoint: GET /api/analysis/packages"}, "properties": {"repobilityId": "fd0153a7cb9350c6", "scanner": "scanner-primary", "fingerprint": "9ef983ab882316d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c9249a3ec15017ca", "level": "note", "message": {"text": "Unused endpoint: GET /api/analysis/check-packages"}, "properties": {"repobilityId": "6edcbc90072ce973", "scanner": "scanner-primary", "fingerprint": "c9249a3ec15017ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34e2b52ba467a81e", "level": "note", "message": {"text": "Unused endpoint: POST /api/analysis/install-packages"}, "properties": {"repobilityId": "51786df3cba6765f", "scanner": "scanner-primary", "fingerprint": "34e2b52ba467a81e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e0073db3c73b13c", "level": "note", "message": {"text": "Unused endpoint: GET /api/analysis/install-status/{job_id}"}, "properties": {"repobilityId": "2720315beec664b3", "scanner": "scanner-primary", "fingerprint": "2e0073db3c73b13c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8f2044f0ab86117", "level": "note", "message": {"text": "Unused endpoint: POST /api/scrna/register"}, "properties": {"repobilityId": "0ea6e946eccdf52d", "scanner": "scanner-primary", "fingerprint": "b8f2044f0ab86117", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-079f5d8bfa7fbe85", "level": "note", "message": {"text": "Unused endpoint: POST /api/scrna/run"}, "properties": {"repobilityId": "04ee573226e4309b", "scanner": "scanner-primary", "fingerprint": "079f5d8bfa7fbe85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4c376ece27bebe9", "level": "note", "message": {"text": "Unused endpoint: GET /api/scrna/status/{job_id}"}, "properties": {"repobilityId": "31e0822753210ba0", "scanner": "scanner-primary", "fingerprint": "b4c376ece27bebe9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab4fc11414f41215", "level": "note", "message": {"text": "Unused endpoint: POST /api/microbiome/register"}, "properties": {"repobilityId": "bea0135ca234501c", "scanner": "scanner-primary", "fingerprint": "ab4fc11414f41215", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fda2caf003eaa25f", "level": "note", "message": {"text": "Unused endpoint: POST /api/microbiome/run"}, "properties": {"repobilityId": "af436a22bf55c703", "scanner": "scanner-primary", "fingerprint": "fda2caf003eaa25f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-25e083a882d4ede1", "level": "note", "message": {"text": "Unused endpoint: GET /api/microbiome/status/{job_id}"}, "properties": {"repobilityId": "65d43fbd119df68e", "scanner": "scanner-primary", "fingerprint": "25e083a882d4ede1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4216552d236fe936", "level": "note", "message": {"text": "Unused endpoint: POST /api/spatial/register"}, "properties": {"repobilityId": "e17a4430eb17696f", "scanner": "scanner-primary", "fingerprint": "4216552d236fe936", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98cef4b9ceb01cf8", "level": "note", "message": {"text": "Unused endpoint: POST /api/spatial/run"}, "properties": {"repobilityId": "dba857b7bf3e198d", "scanner": "scanner-primary", "fingerprint": "98cef4b9ceb01cf8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-415ecb6299d06e21", "level": "note", "message": {"text": "Unused endpoint: GET /api/spatial/status/{job_id}"}, "properties": {"repobilityId": "c48341aaf2702965", "scanner": "scanner-primary", "fingerprint": "415ecb6299d06e21", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-336faba1f191330d", "level": "note", "message": {"text": "Unused endpoint: GET /api/platemap/plates"}, "properties": {"repobilityId": "7b1297ab4888fe8e", "scanner": "scanner-primary", "fingerprint": "336faba1f191330d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4daa1ece8698ea3", "level": "note", "message": {"text": "Unused endpoint: POST /api/platemap/export"}, "properties": {"repobilityId": "ee387f34996e4fd4", "scanner": "scanner-primary", "fingerprint": "b4daa1ece8698ea3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f47ac7f62d04c1d7", "level": "note", "message": {"text": "Unused endpoint: GET /api/analysis/get-settings"}, "properties": {"repobilityId": "9c51dcb9721e7231", "scanner": "scanner-primary", "fingerprint": "f47ac7f62d04c1d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6ac03af8c10261ed", "level": "note", "message": {"text": "Unused endpoint: POST /api/analysis/set-rscript"}, "properties": {"repobilityId": "d928f6ec5149fd82", "scanner": "scanner-primary", "fingerprint": "6ac03af8c10261ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9551c74c01a2c43a", "level": "note", "message": {"text": "Unused endpoint: POST /api/xcelligence/upload"}, "properties": {"repobilityId": "daf67fee2870946c", "scanner": "scanner-primary", "fingerprint": "9551c74c01a2c43a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7e60a77e7d70f670", "level": "note", "message": {"text": "Unused endpoint: POST /api/xcelligence/process"}, "properties": {"repobilityId": "29a7da0ecbaff171", "scanner": "scanner-primary", "fingerprint": "7e60a77e7d70f670", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6493d73d180bdd2a", "level": "note", "message": {"text": "Unused endpoint: POST /api/xcelligence/bar-stats"}, "properties": {"repobilityId": "01c9bbfdc597d2e8", "scanner": "scanner-primary", "fingerprint": "6493d73d180bdd2a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d93b2366507405d0", "level": "note", "message": {"text": "Unused endpoint: POST /api/xcelligence/plot-line"}, "properties": {"repobilityId": "43f9678d85aebd55", "scanner": "scanner-primary", "fingerprint": "d93b2366507405d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ccc201b9229e4a2", "level": "note", "message": {"text": "Unused endpoint: POST /api/xcelligence/plot-bar"}, "properties": {"repobilityId": "850c7493ebc50869", "scanner": "scanner-primary", "fingerprint": "5ccc201b9229e4a2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e57fb1e61c884c8d", "level": "note", "message": {"text": "Unused endpoint: POST /api/qpcr/upload"}, "properties": {"repobilityId": "b4b3c1792ef35094", "scanner": "scanner-primary", "fingerprint": "e57fb1e61c884c8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b7565b09e659935f", "level": "note", "message": {"text": "Unused endpoint: POST /api/qpcr/analyze"}, "properties": {"repobilityId": "82587c8618eb4298", "scanner": "scanner-primary", "fingerprint": "b7565b09e659935f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1716e0451ac3aef3", "level": "note", "message": {"text": "Unused endpoint: POST /api/qpcr/plot"}, "properties": {"repobilityId": "9fcdba33f19a4215", "scanner": "scanner-primary", "fingerprint": "1716e0451ac3aef3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e5644654d9135b27", "level": "note", "message": {"text": "Unused endpoint: POST /api/rnaseq/upload"}, "properties": {"repobilityId": "962eb0957dc60163", "scanner": "scanner-primary", "fingerprint": "e5644654d9135b27", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-890b1e493b867e67", "level": "note", "message": {"text": "Unused endpoint: POST /api/rnaseq/run"}, "properties": {"repobilityId": "0007a351fd48cc38", "scanner": "scanner-primary", "fingerprint": "890b1e493b867e67", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e0fd28a422c9b20", "level": "note", "message": {"text": "Unused endpoint: GET /api/rnaseq/status/{job_id}"}, "properties": {"repobilityId": "3cdd1b26cdbeebd5", "scanner": "scanner-primary", "fingerprint": "0e0fd28a422c9b20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}