{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-126c33ef450d3995", "name": "Possibly dead Python function: beam_key", "shortDescription": {"text": "Possibly dead Python function: beam_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbdb6616b20a1958", "name": "Possibly dead Python function: key", "shortDescription": {"text": "Possibly dead Python function: key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1c4e3d773c949ff", "name": "Possibly dead Python function: predicted_host_usage_at", "shortDescription": {"text": "Possibly dead Python function: predicted_host_usage_at"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-932903c92ef7ca4f", "name": "Possibly dead Python function: stream_busy_until", "shortDescription": {"text": "Possibly dead Python function: stream_busy_until"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-526dcf876ed29be6", "name": "Possibly dead Python function: is_dead", "shortDescription": {"text": "Possibly dead Python function: is_dead"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "12 tests / 65 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 49 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-894fa0495efc4fb5", "name": "Legacy-named symbol `test_offload_overwrites_existing_host_copy` in tests/policies/test_simulator.py:521", "shortDescription": {"text": "Legacy-named symbol `test_offload_overwrites_existing_host_copy` in tests/policies/test_simulator.py:521"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63a00005c4b96c29", "name": "Commented-code block (7 lines) in tests/policies/invalid_chain_fixtures.py:400", "shortDescription": {"text": "Commented-code block (7 lines) in tests/policies/invalid_chain_fixtures.py:400"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-331aacbbdae1c69d", "name": "Commented-code block (9 lines) in tests/policies/test_min_grow.py:341", "shortDescription": {"text": "Commented-code block (9 lines) in tests/policies/test_min_grow.py:341"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e552348944b090dd", "name": "Commented-code block (5 lines) in src/dataflow_sim/app/server/main.py:268", "shortDescription": {"text": "Commented-code block (5 lines) in src/dataflow_sim/app/server/main.py:268"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d8f7da633782a10", "name": "Commented-code block (7 lines) in src/dataflow_sim/policies/max_reduce.py:98", "shortDescription": {"text": "Commented-code block (7 lines) in src/dataflow_sim/policies/max_reduce.py:98"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66aec1ef8ddcb376", "name": "Commented-code block (5 lines) in src/dataflow_sim/policies/min_grow.py:393", "shortDescription": {"text": "Commented-code block (5 lines) in src/dataflow_sim/policies/min_grow.py:393"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1af3ba77a832b437", "name": "Legacy-named symbol `_belady_pass_v2` in src/dataflow_sim/policies/belady_reactive.py:170", "shortDescription": {"text": "Legacy-named symbol `_belady_pass_v2` in src/dataflow_sim/policies/belady_reactive.py:170"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16151b50da0b1fbd", "name": "Commented-code block (6 lines) in src/dataflow_sim/policies/belady_reactive.py:270", "shortDescription": {"text": "Commented-code block (6 lines) in src/dataflow_sim/policies/belady_reactive.py:270"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd34c1cafe9fa2fb", "name": "Commented-code block (5 lines) in src/dataflow_sim/policies/roundtrip_planner.py:87", "shortDescription": {"text": "Commented-code block (5 lines) in src/dataflow_sim/policies/roundtrip_planner.py:87"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-236158c889efab02", "name": "Commented-code block (6 lines) in src/dataflow_sim/policies/shadow.py:121", "shortDescription": {"text": "Commented-code block (6 lines) in src/dataflow_sim/policies/shadow.py:121"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a3dd8fff9e77e5a", "name": "Commented-code block (7 lines) in src/dataflow_sim/core/validate.py:121", "shortDescription": {"text": "Commented-code block (7 lines) in src/dataflow_sim/core/validate.py:121"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f0687fc56c2540b4", "name": "Commented-code block (8 lines) in src/dataflow_sim/engine/simulator.py:545", "shortDescription": {"text": "Commented-code block (8 lines) in src/dataflow_sim/engine/simulator.py:545"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-453579515ce94375", "name": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/App.tsx:183", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/App.tsx:183"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/dataflow_sim/policies/belady_reactive.py:apply_belady_reactive_policy, src/dataflow_sim/policies/roundtrip_planner.py:apply_roundtrip_planner_policy\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b3e89d3019fcb4a", "name": "FastAPI POST `simulate` without auth dependency \u2014 src/dataflow_sim/app/server/main.py:377", "shortDescription": {"text": "FastAPI POST `simulate` without auth dependency \u2014 src/dataflow_sim/app/server/main.py:377"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`src/dataflow_sim/app/server/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24121"}, "properties": {"repository": "als244/dataflow_sim", "repoUrl": "https://github.com/als244/dataflow_sim", "branch": "main"}, "results": [{"ruleId": "scanner-126c33ef450d3995", "level": "note", "message": {"text": "Possibly dead Python function: beam_key"}, "properties": {"repobilityId": "12162492a1df3ceb", "scanner": "scanner-primary", "fingerprint": "126c33ef450d3995", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dataflow_sim/policies/min_grow.py:1153"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbdb6616b20a1958", "level": "note", "message": {"text": "Possibly dead Python function: key"}, "properties": {"repobilityId": "82ad9f64418e6fec", "scanner": "scanner-primary", "fingerprint": "cbdb6616b20a1958", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dataflow_sim/policies/roundtrip_planner.py:287"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1c4e3d773c949ff", "level": "note", "message": {"text": "Possibly dead Python function: predicted_host_usage_at"}, "properties": {"repobilityId": "68b77609eaa9b3fe", "scanner": "scanner-primary", "fingerprint": "c1c4e3d773c949ff", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dataflow_sim/policies/shadow.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-932903c92ef7ca4f", "level": "note", "message": {"text": "Possibly dead Python function: stream_busy_until"}, "properties": {"repobilityId": "43a0fec5384bd991", "scanner": "scanner-primary", "fingerprint": "932903c92ef7ca4f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dataflow_sim/policies/shadow.py:202"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-526dcf876ed29be6", "level": "note", "message": {"text": "Possibly dead Python function: is_dead"}, "properties": {"repobilityId": "5f40f83e99ee9f71", "scanner": "scanner-primary", "fingerprint": "526dcf876ed29be6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dataflow_sim/policies/shadow.py:209"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "b91e8fd1d6ae0716", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5691395fcc757699", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "27ec743e42b06318", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-894fa0495efc4fb5", "level": "note", "message": {"text": "Legacy-named symbol `test_offload_overwrites_existing_host_copy` in tests/policies/test_simulator.py:521"}, "properties": {"repobilityId": "99b15c502a84b147", "scanner": "scanner-primary", "fingerprint": "894fa0495efc4fb5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-63a00005c4b96c29", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/policies/invalid_chain_fixtures.py:400"}, "properties": {"repobilityId": "20159ec2eac91059", "scanner": "scanner-primary", "fingerprint": "63a00005c4b96c29", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-331aacbbdae1c69d", "level": "none", "message": {"text": "Commented-code block (9 lines) in tests/policies/test_min_grow.py:341"}, "properties": {"repobilityId": "5dc90c57b782b362", "scanner": "scanner-primary", "fingerprint": "331aacbbdae1c69d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e552348944b090dd", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/dataflow_sim/app/server/main.py:268"}, "properties": {"repobilityId": "43e6e5fb50f95196", "scanner": "scanner-primary", "fingerprint": "e552348944b090dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d8f7da633782a10", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/dataflow_sim/policies/max_reduce.py:98"}, "properties": {"repobilityId": "a287952bc66b71b1", "scanner": "scanner-primary", "fingerprint": "5d8f7da633782a10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66aec1ef8ddcb376", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/dataflow_sim/policies/min_grow.py:393"}, "properties": {"repobilityId": "faacf72b7ff08f5e", "scanner": "scanner-primary", "fingerprint": "66aec1ef8ddcb376", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1af3ba77a832b437", "level": "note", "message": {"text": "Legacy-named symbol `_belady_pass_v2` in src/dataflow_sim/policies/belady_reactive.py:170"}, "properties": {"repobilityId": "5c76a79e386116e1", "scanner": "scanner-primary", "fingerprint": "1af3ba77a832b437", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-16151b50da0b1fbd", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/dataflow_sim/policies/belady_reactive.py:270"}, "properties": {"repobilityId": "6a05083ee0940d3b", "scanner": "scanner-primary", "fingerprint": "16151b50da0b1fbd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd34c1cafe9fa2fb", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/dataflow_sim/policies/roundtrip_planner.py:87"}, "properties": {"repobilityId": "fdcd20fc59807628", "scanner": "scanner-primary", "fingerprint": "cd34c1cafe9fa2fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-236158c889efab02", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/dataflow_sim/policies/shadow.py:121"}, "properties": {"repobilityId": "0d5ef102b926d4bf", "scanner": "scanner-primary", "fingerprint": "236158c889efab02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6a3dd8fff9e77e5a", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/dataflow_sim/core/validate.py:121"}, "properties": {"repobilityId": "40282a59d5355782", "scanner": "scanner-primary", "fingerprint": "6a3dd8fff9e77e5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f0687fc56c2540b4", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/dataflow_sim/engine/simulator.py:545"}, "properties": {"repobilityId": "87441cf22fa7b0a8", "scanner": "scanner-primary", "fingerprint": "f0687fc56c2540b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-453579515ce94375", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/App.tsx:183"}, "properties": {"repobilityId": "feeecffcca27d5bb", "scanner": "scanner-primary", "fingerprint": "453579515ce94375", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e8c60534cbb53e7f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f3812b4d6186dd5d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6b3e89d3019fcb4a", "level": "error", "message": {"text": "FastAPI POST `simulate` without auth dependency \u2014 src/dataflow_sim/app/server/main.py:377"}, "properties": {"repobilityId": "25c5d6732e136c9a", "scanner": "scanner-primary", "fingerprint": "6b3e89d3019fcb4a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dataflow_sim/app/server/main.py"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "a37eaae381e4cb40", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}