{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-635fb2cba33631a6", "name": "Insecure pattern 'node_child_process' in scripts/check-migrations.mjs:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-migrations.mjs:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-daca89beddec4d98", "name": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/grid.html:88", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/grid.html:88"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8613e51ada33cf2", "name": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/character.html:216", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/character.html:216"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6dc950273a5a883d", "name": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/chat.html:225", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/chat.html:225"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8832866d5254762d", "name": "Very large file: test/workerMigration.test.js (2960 lines)", "shortDescription": {"text": "Very large file: test/workerMigration.test.js (2960 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a71063601c8c296", "name": "Very large file: worker/game.mjs (4808 lines)", "shortDescription": {"text": "Very large file: worker/game.mjs (4808 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ed68815bca2f8c", "name": "Node manifest has dependencies but no lockfile: package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 13 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-11c9645ce5db21c5", "name": "Commented-code block (11 lines) in test/items.integration.test.js:1", "shortDescription": {"text": "Commented-code block (11 lines) in test/items.integration.test.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e7e42674907eeb7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/worldMap.test.js:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/worldMap.test.js:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2195075feb2bbac", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/chatShortcut.test.js:111", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/chatShortcut.test.js:111"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e5eef5d02447d11", "name": "Commented-code block (7 lines) in test/combat.integration.test.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in test/combat.integration.test.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9df7960c8e73c51d", "name": "Commented-code block (5 lines) in test/abilities.integration.test.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in test/abilities.integration.test.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf46fef5025ac1a8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/deathPage.test.js:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/deathPage.test.js:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1af7dc36e429db68", "name": "Commented-code block (7 lines) in test/workerMigration.test.js:94", "shortDescription": {"text": "Commented-code block (7 lines) in test/workerMigration.test.js:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5b350bfa88c1289f", "name": "Commented-code block (8 lines) in scripts/smoke.mjs:4", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/smoke.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e8033b9b23f7b14", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/smoke.mjs:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/smoke.mjs:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-488e90a1e509beca", "name": "Commented-code block (6 lines) in scripts/combat-smoke.mjs:4", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/combat-smoke.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-21fa51257433d2dd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/combat-smoke.mjs:54", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/combat-smoke.mjs:54"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88dff85c2591be4b", "name": "Commented-code block (5 lines) in utils/abilities.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in utils/abilities.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aabaeb3f6bbe4a7f", "name": "Commented-code block (5 lines) in utils/progressionGrid.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in utils/progressionGrid.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e206145f4dd01b4", "name": "Commented-code block (7 lines) in utils/items.js:4", "shortDescription": {"text": "Commented-code block (7 lines) in utils/items.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30d3e2fafcb45e62", "name": "Commented-code block (6 lines) in worker/resurrection.mjs:94", "shortDescription": {"text": "Commented-code block (6 lines) in worker/resurrection.mjs:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-770dd367135a484a", "name": "Commented-code block (5 lines) in worker/npcVoice.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in worker/npcVoice.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0516b5eaaef0e74", "name": "Commented-code block (5 lines) in worker/game.mjs:101", "shortDescription": {"text": "Commented-code block (5 lines) in worker/game.mjs:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-677c1b347b620707", "name": "`fetch()` without try/.catch or AbortSignal \u2014 worker/index.mjs:107", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 worker/index.mjs:107"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad30af71cbd07e4b", "name": "Unused endpoint: GET /signup", "shortDescription": {"text": "Unused endpoint: GET /signup"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da9c4d3c2e18918e", "name": "Unused endpoint: GET /cemetery", "shortDescription": {"text": "Unused endpoint: GET /cemetery"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /cemetery` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add6dcb6007baef6", "name": "Unused endpoint: GET /leaderboard", "shortDescription": {"text": "Unused endpoint: GET /leaderboard"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /leaderboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d16b1bb2723f51e", "name": "Unused endpoint: POST /signup", "shortDescription": {"text": "Unused endpoint: POST /signup"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ca735a2e6e3646c", "name": "Unused endpoint: GET /logout", "shortDescription": {"text": "Unused endpoint: GET /logout"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f336a05a1d1549f5", "name": "Unused endpoint: GET /success", "shortDescription": {"text": "Unused endpoint: GET /success"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /success` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc3ae6430981c707", "name": "Unused endpoint: GET /map-state", "shortDescription": {"text": "Unused endpoint: GET /map-state"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /map-state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd03ffc6a6e38273", "name": "Unused endpoint: GET /world-events", "shortDescription": {"text": "Unused endpoint: GET /world-events"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /world-events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9dfc283aefe761d", "name": "Unused endpoint: GET /character", "shortDescription": {"text": "Unused endpoint: GET /character"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /character` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13c0404f697c3e75", "name": "Unused endpoint: GET /grid", "shortDescription": {"text": "Unused endpoint: GET /grid"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /grid` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfde2541f23e4dfa", "name": "Unused endpoint: GET /death", "shortDescription": {"text": "Unused endpoint: GET /death"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /death` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-888ea008581aa5a3", "name": "Unused endpoint: GET /you-died", "shortDescription": {"text": "Unused endpoint: GET /you-died"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /you-died` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbe480fc42a105c4", "name": "Unused endpoint: GET /death-data", "shortDescription": {"text": "Unused endpoint: GET /death-data"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /death-data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e29f4c1ec636e2c7", "name": "Unused endpoint: POST /resurrection-link", "shortDescription": {"text": "Unused endpoint: POST /resurrection-link"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /resurrection-link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7825addb011bca8b", "name": "Unused endpoint: GET /cemetery-data", "shortDescription": {"text": "Unused endpoint: GET /cemetery-data"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /cemetery-data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-961f73caa9748436", "name": "Unused endpoint: GET /leaderboard-data", "shortDescription": {"text": "Unused endpoint: GET /leaderboard-data"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /leaderboard-data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60f955d85e9eefd4", "name": "Unused endpoint: POST /stripe/webhook", "shortDescription": {"text": "Unused endpoint: POST /stripe/webhook"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /stripe/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2082825433e65702", "name": "Unused endpoint: GET /chat/:row/:col", "shortDescription": {"text": "Unused endpoint: GET /chat/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /chat/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ff32e0301c64f71", "name": "Unused endpoint: GET /user-attributes", "shortDescription": {"text": "Unused endpoint: GET /user-attributes"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /user-attributes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f20aa7735411352b", "name": "Unused endpoint: POST /allocate", "shortDescription": {"text": "Unused endpoint: POST /allocate"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /allocate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44ebff759bcc7c39", "name": "Unused endpoint: GET /progression", "shortDescription": {"text": "Unused endpoint: GET /progression"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /progression` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc3709142c918d04", "name": "Unused endpoint: POST /grid/unlock", "shortDescription": {"text": "Unused endpoint: POST /grid/unlock"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /grid/unlock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc78dd5d15a92f7e", "name": "Unused endpoint: POST /grid/respec", "shortDescription": {"text": "Unused endpoint: POST /grid/respec"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /grid/respec` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b4dc81dcde5c94e", "name": "Unused endpoint: GET /tick", "shortDescription": {"text": "Unused endpoint: GET /tick"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /tick` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bedb812d1702f60c", "name": "Unused endpoint: GET /messages/:row/:col", "shortDescription": {"text": "Unused endpoint: GET /messages/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /messages/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a362d7a509b6225", "name": "Unused endpoint: GET /room-ecology/:row/:col", "shortDescription": {"text": "Unused endpoint: GET /room-ecology/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /room-ecology/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c45ee1254295c4d1", "name": "Unused endpoint: GET /room-state/:row/:col", "shortDescription": {"text": "Unused endpoint: GET /room-state/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /room-state/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb13e0fbb2ee9c37", "name": "Unused endpoint: POST /room-presence/:row/:col", "shortDescription": {"text": "Unused endpoint: POST /room-presence/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /room-presence/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc8d4143f7bba629", "name": "Unused endpoint: POST /room-access/:row/:col/pay", "shortDescription": {"text": "Unused endpoint: POST /room-access/:row/:col/pay"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /room-access/:row/:col/pay` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcfb63d60e06e4cc", "name": "Unused endpoint: POST /chat/:row/:col", "shortDescription": {"text": "Unused endpoint: POST /chat/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /chat/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55e6a10587118547", "name": "Unused endpoint: POST /attack/:row/:col", "shortDescription": {"text": "Unused endpoint: POST /attack/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /attack/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a43a8ed20fe546fd", "name": "Unused endpoint: POST /skill/:row/:col", "shortDescription": {"text": "Unused endpoint: POST /skill/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /skill/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5aa492b815c6fc3", "name": "Unused endpoint: POST /job/:row/:col", "shortDescription": {"text": "Unused endpoint: POST /job/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `POST /job/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48712b2a9c1cb9ca", "name": "Unused endpoint: GET /ws/:row/:col", "shortDescription": {"text": "Unused endpoint: GET /ws/:row/:col"}, "fullDescription": {"text": "`worker/index.mjs` declares `GET /ws/:row/:col` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21951"}, "properties": {"repository": "urcades/rpgchat", "repoUrl": "https://github.com/urcades/rpgchat", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-635fb2cba33631a6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-migrations.mjs:13"}, "properties": {"repobilityId": "6488738b6523d833", "scanner": "scanner-primary", "fingerprint": "635fb2cba33631a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-migrations.mjs"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-daca89beddec4d98", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/grid.html:88"}, "properties": {"repobilityId": "f3d43bb5cf6553ed", "scanner": "scanner-primary", "fingerprint": "daca89beddec4d98", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "worker/static/grid.html"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-f8613e51ada33cf2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/character.html:216"}, "properties": {"repobilityId": "f271beeccfba3406", "scanner": "scanner-primary", "fingerprint": "f8613e51ada33cf2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "worker/static/character.html"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-6dc950273a5a883d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in worker/static/chat.html:225"}, "properties": {"repobilityId": "48368204c0796dfb", "scanner": "scanner-primary", "fingerprint": "6dc950273a5a883d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "worker/static/chat.html"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-8832866d5254762d", "level": "note", "message": {"text": "Very large file: test/workerMigration.test.js (2960 lines)"}, "properties": {"repobilityId": "63fb0ecee158ec93", "scanner": "scanner-primary", "fingerprint": "8832866d5254762d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0a71063601c8c296", "level": "note", "message": {"text": "Very large file: worker/game.mjs (4808 lines)"}, "properties": {"repobilityId": "8329490808e01af6", "scanner": "scanner-primary", "fingerprint": "0a71063601c8c296", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "f3a60130cb136e0c", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b3ed68815bca2f8c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "properties": {"repobilityId": "7edae0550c126386", "scanner": "scanner-primary", "fingerprint": "b3ed68815bca2f8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "73b2e5a9144b4d8b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "838ee51e71b09fe8", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "57eaa74e728157d8", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2da70a7f48190e25", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "75a146e99bac587c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-11c9645ce5db21c5", "level": "none", "message": {"text": "Commented-code block (11 lines) in test/items.integration.test.js:1"}, "properties": {"repobilityId": "f8c6041463005dfa", "scanner": "scanner-primary", "fingerprint": "11c9645ce5db21c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e7e42674907eeb7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/worldMap.test.js:38"}, "properties": {"repobilityId": "c9d88d873762eeaf", "scanner": "scanner-primary", "fingerprint": "9e7e42674907eeb7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d2195075feb2bbac", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/chatShortcut.test.js:111"}, "properties": {"repobilityId": "c1c91512387247be", "scanner": "scanner-primary", "fingerprint": "d2195075feb2bbac", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3e5eef5d02447d11", "level": "none", "message": {"text": "Commented-code block (7 lines) in test/combat.integration.test.js:1"}, "properties": {"repobilityId": "70f310d5802606aa", "scanner": "scanner-primary", "fingerprint": "3e5eef5d02447d11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9df7960c8e73c51d", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/abilities.integration.test.js:1"}, "properties": {"repobilityId": "8a91ac12e742fbea", "scanner": "scanner-primary", "fingerprint": "9df7960c8e73c51d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bf46fef5025ac1a8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/deathPage.test.js:38"}, "properties": {"repobilityId": "f80403ba50c89e96", "scanner": "scanner-primary", "fingerprint": "bf46fef5025ac1a8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1af7dc36e429db68", "level": "none", "message": {"text": "Commented-code block (7 lines) in test/workerMigration.test.js:94"}, "properties": {"repobilityId": "b97329ea37a5b967", "scanner": "scanner-primary", "fingerprint": "1af7dc36e429db68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5b350bfa88c1289f", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/smoke.mjs:4"}, "properties": {"repobilityId": "327b4c8245218dfd", "scanner": "scanner-primary", "fingerprint": "5b350bfa88c1289f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e8033b9b23f7b14", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/smoke.mjs:36"}, "properties": {"repobilityId": "a818e1f5a6722026", "scanner": "scanner-primary", "fingerprint": "8e8033b9b23f7b14", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-488e90a1e509beca", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/combat-smoke.mjs:4"}, "properties": {"repobilityId": "807a9b0cb759a4dd", "scanner": "scanner-primary", "fingerprint": "488e90a1e509beca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-21fa51257433d2dd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/combat-smoke.mjs:54"}, "properties": {"repobilityId": "f41c7ed3288358f2", "scanner": "scanner-primary", "fingerprint": "21fa51257433d2dd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-88dff85c2591be4b", "level": "none", "message": {"text": "Commented-code block (5 lines) in utils/abilities.js:6"}, "properties": {"repobilityId": "1f18c30e7b064f6b", "scanner": "scanner-primary", "fingerprint": "88dff85c2591be4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aabaeb3f6bbe4a7f", "level": "none", "message": {"text": "Commented-code block (5 lines) in utils/progressionGrid.js:1"}, "properties": {"repobilityId": "58569f8f95782639", "scanner": "scanner-primary", "fingerprint": "aabaeb3f6bbe4a7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0e206145f4dd01b4", "level": "none", "message": {"text": "Commented-code block (7 lines) in utils/items.js:4"}, "properties": {"repobilityId": "9bd40ff5077fef3d", "scanner": "scanner-primary", "fingerprint": "0e206145f4dd01b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30d3e2fafcb45e62", "level": "none", "message": {"text": "Commented-code block (6 lines) in worker/resurrection.mjs:94"}, "properties": {"repobilityId": "4484ffc03d8c68e6", "scanner": "scanner-primary", "fingerprint": "30d3e2fafcb45e62", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-770dd367135a484a", "level": "none", "message": {"text": "Commented-code block (5 lines) in worker/npcVoice.mjs:1"}, "properties": {"repobilityId": "fdf08cc2761a117f", "scanner": "scanner-primary", "fingerprint": "770dd367135a484a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0516b5eaaef0e74", "level": "none", "message": {"text": "Commented-code block (5 lines) in worker/game.mjs:101"}, "properties": {"repobilityId": "94f144e4bf9a2f01", "scanner": "scanner-primary", "fingerprint": "c0516b5eaaef0e74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-677c1b347b620707", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 worker/index.mjs:107"}, "properties": {"repobilityId": "56fff7ca4e87c90f", "scanner": "scanner-primary", "fingerprint": "677c1b347b620707", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "908796a8f32eef2f", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ad30af71cbd07e4b", "level": "note", "message": {"text": "Unused endpoint: GET /signup"}, "properties": {"repobilityId": "0c0f2600828895a7", "scanner": "scanner-primary", "fingerprint": "ad30af71cbd07e4b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da9c4d3c2e18918e", "level": "note", "message": {"text": "Unused endpoint: GET /cemetery"}, "properties": {"repobilityId": "d8c4748af21ccfcf", "scanner": "scanner-primary", "fingerprint": "da9c4d3c2e18918e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-add6dcb6007baef6", "level": "note", "message": {"text": "Unused endpoint: GET /leaderboard"}, "properties": {"repobilityId": "6b047774c5a0d211", "scanner": "scanner-primary", "fingerprint": "add6dcb6007baef6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "5b13c572424fc60a", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d16b1bb2723f51e", "level": "note", "message": {"text": "Unused endpoint: POST /signup"}, "properties": {"repobilityId": "c37318e8e509f42d", "scanner": "scanner-primary", "fingerprint": "8d16b1bb2723f51e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ca735a2e6e3646c", "level": "note", "message": {"text": "Unused endpoint: GET /logout"}, "properties": {"repobilityId": "fd4177a4737a1b15", "scanner": "scanner-primary", "fingerprint": "5ca735a2e6e3646c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f336a05a1d1549f5", "level": "note", "message": {"text": "Unused endpoint: GET /success"}, "properties": {"repobilityId": "746e53986b4b9852", "scanner": "scanner-primary", "fingerprint": "f336a05a1d1549f5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dc3ae6430981c707", "level": "note", "message": {"text": "Unused endpoint: GET /map-state"}, "properties": {"repobilityId": "31851058ce310646", "scanner": "scanner-primary", "fingerprint": "dc3ae6430981c707", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dd03ffc6a6e38273", "level": "note", "message": {"text": "Unused endpoint: GET /world-events"}, "properties": {"repobilityId": "ca3767c9ec904973", "scanner": "scanner-primary", "fingerprint": "dd03ffc6a6e38273", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a9dfc283aefe761d", "level": "note", "message": {"text": "Unused endpoint: GET /character"}, "properties": {"repobilityId": "bc710842bb0f6922", "scanner": "scanner-primary", "fingerprint": "a9dfc283aefe761d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-13c0404f697c3e75", "level": "note", "message": {"text": "Unused endpoint: GET /grid"}, "properties": {"repobilityId": "0c6e577f293aa319", "scanner": "scanner-primary", "fingerprint": "13c0404f697c3e75", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dfde2541f23e4dfa", "level": "note", "message": {"text": "Unused endpoint: GET /death"}, "properties": {"repobilityId": "ad68bac9b425a47f", "scanner": "scanner-primary", "fingerprint": "dfde2541f23e4dfa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-888ea008581aa5a3", "level": "note", "message": {"text": "Unused endpoint: GET /you-died"}, "properties": {"repobilityId": "8728ee6e2c54c87b", "scanner": "scanner-primary", "fingerprint": "888ea008581aa5a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cbe480fc42a105c4", "level": "note", "message": {"text": "Unused endpoint: GET /death-data"}, "properties": {"repobilityId": "32eadc713d2815ec", "scanner": "scanner-primary", "fingerprint": "cbe480fc42a105c4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e29f4c1ec636e2c7", "level": "note", "message": {"text": "Unused endpoint: POST /resurrection-link"}, "properties": {"repobilityId": "fc7997fb6dad0a5c", "scanner": "scanner-primary", "fingerprint": "e29f4c1ec636e2c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7825addb011bca8b", "level": "note", "message": {"text": "Unused endpoint: GET /cemetery-data"}, "properties": {"repobilityId": "66bbbcc8d7975ff7", "scanner": "scanner-primary", "fingerprint": "7825addb011bca8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-961f73caa9748436", "level": "note", "message": {"text": "Unused endpoint: GET /leaderboard-data"}, "properties": {"repobilityId": "7fe77ff8429095f8", "scanner": "scanner-primary", "fingerprint": "961f73caa9748436", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60f955d85e9eefd4", "level": "note", "message": {"text": "Unused endpoint: POST /stripe/webhook"}, "properties": {"repobilityId": "653736899153944b", "scanner": "scanner-primary", "fingerprint": "60f955d85e9eefd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2082825433e65702", "level": "note", "message": {"text": "Unused endpoint: GET /chat/:row/:col"}, "properties": {"repobilityId": "e25235c394f7e59c", "scanner": "scanner-primary", "fingerprint": "2082825433e65702", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ff32e0301c64f71", "level": "note", "message": {"text": "Unused endpoint: GET /user-attributes"}, "properties": {"repobilityId": "e3af7870b238da57", "scanner": "scanner-primary", "fingerprint": "2ff32e0301c64f71", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f20aa7735411352b", "level": "note", "message": {"text": "Unused endpoint: POST /allocate"}, "properties": {"repobilityId": "44aab6e82b9b4bc2", "scanner": "scanner-primary", "fingerprint": "f20aa7735411352b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44ebff759bcc7c39", "level": "note", "message": {"text": "Unused endpoint: GET /progression"}, "properties": {"repobilityId": "29b978d42517eb59", "scanner": "scanner-primary", "fingerprint": "44ebff759bcc7c39", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc3709142c918d04", "level": "note", "message": {"text": "Unused endpoint: POST /grid/unlock"}, "properties": {"repobilityId": "38ce9f5856a8d8bd", "scanner": "scanner-primary", "fingerprint": "cc3709142c918d04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc78dd5d15a92f7e", "level": "note", "message": {"text": "Unused endpoint: POST /grid/respec"}, "properties": {"repobilityId": "9c4740a41c0e0665", "scanner": "scanner-primary", "fingerprint": "bc78dd5d15a92f7e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b4dc81dcde5c94e", "level": "note", "message": {"text": "Unused endpoint: GET /tick"}, "properties": {"repobilityId": "1858cb1c31f3f649", "scanner": "scanner-primary", "fingerprint": "0b4dc81dcde5c94e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bedb812d1702f60c", "level": "note", "message": {"text": "Unused endpoint: GET /messages/:row/:col"}, "properties": {"repobilityId": "d1179794ec6a88f7", "scanner": "scanner-primary", "fingerprint": "bedb812d1702f60c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8a362d7a509b6225", "level": "note", "message": {"text": "Unused endpoint: GET /room-ecology/:row/:col"}, "properties": {"repobilityId": "6ef20970e7ae628a", "scanner": "scanner-primary", "fingerprint": "8a362d7a509b6225", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c45ee1254295c4d1", "level": "note", "message": {"text": "Unused endpoint: GET /room-state/:row/:col"}, "properties": {"repobilityId": "e75838d5a137fbf9", "scanner": "scanner-primary", "fingerprint": "c45ee1254295c4d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb13e0fbb2ee9c37", "level": "note", "message": {"text": "Unused endpoint: POST /room-presence/:row/:col"}, "properties": {"repobilityId": "c26d187105b735ec", "scanner": "scanner-primary", "fingerprint": "eb13e0fbb2ee9c37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fc8d4143f7bba629", "level": "note", "message": {"text": "Unused endpoint: POST /room-access/:row/:col/pay"}, "properties": {"repobilityId": "6f6caa930ffd9d5b", "scanner": "scanner-primary", "fingerprint": "fc8d4143f7bba629", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dcfb63d60e06e4cc", "level": "note", "message": {"text": "Unused endpoint: POST /chat/:row/:col"}, "properties": {"repobilityId": "b04b3f5c91934318", "scanner": "scanner-primary", "fingerprint": "dcfb63d60e06e4cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55e6a10587118547", "level": "note", "message": {"text": "Unused endpoint: POST /attack/:row/:col"}, "properties": {"repobilityId": "9e374c0fa8aa0cc0", "scanner": "scanner-primary", "fingerprint": "55e6a10587118547", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a43a8ed20fe546fd", "level": "note", "message": {"text": "Unused endpoint: POST /skill/:row/:col"}, "properties": {"repobilityId": "33e3959b008d9f31", "scanner": "scanner-primary", "fingerprint": "a43a8ed20fe546fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5aa492b815c6fc3", "level": "note", "message": {"text": "Unused endpoint: POST /job/:row/:col"}, "properties": {"repobilityId": "2c5cafbb7ec56517", "scanner": "scanner-primary", "fingerprint": "a5aa492b815c6fc3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-48712b2a9c1cb9ca", "level": "note", "message": {"text": "Unused endpoint: GET /ws/:row/:col"}, "properties": {"repobilityId": "4f44c7f78bc49ba3", "scanner": "scanner-primary", "fingerprint": "48712b2a9c1cb9ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}