Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

ycpiglet/autofolio

https://github.com/ycpiglet/autofolio · scanned 2026-06-16 01:05 UTC (2 months, 1 week ago)

140 raw signals (0 security + 140 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 124 actionable findings from 1 signal source. 16 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
70.8
/100
Security checks
71
0 findings
System graph
71
100.0% cov · 124 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: low × excluding tests × Reset all
Severity: Critical 0 High 1 Medium 27 Low 85 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 124 Crowd 0 Layer: Software 29 Hardware 3 Cicd 1 Quality 52 Api 39
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 70.8/100 with 100.0% coverage. It contains 5420 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 140 findings — concentrated in quality (68), api (39), software (29). Risk profile is high: 0 critical, 1 high, 27 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 85 of 124 actionable findings. 140 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 783 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:1 containersPinned dependencies
low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/frontend.yml:48 CI/CD securitySupply chainGithub actions
low System graph quality Integrity conf 1.00 14 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: scripts/agent_instance_registry.py:build_instance_record, scripts/agent_instance_registry.py:record_claim_instance This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or docum…
14 occurrences
repo-level (14 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 4 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: scripts/generate_report_views.py:parse_frontmatter, scripts/query_reports.py:parse_frontmatter, scripts/generate_views.py:parse_frontmatter This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygie…
4 occurrences
repo-level (4 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: scripts/task_claim_dispatcher.py:main, scripts/agent_instance_registry.py:main, scripts/agent_terminal.py:main, scripts/taskset_dispatcher.py:main This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-cod…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 5 places
Functions with the same first-5-line body hash: scripts/collab_log.py:main, scripts/subagent_council.py:main, scripts/agent_live_session.py:main, scripts/codex_subagent_bridge.py:main This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene).…
duplicatesduplication
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `multi_agent_v1` in scripts/check_agent_docs.py:86
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `multi_agent_v1` in scripts/codex_subagent_bridge.py:6
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `multi_agent_v1` in scripts/providers/codex.py:7
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `multi_agent_v1` in scripts/test_codex_subagent_bridge.py:28
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_apply_skill_patch_adds_guardrail_with_backup` in scripts/test_agent_retro.py:227
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_logout_symbol_modes_is_independent_copy` in tests/unit/test_state_logout.py:117
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: atomic_write_text
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_worker.py:197
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_add
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/schedule.py:163
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_backfill
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/task_identity.py:245
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_census
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/pane_event_log.py:316
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_census_record
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/pane_event_log.py:296
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_close_preview
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_terminal.py:590
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_create
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/task_claim_dispatcher.py:481
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_create
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/task_identity.py:259
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_disable
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/schedule.py:219
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_dispatch_next
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:395
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_enable
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/schedule.py:215
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_enqueue
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/merge_queue.py:542
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_go_to_work
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:853
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_inbox
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:498
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_kill
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:554
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_launch
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_terminal.py:549
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_leave_for_work
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:872
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_list
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/merge_queue.py:564
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_list
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/schedule.py:151
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_preview
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_terminal.py:523
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_process
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/merge_queue.py:604
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_release
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/task_claim_dispatcher.py:659
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_remove
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/merge_queue.py:589
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_spawn
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:509
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_summary
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/pane_event_log.py:290
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_triage_cycle
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_orchestrator.py:817
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_update
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/schedule.py:182
low System graph software Dead code conf 1.00 Possibly dead Python function: repl
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/query_tasks.py:158
low System graph software Dead code conf 1.00 Possibly dead Python function: shell_kind_for
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/agent_terminal.py:182
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/allocation-gap
`app/api/routers/portfolio.py` declares `GET /api/allocation-gap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/asset-curve
`app/api/routers/portfolio.py` declares `GET /api/asset-curve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/attribution
`app/api/routers/analysis.py` declares `GET /api/attribution` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/backtest
`app/api/routers/analysis.py` declares `GET /api/backtest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/conditions
`app/api/routers/trade.py` declares `GET /api/conditions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/daily-pnl
`app/api/routers/analysis.py` declares `GET /api/daily-pnl` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/disclosures
`app/api/routers/market.py` declares `GET /api/disclosures` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/events
`app/api/routers/stream.py` declares `GET /api/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/fills/recent
`app/api/routers/trade.py` declares `GET /api/fills/recent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/fundamental
`app/api/routers/market.py` declares `GET /api/fundamental` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/health
`app/api/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/holdings
`app/api/routers/portfolio.py` declares `GET /api/holdings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/ic/decisions
`app/api/routers/agents.py` declares `GET /api/ic/decisions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/ic/stream/{job_id}
`app/api/routers/agents.py` declares `GET /api/ic/stream/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/indices
`app/api/routers/market.py` declares `GET /api/indices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/intraday
`app/api/routers/market.py` declares `GET /api/intraday` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/kpis
`app/api/routers/portfolio.py` declares `GET /api/kpis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/list
`app/api/routers/agents.py` declares `GET /api/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/me
`app/api/routers/auth.py` declares `GET /api/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/order-book
`app/api/routers/market.py` declares `GET /api/order-book` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/orders
`app/api/routers/trade.py` declares `GET /api/orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/price
`app/api/routers/market.py` declares `GET /api/price` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/retro
`app/api/routers/analysis.py` declares `GET /api/retro` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/scenario
`app/api/routers/analysis.py` declares `GET /api/scenario` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/sectors
`app/api/routers/market.py` declares `GET /api/sectors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/status
`app/api/routers/engine.py` declares `GET /api/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/var
`app/api/routers/analysis.py` declares `GET /api/var` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/watchlist
`app/api/routers/market.py` declares `GET /api/watchlist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/whatif
`app/api/routers/analysis.py` declares `GET /api/whatif` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/ask
`app/api/routers/agents.py` declares `POST /api/ask` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auto-trading
`app/api/routers/engine.py` declares `POST /api/auto-trading` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/conditions
`app/api/routers/trade.py` declares `POST /api/conditions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/ic/run
`app/api/routers/agents.py` declares `POST /api/ic/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/kill-switch
`app/api/routers/engine.py` declares `POST /api/kill-switch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/login
`app/api/routers/auth.py` declares `POST /api/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/logout
`app/api/routers/auth.py` declares `POST /api/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/run-once
`app/api/routers/engine.py` declares `POST /api/run-once` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /risk-limits
`app/api/routers/settings.py` declares `PUT /risk-limits` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: app/brokers/kis/kis_client.py (1517 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/check_agent_docs.py (1881 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/44687eb0-65c5-4fe3-bcb8-9f56f94ba769/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/44687eb0-65c5-4fe3-bcb8-9f56f94ba769/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.