{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8c551784e5bed2da", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/design/option-c/page.tsx:120", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/design/option-c/page.tsx:120"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0ea0269b46547fc", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/design/option-a/page.tsx:105", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/design/option-a/page.tsx:105"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-656d3c1a0f2f8038", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/(pos)/pos/page.tsx:362", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/(pos)/pos/page.tsx:362"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0531d71cd87846bd", "name": "Stray `console.log` in TS/JS \u2014 backend/scripts/seed-super-admin.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/scripts/seed-super-admin.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3783aa91b892f59a", "name": "Stray `console.log` in TS/JS \u2014 backend/src/server.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/src/server.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b4361f97ac53117", "name": "Stray `console.log` in TS/JS \u2014 backend/src/services/mailer.service.ts:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/src/services/mailer.service.ts:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "4 test file(s) for 119 source file(s) (ratio 0.03). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 36 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 43 placeholder/mock markers across 19 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `FRONTEND_URL`, `NEXT_PUBLIC_API_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1a36f14a32f1d38", "name": "Unused endpoint: PATCH /business", "shortDescription": {"text": "Unused endpoint: PATCH /business"}, "fullDescription": {"text": "`frontend/app/(dashboard)/settings/page.tsx` declares `PATCH /business` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f18d1a5727ef27d", "name": "Unused endpoint: PATCH /settings/receipt", "shortDescription": {"text": "Unused endpoint: PATCH /settings/receipt"}, "fullDescription": {"text": "`frontend/app/(dashboard)/settings/page.tsx` declares `PATCH /settings/receipt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-689e4ffd880f570d", "name": "Unused endpoint: PATCH /settings", "shortDescription": {"text": "Unused endpoint: PATCH /settings"}, "fullDescription": {"text": "`frontend/app/(dashboard)/settings/page.tsx` declares `PATCH /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f0d692e29775717", "name": "Unused endpoint: POST /subscription/upgrade", "shortDescription": {"text": "Unused endpoint: POST /subscription/upgrade"}, "fullDescription": {"text": "`frontend/app/(dashboard)/settings/page.tsx` declares `POST /subscription/upgrade` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c801ee03bb824ffe", "name": "Unused endpoint: POST /users/invite", "shortDescription": {"text": "Unused endpoint: POST /users/invite"}, "fullDescription": {"text": "`frontend/app/(dashboard)/team/page.tsx` declares `POST /users/invite` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-785d50f121ed5854", "name": "Unused endpoint: POST /branches", "shortDescription": {"text": "Unused endpoint: POST /branches"}, "fullDescription": {"text": "`frontend/app/(dashboard)/branches/page.tsx` declares `POST /branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cca7583916efd86a", "name": "Unused endpoint: POST /products", "shortDescription": {"text": "Unused endpoint: POST /products"}, "fullDescription": {"text": "`frontend/app/(dashboard)/products/page.tsx` declares `POST /products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1033c7a1d3884505", "name": "Unused endpoint: POST /categories", "shortDescription": {"text": "Unused endpoint: POST /categories"}, "fullDescription": {"text": "`frontend/app/(dashboard)/products/page.tsx` declares `POST /categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`frontend/lib/auth-context.tsx` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94da1aaaf36cc41f", "name": "Unused endpoint: USE /api/v1", "shortDescription": {"text": "Unused endpoint: USE /api/v1"}, "fullDescription": {"text": "`backend/src/app.ts` declares `USE /api/v1` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72f99d58636b648b", "name": "Unused endpoint: GET /logs", "shortDescription": {"text": "Unused endpoint: GET /logs"}, "fullDescription": {"text": "`backend/src/routes/inventory.routes.ts` declares `GET /logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab7693eb5313e2b6", "name": "Unused endpoint: GET /:branchId", "shortDescription": {"text": "Unused endpoint: GET /:branchId"}, "fullDescription": {"text": "`backend/src/routes/inventory.routes.ts` declares `GET /:branchId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ee3f57a7e0a404a", "name": "Unused endpoint: GET /:branchId/low-stock", "shortDescription": {"text": "Unused endpoint: GET /:branchId/low-stock"}, "fullDescription": {"text": "`backend/src/routes/inventory.routes.ts` declares `GET /:branchId/low-stock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3b2495c2acbde99", "name": "Unused endpoint: POST /:branchId/restock", "shortDescription": {"text": "Unused endpoint: POST /:branchId/restock"}, "fullDescription": {"text": "`backend/src/routes/inventory.routes.ts` declares `POST /:branchId/restock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1980e8894fba924b", "name": "Unused endpoint: GET /:branchId/:productId", "shortDescription": {"text": "Unused endpoint: GET /:branchId/:productId"}, "fullDescription": {"text": "`backend/src/routes/inventory.routes.ts` declares `GET /:branchId/:productId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5d3ba0b9081751b", "name": "Unused endpoint: PATCH /:branchId/:productId", "shortDescription": {"text": "Unused endpoint: PATCH /:branchId/:productId"}, "fullDescription": {"text": "`backend/src/routes/inventory.routes.ts` declares `PATCH /:branchId/:productId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24876cd4b5637290", "name": "Unused endpoint: POST /:branchId/open", "shortDescription": {"text": "Unused endpoint: POST /:branchId/open"}, "fullDescription": {"text": "`backend/src/routes/register.routes.ts` declares `POST /:branchId/open` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d00e43cdb348b69f", "name": "Unused endpoint: POST /:branchId/close", "shortDescription": {"text": "Unused endpoint: POST /:branchId/close"}, "fullDescription": {"text": "`backend/src/routes/register.routes.ts` declares `POST /:branchId/close` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1570f68cc45cf784", "name": "Unused endpoint: GET /:branchId/history", "shortDescription": {"text": "Unused endpoint: GET /:branchId/history"}, "fullDescription": {"text": "`backend/src/routes/register.routes.ts` declares `GET /:branchId/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce17d6b092a81ca", "name": "Unused endpoint: POST /refresh", "shortDescription": {"text": "Unused endpoint: POST /refresh"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4257ec01219aa99a", "name": "Unused endpoint: POST /forgot-password", "shortDescription": {"text": "Unused endpoint: POST /forgot-password"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `POST /forgot-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68a5d356c0cac9e3", "name": "Unused endpoint: POST /reset-password", "shortDescription": {"text": "Unused endpoint: POST /reset-password"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `POST /reset-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19f2e7231bd6fbb5", "name": "Unused endpoint: PATCH /change-password", "shortDescription": {"text": "Unused endpoint: PATCH /change-password"}, "fullDescription": {"text": "`backend/src/routes/auth.routes.ts` declares `PATCH /change-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fbc954f63526821", "name": "Unused endpoint: PATCH /:id", "shortDescription": {"text": "Unused endpoint: PATCH /:id"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `PATCH /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a61c112b611f4bb", "name": "Unused endpoint: DELETE /:id", "shortDescription": {"text": "Unused endpoint: DELETE /:id"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3540c0332e6b5e5e", "name": "Unused endpoint: GET /:id/staff", "shortDescription": {"text": "Unused endpoint: GET /:id/staff"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `GET /:id/staff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cd3fa032d2ed0fc", "name": "Unused endpoint: POST /:id/staff", "shortDescription": {"text": "Unused endpoint: POST /:id/staff"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `POST /:id/staff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78cbb6b8d3420d4f", "name": "Unused endpoint: DELETE /:id/staff/:userId", "shortDescription": {"text": "Unused endpoint: DELETE /:id/staff/:userId"}, "fullDescription": {"text": "`backend/src/routes/branch.routes.ts` declares `DELETE /:id/staff/:userId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e90d7a35fc9bc40d", "name": "Unused endpoint: GET /businesses", "shortDescription": {"text": "Unused endpoint: GET /businesses"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `GET /businesses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbb4ec03074a2eed", "name": "Unused endpoint: GET /businesses/:id", "shortDescription": {"text": "Unused endpoint: GET /businesses/:id"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `GET /businesses/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96be4e9c2180cf40", "name": "Unused endpoint: PATCH /businesses/:id", "shortDescription": {"text": "Unused endpoint: PATCH /businesses/:id"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `PATCH /businesses/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5436acf28b975dd", "name": "Unused endpoint: POST /businesses/:id/suspend", "shortDescription": {"text": "Unused endpoint: POST /businesses/:id/suspend"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `POST /businesses/:id/suspend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd8dc4599ec52a08", "name": "Unused endpoint: GET /stats", "shortDescription": {"text": "Unused endpoint: GET /stats"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `GET /stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c78e9940ce95d7e1", "name": "Unused endpoint: GET /ai-usage", "shortDescription": {"text": "Unused endpoint: GET /ai-usage"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `GET /ai-usage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb4df3c2c490ecc9", "name": "Unused endpoint: POST /impersonate/:id", "shortDescription": {"text": "Unused endpoint: POST /impersonate/:id"}, "fullDescription": {"text": "`backend/src/routes/admin.routes.ts` declares `POST /impersonate/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`backend/src/routes/user.routes.ts` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea575b61c121b733", "name": "Unused endpoint: PATCH /me", "shortDescription": {"text": "Unused endpoint: PATCH /me"}, "fullDescription": {"text": "`backend/src/routes/user.routes.ts` declares `PATCH /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46eb93a4accdc83b", "name": "Unused endpoint: POST /invite", "shortDescription": {"text": "Unused endpoint: POST /invite"}, "fullDescription": {"text": "`backend/src/routes/user.routes.ts` declares `POST /invite` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7374031324ca1f57", "name": "Unused endpoint: PATCH /:id/activate", "shortDescription": {"text": "Unused endpoint: PATCH /:id/activate"}, "fullDescription": {"text": "`backend/src/routes/user.routes.ts` declares `PATCH /:id/activate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b28d92215a503990", "name": "Unused endpoint: USE /auth", "shortDescription": {"text": "Unused endpoint: USE /auth"}, "fullDescription": {"text": "`backend/src/routes/index.ts` declares `USE /auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a195dd44f7baf11d", "name": "Unused endpoint: USE /business", "shortDescription": {"text": "Unused endpoint: USE /business"}, "fullDescription": {"text": "`backend/src/routes/index.ts` declares `USE /business` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-386058916b0b228a", "name": "Unused endpoint: USE /branches", "shortDescription": {"text": "Unused endpoint: USE /branches"}, "fullDescription": {"text": "`backend/src/routes/index.ts` declares `USE /branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e480cf1bc736555", "name": "Unused endpoint: USE /users", "shortDescription": {"text": "Unused endpoint: USE /users"}, "fullDescription": {"text": "`backend/src/routes/index.ts` declares `USE /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-290abf713a4ae6c2", "name": "Unused endpoint: USE /categories", "shortDescription": {"text": "Unused endpoint: USE /categories"}, "fullDescription": {"text": "`backend/src/routes/index.ts` declares `USE /categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17730"}, "properties": {"repository": "RagibShariar/POSiq", "repoUrl": "https://github.com/RagibShariar/POSiq", "branch": "main"}, "results": [{"ruleId": "scanner-8c551784e5bed2da", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/design/option-c/page.tsx:120"}, "properties": {"repobilityId": "8c7fb5498d45c489", "scanner": "scanner-primary", "fingerprint": "8c551784e5bed2da", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b0ea0269b46547fc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/design/option-a/page.tsx:105"}, "properties": {"repobilityId": "1e34c5e97e51c076", "scanner": "scanner-primary", "fingerprint": "b0ea0269b46547fc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-656d3c1a0f2f8038", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/(pos)/pos/page.tsx:362"}, "properties": {"repobilityId": "d043c694f6a76fa8", "scanner": "scanner-primary", "fingerprint": "656d3c1a0f2f8038", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0531d71cd87846bd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/scripts/seed-super-admin.ts:32"}, "properties": {"repobilityId": "575d56b82edcc13a", "scanner": "scanner-primary", "fingerprint": "0531d71cd87846bd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3783aa91b892f59a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/src/server.ts:6"}, "properties": {"repobilityId": "60601c54191a4c88", "scanner": "scanner-primary", "fingerprint": "3783aa91b892f59a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3b4361f97ac53117", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/src/services/mailer.service.ts:11"}, "properties": {"repobilityId": "b3fa64b142f2f54f", "scanner": "scanner-primary", "fingerprint": "3b4361f97ac53117", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "56e41fe2f0400046", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f75a87fdd2bd9fcc", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f7aac8dcb3d90193", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "7110a8237b10ef68", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "2ba9bb7ba0e3fb2a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "583dea107bb3626c", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "000ec10155886ff7", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fc61a7437197ff1a", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-d1a36f14a32f1d38", "level": "note", "message": {"text": "Unused endpoint: PATCH /business"}, "properties": {"repobilityId": "60caca6e49f5e6a1", "scanner": "scanner-primary", "fingerprint": "d1a36f14a32f1d38", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0f18d1a5727ef27d", "level": "note", "message": {"text": "Unused endpoint: PATCH /settings/receipt"}, "properties": {"repobilityId": "7c5691d05319f05a", "scanner": "scanner-primary", "fingerprint": "0f18d1a5727ef27d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-689e4ffd880f570d", "level": "note", "message": {"text": "Unused endpoint: PATCH /settings"}, "properties": {"repobilityId": "a33fdf7327fd5e7d", "scanner": "scanner-primary", "fingerprint": "689e4ffd880f570d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0f0d692e29775717", "level": "note", "message": {"text": "Unused endpoint: POST /subscription/upgrade"}, "properties": {"repobilityId": "3b98cde35c62dcc9", "scanner": "scanner-primary", "fingerprint": "0f0d692e29775717", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c801ee03bb824ffe", "level": "note", "message": {"text": "Unused endpoint: POST /users/invite"}, "properties": {"repobilityId": "db1bbdf110dd794d", "scanner": "scanner-primary", "fingerprint": "c801ee03bb824ffe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-785d50f121ed5854", "level": "note", "message": {"text": "Unused endpoint: POST /branches"}, "properties": {"repobilityId": "d31563da309917ae", "scanner": "scanner-primary", "fingerprint": "785d50f121ed5854", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cca7583916efd86a", "level": "note", "message": {"text": "Unused endpoint: POST /products"}, "properties": {"repobilityId": "4787718712e2f323", "scanner": "scanner-primary", "fingerprint": "cca7583916efd86a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1033c7a1d3884505", "level": "note", "message": {"text": "Unused endpoint: POST /categories"}, "properties": {"repobilityId": "1b1ce2eb7bae2c1f", "scanner": "scanner-primary", "fingerprint": "1033c7a1d3884505", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "183831cf61cddc3e", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94da1aaaf36cc41f", "level": "note", "message": {"text": "Unused endpoint: USE /api/v1"}, "properties": {"repobilityId": "ea6d441822f7cd0b", "scanner": "scanner-primary", "fingerprint": "94da1aaaf36cc41f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72f99d58636b648b", "level": "note", "message": {"text": "Unused endpoint: GET /logs"}, "properties": {"repobilityId": "e1cd5a824cb072fa", "scanner": "scanner-primary", "fingerprint": "72f99d58636b648b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab7693eb5313e2b6", "level": "note", "message": {"text": "Unused endpoint: GET /:branchId"}, "properties": {"repobilityId": "4797627e192087cb", "scanner": "scanner-primary", "fingerprint": "ab7693eb5313e2b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ee3f57a7e0a404a", "level": "note", "message": {"text": "Unused endpoint: GET /:branchId/low-stock"}, "properties": {"repobilityId": "9d8f2aef3cb81cbf", "scanner": "scanner-primary", "fingerprint": "3ee3f57a7e0a404a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e3b2495c2acbde99", "level": "note", "message": {"text": "Unused endpoint: POST /:branchId/restock"}, "properties": {"repobilityId": "95b145d88333be06", "scanner": "scanner-primary", "fingerprint": "e3b2495c2acbde99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1980e8894fba924b", "level": "note", "message": {"text": "Unused endpoint: GET /:branchId/:productId"}, "properties": {"repobilityId": "ead1454f29e3be87", "scanner": "scanner-primary", "fingerprint": "1980e8894fba924b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5d3ba0b9081751b", "level": "note", "message": {"text": "Unused endpoint: PATCH /:branchId/:productId"}, "properties": {"repobilityId": "b9c3b42969011465", "scanner": "scanner-primary", "fingerprint": "c5d3ba0b9081751b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-24876cd4b5637290", "level": "note", "message": {"text": "Unused endpoint: POST /:branchId/open"}, "properties": {"repobilityId": "e94598832ef11155", "scanner": "scanner-primary", "fingerprint": "24876cd4b5637290", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d00e43cdb348b69f", "level": "note", "message": {"text": "Unused endpoint: POST /:branchId/close"}, "properties": {"repobilityId": "a3f636cac7b88644", "scanner": "scanner-primary", "fingerprint": "d00e43cdb348b69f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1570f68cc45cf784", "level": "note", "message": {"text": "Unused endpoint: GET /:branchId/history"}, "properties": {"repobilityId": "2146b0f9033447d8", "scanner": "scanner-primary", "fingerprint": "1570f68cc45cf784", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "646c9e6597affe5c", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "07d9777318a15b5e", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "9012f2aac2275ea9", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ce17d6b092a81ca", "level": "note", "message": {"text": "Unused endpoint: POST /refresh"}, "properties": {"repobilityId": "2ba97406358677f7", "scanner": "scanner-primary", "fingerprint": "7ce17d6b092a81ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4257ec01219aa99a", "level": "note", "message": {"text": "Unused endpoint: POST /forgot-password"}, "properties": {"repobilityId": "b94ebfdb0d647625", "scanner": "scanner-primary", "fingerprint": "4257ec01219aa99a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68a5d356c0cac9e3", "level": "note", "message": {"text": "Unused endpoint: POST /reset-password"}, "properties": {"repobilityId": "d07482164174653d", "scanner": "scanner-primary", "fingerprint": "68a5d356c0cac9e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-19f2e7231bd6fbb5", "level": "note", "message": {"text": "Unused endpoint: PATCH /change-password"}, "properties": {"repobilityId": "7c57fdbe57144cae", "scanner": "scanner-primary", "fingerprint": "19f2e7231bd6fbb5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "05904afe4712cc2d", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "72577e717fb49f8e", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "804205b85231623d", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fbc954f63526821", "level": "note", "message": {"text": "Unused endpoint: PATCH /:id"}, "properties": {"repobilityId": "10c73aa8b0438d59", "scanner": "scanner-primary", "fingerprint": "5fbc954f63526821", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a61c112b611f4bb", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id"}, "properties": {"repobilityId": "086756aea32fda1e", "scanner": "scanner-primary", "fingerprint": "7a61c112b611f4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3540c0332e6b5e5e", "level": "note", "message": {"text": "Unused endpoint: GET /:id/staff"}, "properties": {"repobilityId": "6172f5a1eafb690f", "scanner": "scanner-primary", "fingerprint": "3540c0332e6b5e5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2cd3fa032d2ed0fc", "level": "note", "message": {"text": "Unused endpoint: POST /:id/staff"}, "properties": {"repobilityId": "347eefd60f8f696c", "scanner": "scanner-primary", "fingerprint": "2cd3fa032d2ed0fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-78cbb6b8d3420d4f", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id/staff/:userId"}, "properties": {"repobilityId": "e868401e417550fc", "scanner": "scanner-primary", "fingerprint": "78cbb6b8d3420d4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e90d7a35fc9bc40d", "level": "note", "message": {"text": "Unused endpoint: GET /businesses"}, "properties": {"repobilityId": "b523e2ce31ddeb03", "scanner": "scanner-primary", "fingerprint": "e90d7a35fc9bc40d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cbb4ec03074a2eed", "level": "note", "message": {"text": "Unused endpoint: GET /businesses/:id"}, "properties": {"repobilityId": "46bff9f9d57e4bba", "scanner": "scanner-primary", "fingerprint": "cbb4ec03074a2eed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-96be4e9c2180cf40", "level": "note", "message": {"text": "Unused endpoint: PATCH /businesses/:id"}, "properties": {"repobilityId": "8088d194a0733262", "scanner": "scanner-primary", "fingerprint": "96be4e9c2180cf40", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5436acf28b975dd", "level": "note", "message": {"text": "Unused endpoint: POST /businesses/:id/suspend"}, "properties": {"repobilityId": "9d10cfa5ea7d4407", "scanner": "scanner-primary", "fingerprint": "c5436acf28b975dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd8dc4599ec52a08", "level": "note", "message": {"text": "Unused endpoint: GET /stats"}, "properties": {"repobilityId": "276b526a0c677b80", "scanner": "scanner-primary", "fingerprint": "cd8dc4599ec52a08", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c78e9940ce95d7e1", "level": "note", "message": {"text": "Unused endpoint: GET /ai-usage"}, "properties": {"repobilityId": "367f08822caaaacf", "scanner": "scanner-primary", "fingerprint": "c78e9940ce95d7e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb4df3c2c490ecc9", "level": "note", "message": {"text": "Unused endpoint: POST /impersonate/:id"}, "properties": {"repobilityId": "ec52e152f6d8c6d3", "scanner": "scanner-primary", "fingerprint": "cb4df3c2c490ecc9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "22074e23b5f2da47", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea575b61c121b733", "level": "note", "message": {"text": "Unused endpoint: PATCH /me"}, "properties": {"repobilityId": "f763977e5716f94f", "scanner": "scanner-primary", "fingerprint": "ea575b61c121b733", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-46eb93a4accdc83b", "level": "note", "message": {"text": "Unused endpoint: POST /invite"}, "properties": {"repobilityId": "6b694b14f12ff3e5", "scanner": "scanner-primary", "fingerprint": "46eb93a4accdc83b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7374031324ca1f57", "level": "note", "message": {"text": "Unused endpoint: PATCH /:id/activate"}, "properties": {"repobilityId": "3c9a68e17f96873e", "scanner": "scanner-primary", "fingerprint": "7374031324ca1f57", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b28d92215a503990", "level": "note", "message": {"text": "Unused endpoint: USE /auth"}, "properties": {"repobilityId": "46f0eca560fd8783", "scanner": "scanner-primary", "fingerprint": "b28d92215a503990", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a195dd44f7baf11d", "level": "note", "message": {"text": "Unused endpoint: USE /business"}, "properties": {"repobilityId": "68ac05f95a9de3aa", "scanner": "scanner-primary", "fingerprint": "a195dd44f7baf11d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-386058916b0b228a", "level": "note", "message": {"text": "Unused endpoint: USE /branches"}, "properties": {"repobilityId": "3d580733486fab2f", "scanner": "scanner-primary", "fingerprint": "386058916b0b228a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e480cf1bc736555", "level": "note", "message": {"text": "Unused endpoint: USE /users"}, "properties": {"repobilityId": "79f4e070b46583fa", "scanner": "scanner-primary", "fingerprint": "4e480cf1bc736555", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-290abf713a4ae6c2", "level": "note", "message": {"text": "Unused endpoint: USE /categories"}, "properties": {"repobilityId": "b61d6520888928ba", "scanner": "scanner-primary", "fingerprint": "290abf713a4ae6c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}