{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d49990b05e20d4b7", "name": "Possibly dead Python function: pull_client_health", "shortDescription": {"text": "Possibly dead Python function: pull_client_health"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f9f36bed31fb32b", "name": "Possibly dead Python function: compute_all", "shortDescription": {"text": "Possibly dead Python function: compute_all"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a723a5ff3d77abbc", "name": "Possibly dead Python function: header", "shortDescription": {"text": "Possibly dead Python function: header"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d65f777e2e278a4", "name": "Possibly dead Python function: footer", "shortDescription": {"text": "Possibly dead Python function: footer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ff4e5b5b6854148", "name": "Insecure pattern 'debug_true' in app.py:397", "shortDescription": {"text": "Insecure pattern 'debug_true' in app.py:397"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a52fd4524c1e15fb", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/hud.js:24", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/hud.js:24"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85e3d715cefad574", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/edith.js:657", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/edith.js:657"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3080b5ba70cbe9a", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/dashboard.js:123", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/dashboard.js:123"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f15a09d0960898b", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/chat.js:30", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/chat.js:30"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d4c664dfb52fcf4", "name": "Very large file: sales_analytics_pull.py (1468 lines)", "shortDescription": {"text": "Very large file: sales_analytics_pull.py (1468 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ba451ad14e5bfc6", "name": "Very large file: dashboard/static/js/edith.js (1889 lines)", "shortDescription": {"text": "Very large file: dashboard/static/js/edith.js (1889 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8cae2b4381e8492", "name": "Very large file: dashboard/static/js/dashboard.js (3984 lines)", "shortDescription": {"text": "Very large file: dashboard/static/js/dashboard.js (3984 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-411a24df974a81b6", "name": "Commented-code block (5 lines) in config.py:58", "shortDescription": {"text": "Commented-code block (5 lines) in config.py:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8132ed1ddf30852f", "name": "Commented-code block (5 lines) in stripe_pull.py:102", "shortDescription": {"text": "Commented-code block (5 lines) in stripe_pull.py:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e5a91b5e1eeaa0d4", "name": "Commented-code block (5 lines) in sales_analytics_pull.py:1188", "shortDescription": {"text": "Commented-code block (5 lines) in sales_analytics_pull.py:1188"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66914c187091af18", "name": "Commented-code block (5 lines) in test_snapshot.py:470", "shortDescription": {"text": "Commented-code block (5 lines) in test_snapshot.py:470"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1c2ab5711d13cbe9", "name": "Commented-code block (7 lines) in financial_position.py:83", "shortDescription": {"text": "Commented-code block (7 lines) in financial_position.py:83"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4cf87720df4a789a", "name": "Legacy-named symbol `test_health_only_legacy` in tests/test_active_clients.py:89", "shortDescription": {"text": "Legacy-named symbol `test_health_only_legacy` in tests/test_active_clients.py:89"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23d9a49680136a79", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_hud.py:38", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_hud.py:38"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-529bd0d56bbe75fc", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_hud_v2.py:15", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_hud_v2.py:15"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2205f207c1c87f23", "name": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/export.js:33", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/export.js:33"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9547757f4b8fc6dd", "name": "Commented-code block (5 lines) in dashboard/static/js/edith.js:1334", "shortDescription": {"text": "Commented-code block (5 lines) in dashboard/static/js/edith.js:1334"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f7c0541506d2d88", "name": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/edith.js:1755", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/edith.js:1755"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf6800e7784a8957", "name": "Legacy-named symbol `isLegacy` in dashboard/static/js/dashboard.js:2116", "shortDescription": {"text": "Legacy-named symbol `isLegacy` in dashboard/static/js/dashboard.js:2116"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d007a20994cdc7e1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/dashboard.js:3196", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/dashboard.js:3196"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nfinancial_position.py:json_safe, hiring_model.py:json_safe\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73e28535c1568837", "name": "Flask mutation route `refresh_snapshot` without `@login_required` \u2014 app.py:163", "shortDescription": {"text": "Flask mutation route `refresh_snapshot` without `@login_required` \u2014 app.py:163"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3057a62b0a2f4398", "name": "Flask mutation route `login_submit` without `@login_required` \u2014 dashboard/routes.py:65", "shortDescription": {"text": "Flask mutation route `login_submit` without `@login_required` \u2014 dashboard/routes.py:65"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-668fa57a74091d05", "name": "Flask mutation route `api_refresh` without `@login_required` \u2014 dashboard/routes.py:93", "shortDescription": {"text": "Flask mutation route `api_refresh` without `@login_required` \u2014 dashboard/routes.py:93"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-81001cd0c9226012", "name": "Flask mutation route `api_tts` without `@login_required` \u2014 dashboard/routes.py:176", "shortDescription": {"text": "Flask mutation route `api_tts` without `@login_required` \u2014 dashboard/routes.py:176"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba49986fe91fe4ce", "name": "Flask mutation route `api_brief` without `@login_required` \u2014 dashboard/routes.py:210", "shortDescription": {"text": "Flask mutation route `api_brief` without `@login_required` \u2014 dashboard/routes.py:210"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1bc7c00d1852b4f", "name": "Flask mutation route `api_voice_config` without `@login_required` \u2014 dashboard/routes.py:250", "shortDescription": {"text": "Flask mutation route `api_voice_config` without `@login_required` \u2014 dashboard/routes.py:250"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b5fed802b045a2ce", "name": "Flask mutation route `api_entrance_audio` without `@login_required` \u2014 dashboard/routes.py:294", "shortDescription": {"text": "Flask mutation route `api_entrance_audio` without `@login_required` \u2014 dashboard/routes.py:294"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c1ae2cb8c450206", "name": "Flask mutation route `api_hiring_scenario` without `@login_required` \u2014 dashboard/routes.py:324", "shortDescription": {"text": "Flask mutation route `api_hiring_scenario` without `@login_required` \u2014 dashboard/routes.py:324"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4160af380931ff6b", "name": "Flask mutation route `api_chat` without `@login_required` \u2014 dashboard/routes.py:435", "shortDescription": {"text": "Flask mutation route `api_chat` without `@login_required` \u2014 dashboard/routes.py:435"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b0ec9bcdf9055842", "name": "Dangling fetch: GET /dashboard/api/voice-status (dashboard/static/js/edith.js:619)", "shortDescription": {"text": "Dangling fetch: GET /dashboard/api/voice-status (dashboard/static/js/edith.js:619)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:619` calls `GET /dashboard/api/voice-status` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/voice-status`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c59aca0f7094063c", "name": "Dangling fetch: POST /dashboard/api/brief (dashboard/static/js/edith.js:998)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/brief (dashboard/static/js/edith.js:998)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:998` calls `POST /dashboard/api/brief` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/brief`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c3b70a8946924e3", "name": "Dangling fetch: GET /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1015)", "shortDescription": {"text": "Dangling fetch: GET /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1015)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1015` calls `GET /dashboard/api/entrance-audio` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/entrance-audio`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3289a3087d7cd53e", "name": "Dangling fetch: GET /dashboard/api/greeting (dashboard/static/js/edith.js:1121)", "shortDescription": {"text": "Dangling fetch: GET /dashboard/api/greeting (dashboard/static/js/edith.js:1121)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1121` calls `GET /dashboard/api/greeting` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/greeting`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afea869506d30684", "name": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1755)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1755)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1755` calls `POST /dashboard/api/voice-config` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/voice-config`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2a3275d83eee62cf", "name": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1802)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1802)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1802` calls `POST /dashboard/api/voice-config` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/voice-config`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df633e1ffda15054", "name": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1807)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1807)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1807` calls `POST /dashboard/api/voice-config` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/voice-config`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4cb9a4e56eb1b685", "name": "Dangling fetch: POST /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1815)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1815)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1815` calls `POST /dashboard/api/entrance-audio` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/entrance-audio`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5468559394ab5eee", "name": "Dangling fetch: DELETE /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1821)", "shortDescription": {"text": "Dangling fetch: DELETE /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1821)"}, "fullDescription": {"text": "`dashboard/static/js/edith.js:1821` calls `DELETE /dashboard/api/entrance-audio` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/entrance-audio`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3633c2906ef4373", "name": "Dangling fetch: GET /dashboard/api/snapshot (dashboard/static/js/dashboard.js:431)", "shortDescription": {"text": "Dangling fetch: GET /dashboard/api/snapshot (dashboard/static/js/dashboard.js:431)"}, "fullDescription": {"text": "`dashboard/static/js/dashboard.js:431` calls `GET /dashboard/api/snapshot` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/snapshot`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04218a0669062841", "name": "Dangling fetch: GET /dashboard/api/history?n=14 (dashboard/static/js/dashboard.js:442)", "shortDescription": {"text": "Dangling fetch: GET /dashboard/api/history?n=14 (dashboard/static/js/dashboard.js:442)"}, "fullDescription": {"text": "`dashboard/static/js/dashboard.js:442` calls `GET /dashboard/api/history?n=14` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/history`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e71a806be33bbf5", "name": "Dangling fetch: POST /dashboard/api/hiring-scenario (dashboard/static/js/dashboard.js:3196)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/hiring-scenario (dashboard/static/js/dashboard.js:3196)"}, "fullDescription": {"text": "`dashboard/static/js/dashboard.js:3196` calls `POST /dashboard/api/hiring-scenario` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/hiring-scenario`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d35434482ccd3f67", "name": "Dangling fetch: POST /dashboard/api/refresh (dashboard/static/js/dashboard.js:3865)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/refresh (dashboard/static/js/dashboard.js:3865)"}, "fullDescription": {"text": "`dashboard/static/js/dashboard.js:3865` calls `POST /dashboard/api/refresh` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/refresh`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d64a9222e2c3c6f5", "name": "Dangling fetch: GET /dashboard/api/briefing-pdf (dashboard/static/js/dashboard.js:3884)", "shortDescription": {"text": "Dangling fetch: GET /dashboard/api/briefing-pdf (dashboard/static/js/dashboard.js:3884)"}, "fullDescription": {"text": "`dashboard/static/js/dashboard.js:3884` calls `GET /dashboard/api/briefing-pdf` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/briefing-pdf`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a80fb4c2e85172e6", "name": "Dangling fetch: POST /dashboard/api/chat (dashboard/static/js/chat.js:76)", "shortDescription": {"text": "Dangling fetch: POST /dashboard/api/chat (dashboard/static/js/chat.js:76)"}, "fullDescription": {"text": "`dashboard/static/js/chat.js:76` calls `POST /dashboard/api/chat` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/dashboard/api/chat`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d2edf1a25ffddf34", "name": "Unused endpoint: ANY /cfo/snapshot", "shortDescription": {"text": "Unused endpoint: ANY /cfo/snapshot"}, "fullDescription": {"text": "`app.py` declares `ANY /cfo/snapshot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-478cc2ac6be24243", "name": "Unused endpoint: ANY /cfo/refresh", "shortDescription": {"text": "Unused endpoint: ANY /cfo/refresh"}, "fullDescription": {"text": "`app.py` declares `ANY /cfo/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c26820a20e2f36f", "name": "Unused endpoint: ANY /xero/connect", "shortDescription": {"text": "Unused endpoint: ANY /xero/connect"}, "fullDescription": {"text": "`app.py` declares `ANY /xero/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-506683b001b11e41", "name": "Unused endpoint: ANY /xero/callback", "shortDescription": {"text": "Unused endpoint: ANY /xero/callback"}, "fullDescription": {"text": "`app.py` declares `ANY /xero/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f52b377f988dfc6", "name": "Unused endpoint: ANY /debug/stripe-ping", "shortDescription": {"text": "Unused endpoint: ANY /debug/stripe-ping"}, "fullDescription": {"text": "`app.py` declares `ANY /debug/stripe-ping` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d9640f5e24c40c3", "name": "Unused endpoint: ANY /debug/sources", "shortDescription": {"text": "Unused endpoint: ANY /debug/sources"}, "fullDescription": {"text": "`app.py` declares `ANY /debug/sources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b55e87e914214a30", "name": "Unused endpoint: ANY /debug/xero-raw", "shortDescription": {"text": "Unused endpoint: ANY /debug/xero-raw"}, "fullDescription": {"text": "`app.py` declares `ANY /debug/xero-raw` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c7ad61ba1b23915", "name": "Unused endpoint: ANY /login", "shortDescription": {"text": "Unused endpoint: ANY /login"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18aeb716e181e844", "name": "Unused endpoint: ANY /api/snapshot", "shortDescription": {"text": "Unused endpoint: ANY /api/snapshot"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/snapshot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7748279e1ffa9ad", "name": "Unused endpoint: ANY /api/refresh", "shortDescription": {"text": "Unused endpoint: ANY /api/refresh"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87536038ad543230", "name": "Unused endpoint: ANY /api/history", "shortDescription": {"text": "Unused endpoint: ANY /api/history"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28280ed1932b9a2f", "name": "Unused endpoint: ANY /api/voice-status", "shortDescription": {"text": "Unused endpoint: ANY /api/voice-status"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/voice-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-823f4d973f8176d1", "name": "Unused endpoint: ANY /api/tts", "shortDescription": {"text": "Unused endpoint: ANY /api/tts"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/tts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38856b65b03ecb1a", "name": "Unused endpoint: ANY /api/brief", "shortDescription": {"text": "Unused endpoint: ANY /api/brief"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/brief` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71c154a169506cf7", "name": "Unused endpoint: ANY /api/greeting", "shortDescription": {"text": "Unused endpoint: ANY /api/greeting"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/greeting` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee8536c87a2c831a", "name": "Unused endpoint: ANY /api/voice-config", "shortDescription": {"text": "Unused endpoint: ANY /api/voice-config"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/voice-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cead6881e852cf81", "name": "Unused endpoint: ANY /audio/entrance", "shortDescription": {"text": "Unused endpoint: ANY /audio/entrance"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /audio/entrance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19d146f5c28ee3eb", "name": "Unused endpoint: ANY /api/entrance-audio", "shortDescription": {"text": "Unused endpoint: ANY /api/entrance-audio"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/entrance-audio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1179d84e208891a", "name": "Unused endpoint: ANY /api/hiring-scenario", "shortDescription": {"text": "Unused endpoint: ANY /api/hiring-scenario"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/hiring-scenario` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a56a74bc24f39ac5", "name": "Unused endpoint: ANY /api/sales-summary", "shortDescription": {"text": "Unused endpoint: ANY /api/sales-summary"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/sales-summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01985aa4b2715cba", "name": "Unused endpoint: ANY /api/briefing-pdf", "shortDescription": {"text": "Unused endpoint: ANY /api/briefing-pdf"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/briefing-pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd2e5f273f9750ee", "name": "Unused endpoint: ANY /api/chat", "shortDescription": {"text": "Unused endpoint: ANY /api/chat"}, "fullDescription": {"text": "`dashboard/routes.py` declares `ANY /api/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18653"}, "properties": {"repository": "rydel-beep/servedcfoagent", "repoUrl": "https://github.com/rydel-beep/servedcfoagent", "branch": "main"}, "results": [{"ruleId": "scanner-d49990b05e20d4b7", "level": "note", "message": {"text": "Possibly dead Python function: pull_client_health"}, "properties": {"repobilityId": "b1ec29ac95ca3b34", "scanner": "scanner-primary", "fingerprint": "d49990b05e20d4b7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finance_sheets_pull.py:318"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f9f36bed31fb32b", "level": "note", "message": {"text": "Possibly dead Python function: compute_all"}, "properties": {"repobilityId": "4a0764d99839e786", "scanner": "scanner-primary", "fingerprint": "6f9f36bed31fb32b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hormozi_metrics.py:470"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a723a5ff3d77abbc", "level": "note", "message": {"text": "Possibly dead Python function: header"}, "properties": {"repobilityId": "0d3c97e1cc68c808", "scanner": "scanner-primary", "fingerprint": "a723a5ff3d77abbc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/briefing_pdf.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d65f777e2e278a4", "level": "note", "message": {"text": "Possibly dead Python function: footer"}, "properties": {"repobilityId": "9f0be3db8aae782f", "scanner": "scanner-primary", "fingerprint": "0d65f777e2e278a4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/briefing_pdf.py:108"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-2ff4e5b5b6854148", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in app.py:397"}, "properties": {"repobilityId": "820a29d1c28c9121", "scanner": "scanner-primary", "fingerprint": "2ff4e5b5b6854148", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 397}}}]}, {"ruleId": "scanner-a52fd4524c1e15fb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/hud.js:24"}, "properties": {"repobilityId": "cbc27eeef4d6f352", "scanner": "scanner-primary", "fingerprint": "a52fd4524c1e15fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/static/js/hud.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-85e3d715cefad574", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/edith.js:657"}, "properties": {"repobilityId": "9f7771551a60ada3", "scanner": "scanner-primary", "fingerprint": "85e3d715cefad574", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/static/js/edith.js"}, "region": {"startLine": 657}}}]}, {"ruleId": "scanner-a3080b5ba70cbe9a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/dashboard.js:123"}, "properties": {"repobilityId": "70923f0ecfd5e551", "scanner": "scanner-primary", "fingerprint": "a3080b5ba70cbe9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/static/js/dashboard.js"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-3f15a09d0960898b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/static/js/chat.js:30"}, "properties": {"repobilityId": "6537a2f78fa2194f", "scanner": "scanner-primary", "fingerprint": "3f15a09d0960898b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/static/js/chat.js"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-1d4c664dfb52fcf4", "level": "note", "message": {"text": "Very large file: sales_analytics_pull.py (1468 lines)"}, "properties": {"repobilityId": "2040784c9eee6788", "scanner": "scanner-primary", "fingerprint": "1d4c664dfb52fcf4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5ba451ad14e5bfc6", "level": "note", "message": {"text": "Very large file: dashboard/static/js/edith.js (1889 lines)"}, "properties": {"repobilityId": "15e03e70bf65a0fe", "scanner": "scanner-primary", "fingerprint": "5ba451ad14e5bfc6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b8cae2b4381e8492", "level": "note", "message": {"text": "Very large file: dashboard/static/js/dashboard.js (3984 lines)"}, "properties": {"repobilityId": "857a05d6e7e72af9", "scanner": "scanner-primary", "fingerprint": "b8cae2b4381e8492", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "10253751e1ea1de3", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "f30b211e1aa73617", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "729dc7ecea2713c0", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "b984259c05bcac5b", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "3cd52b260f2407a4", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "fcfe294c9e30e431", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "214d0f33ec0388dd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-411a24df974a81b6", "level": "none", "message": {"text": "Commented-code block (5 lines) in config.py:58"}, "properties": {"repobilityId": "9ccdb83260159315", "scanner": "scanner-primary", "fingerprint": "411a24df974a81b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8132ed1ddf30852f", "level": "none", "message": {"text": "Commented-code block (5 lines) in stripe_pull.py:102"}, "properties": {"repobilityId": "c2717cb439309f16", "scanner": "scanner-primary", "fingerprint": "8132ed1ddf30852f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e5a91b5e1eeaa0d4", "level": "none", "message": {"text": "Commented-code block (5 lines) in sales_analytics_pull.py:1188"}, "properties": {"repobilityId": "e4aeb0e9e1ccb5ad", "scanner": "scanner-primary", "fingerprint": "e5a91b5e1eeaa0d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66914c187091af18", "level": "none", "message": {"text": "Commented-code block (5 lines) in test_snapshot.py:470"}, "properties": {"repobilityId": "a1557a3ece94be79", "scanner": "scanner-primary", "fingerprint": "66914c187091af18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1c2ab5711d13cbe9", "level": "none", "message": {"text": "Commented-code block (7 lines) in financial_position.py:83"}, "properties": {"repobilityId": "4bd1c1f214a18478", "scanner": "scanner-primary", "fingerprint": "1c2ab5711d13cbe9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4cf87720df4a789a", "level": "note", "message": {"text": "Legacy-named symbol `test_health_only_legacy` in tests/test_active_clients.py:89"}, "properties": {"repobilityId": "517ba3f74250a77c", "scanner": "scanner-primary", "fingerprint": "4cf87720df4a789a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-23d9a49680136a79", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_hud.py:38"}, "properties": {"repobilityId": "a5f4fdb4c61e96de", "scanner": "scanner-primary", "fingerprint": "23d9a49680136a79", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-529bd0d56bbe75fc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_hud_v2.py:15"}, "properties": {"repobilityId": "6292aca4dbff00ec", "scanner": "scanner-primary", "fingerprint": "529bd0d56bbe75fc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2205f207c1c87f23", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/export.js:33"}, "properties": {"repobilityId": "80a4284d72dd97e5", "scanner": "scanner-primary", "fingerprint": "2205f207c1c87f23", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9547757f4b8fc6dd", "level": "none", "message": {"text": "Commented-code block (5 lines) in dashboard/static/js/edith.js:1334"}, "properties": {"repobilityId": "380ad3d241f27d4a", "scanner": "scanner-primary", "fingerprint": "9547757f4b8fc6dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f7c0541506d2d88", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/edith.js:1755"}, "properties": {"repobilityId": "48900056da003205", "scanner": "scanner-primary", "fingerprint": "2f7c0541506d2d88", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cf6800e7784a8957", "level": "note", "message": {"text": "Legacy-named symbol `isLegacy` in dashboard/static/js/dashboard.js:2116"}, "properties": {"repobilityId": "094d4f88b474dc08", "scanner": "scanner-primary", "fingerprint": "cf6800e7784a8957", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d007a20994cdc7e1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 dashboard/static/js/dashboard.js:3196"}, "properties": {"repobilityId": "4ec03d53909ecde6", "scanner": "scanner-primary", "fingerprint": "d007a20994cdc7e1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1275c990b4162deb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "019a68c5c24b9688", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-73e28535c1568837", "level": "error", "message": {"text": "Flask mutation route `refresh_snapshot` without `@login_required` \u2014 app.py:163"}, "properties": {"repobilityId": "b38d9077e9166cc4", "scanner": "scanner-primary", "fingerprint": "73e28535c1568837", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-3057a62b0a2f4398", "level": "error", "message": {"text": "Flask mutation route `login_submit` without `@login_required` \u2014 dashboard/routes.py:65"}, "properties": {"repobilityId": "41dcd293b82901d6", "scanner": "scanner-primary", "fingerprint": "3057a62b0a2f4398", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-668fa57a74091d05", "level": "error", "message": {"text": "Flask mutation route `api_refresh` without `@login_required` \u2014 dashboard/routes.py:93"}, "properties": {"repobilityId": "4674e48a84b080b8", "scanner": "scanner-primary", "fingerprint": "668fa57a74091d05", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-81001cd0c9226012", "level": "error", "message": {"text": "Flask mutation route `api_tts` without `@login_required` \u2014 dashboard/routes.py:176"}, "properties": {"repobilityId": "270421141397e97f", "scanner": "scanner-primary", "fingerprint": "81001cd0c9226012", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-ba49986fe91fe4ce", "level": "error", "message": {"text": "Flask mutation route `api_brief` without `@login_required` \u2014 dashboard/routes.py:210"}, "properties": {"repobilityId": "4a31d5627729413f", "scanner": "scanner-primary", "fingerprint": "ba49986fe91fe4ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-f1bc7c00d1852b4f", "level": "error", "message": {"text": "Flask mutation route `api_voice_config` without `@login_required` \u2014 dashboard/routes.py:250"}, "properties": {"repobilityId": "424bcbcc84c1a2bd", "scanner": "scanner-primary", "fingerprint": "f1bc7c00d1852b4f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-b5fed802b045a2ce", "level": "error", "message": {"text": "Flask mutation route `api_entrance_audio` without `@login_required` \u2014 dashboard/routes.py:294"}, "properties": {"repobilityId": "72a8b35dd1fddac6", "scanner": "scanner-primary", "fingerprint": "b5fed802b045a2ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 294}}}]}, {"ruleId": "scanner-9c1ae2cb8c450206", "level": "error", "message": {"text": "Flask mutation route `api_hiring_scenario` without `@login_required` \u2014 dashboard/routes.py:324"}, "properties": {"repobilityId": "1e413865a247eb69", "scanner": "scanner-primary", "fingerprint": "9c1ae2cb8c450206", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 324}}}]}, {"ruleId": "scanner-4160af380931ff6b", "level": "error", "message": {"text": "Flask mutation route `api_chat` without `@login_required` \u2014 dashboard/routes.py:435"}, "properties": {"repobilityId": "57e02fd76303b2b0", "scanner": "scanner-primary", "fingerprint": "4160af380931ff6b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes.py"}, "region": {"startLine": 435}}}]}, {"ruleId": "scanner-b0ec9bcdf9055842", "level": "error", "message": {"text": "Dangling fetch: GET /dashboard/api/voice-status (dashboard/static/js/edith.js:619)"}, "properties": {"repobilityId": "9e2528f0ebcbc88f", "scanner": "scanner-primary", "fingerprint": "b0ec9bcdf9055842", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c59aca0f7094063c", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/brief (dashboard/static/js/edith.js:998)"}, "properties": {"repobilityId": "5f15189ada2bdc7f", "scanner": "scanner-primary", "fingerprint": "c59aca0f7094063c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1c3b70a8946924e3", "level": "error", "message": {"text": "Dangling fetch: GET /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1015)"}, "properties": {"repobilityId": "6ce9c203d93c88b0", "scanner": "scanner-primary", "fingerprint": "1c3b70a8946924e3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3289a3087d7cd53e", "level": "error", "message": {"text": "Dangling fetch: GET /dashboard/api/greeting (dashboard/static/js/edith.js:1121)"}, "properties": {"repobilityId": "ebb11820c74f2042", "scanner": "scanner-primary", "fingerprint": "3289a3087d7cd53e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-afea869506d30684", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1755)"}, "properties": {"repobilityId": "15a48061f422d95d", "scanner": "scanner-primary", "fingerprint": "afea869506d30684", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-2a3275d83eee62cf", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1802)"}, "properties": {"repobilityId": "07614e2ba9ed0d0b", "scanner": "scanner-primary", "fingerprint": "2a3275d83eee62cf", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-df633e1ffda15054", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/voice-config (dashboard/static/js/edith.js:1807)"}, "properties": {"repobilityId": "d6af610e0cfcb04c", "scanner": "scanner-primary", "fingerprint": "df633e1ffda15054", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4cb9a4e56eb1b685", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1815)"}, "properties": {"repobilityId": "d31f74614ab840c6", "scanner": "scanner-primary", "fingerprint": "4cb9a4e56eb1b685", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5468559394ab5eee", "level": "error", "message": {"text": "Dangling fetch: DELETE /dashboard/api/entrance-audio (dashboard/static/js/edith.js:1821)"}, "properties": {"repobilityId": "53489173903e5e1b", "scanner": "scanner-primary", "fingerprint": "5468559394ab5eee", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c3633c2906ef4373", "level": "error", "message": {"text": "Dangling fetch: GET /dashboard/api/snapshot (dashboard/static/js/dashboard.js:431)"}, "properties": {"repobilityId": "14b50aef6fed4ad3", "scanner": "scanner-primary", "fingerprint": "c3633c2906ef4373", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-04218a0669062841", "level": "error", "message": {"text": "Dangling fetch: GET /dashboard/api/history?n=14 (dashboard/static/js/dashboard.js:442)"}, "properties": {"repobilityId": "bbaec03cc0d7fb1f", "scanner": "scanner-primary", "fingerprint": "04218a0669062841", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5e71a806be33bbf5", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/hiring-scenario (dashboard/static/js/dashboard.js:3196)"}, "properties": {"repobilityId": "fec1395f9ff620ac", "scanner": "scanner-primary", "fingerprint": "5e71a806be33bbf5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d35434482ccd3f67", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/refresh (dashboard/static/js/dashboard.js:3865)"}, "properties": {"repobilityId": "cd73c507abfbb9f3", "scanner": "scanner-primary", "fingerprint": "d35434482ccd3f67", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d64a9222e2c3c6f5", "level": "error", "message": {"text": "Dangling fetch: GET /dashboard/api/briefing-pdf (dashboard/static/js/dashboard.js:3884)"}, "properties": {"repobilityId": "25f1b0f167a55050", "scanner": "scanner-primary", "fingerprint": "d64a9222e2c3c6f5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a80fb4c2e85172e6", "level": "error", "message": {"text": "Dangling fetch: POST /dashboard/api/chat (dashboard/static/js/chat.js:76)"}, "properties": {"repobilityId": "7cdaf4be7d144cce", "scanner": "scanner-primary", "fingerprint": "a80fb4c2e85172e6", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d2edf1a25ffddf34", "level": "note", "message": {"text": "Unused endpoint: ANY /cfo/snapshot"}, "properties": {"repobilityId": "8336051120237db5", "scanner": "scanner-primary", "fingerprint": "d2edf1a25ffddf34", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-478cc2ac6be24243", "level": "note", "message": {"text": "Unused endpoint: ANY /cfo/refresh"}, "properties": {"repobilityId": "f39994213a8f778e", "scanner": "scanner-primary", "fingerprint": "478cc2ac6be24243", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c26820a20e2f36f", "level": "note", "message": {"text": "Unused endpoint: ANY /xero/connect"}, "properties": {"repobilityId": "3d410ca8ede80147", "scanner": "scanner-primary", "fingerprint": "8c26820a20e2f36f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-506683b001b11e41", "level": "note", "message": {"text": "Unused endpoint: ANY /xero/callback"}, "properties": {"repobilityId": "790b2ff366515098", "scanner": "scanner-primary", "fingerprint": "506683b001b11e41", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f52b377f988dfc6", "level": "note", "message": {"text": "Unused endpoint: ANY /debug/stripe-ping"}, "properties": {"repobilityId": "4032ce8bb3c0a6c6", "scanner": "scanner-primary", "fingerprint": "8f52b377f988dfc6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d9640f5e24c40c3", "level": "note", "message": {"text": "Unused endpoint: ANY /debug/sources"}, "properties": {"repobilityId": "9d47cb882b1b3f80", "scanner": "scanner-primary", "fingerprint": "6d9640f5e24c40c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b55e87e914214a30", "level": "note", "message": {"text": "Unused endpoint: ANY /debug/xero-raw"}, "properties": {"repobilityId": "b083e66c04114296", "scanner": "scanner-primary", "fingerprint": "b55e87e914214a30", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "deee812f456f23a1", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c7ad61ba1b23915", "level": "note", "message": {"text": "Unused endpoint: ANY /login"}, "properties": {"repobilityId": "6e9757228dc1c29d", "scanner": "scanner-primary", "fingerprint": "4c7ad61ba1b23915", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18aeb716e181e844", "level": "note", "message": {"text": "Unused endpoint: ANY /api/snapshot"}, "properties": {"repobilityId": "f6129ae4d92a609d", "scanner": "scanner-primary", "fingerprint": "18aeb716e181e844", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7748279e1ffa9ad", "level": "note", "message": {"text": "Unused endpoint: ANY /api/refresh"}, "properties": {"repobilityId": "cccce6bacb90b03d", "scanner": "scanner-primary", "fingerprint": "d7748279e1ffa9ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87536038ad543230", "level": "note", "message": {"text": "Unused endpoint: ANY /api/history"}, "properties": {"repobilityId": "f7c58f4589e392cc", "scanner": "scanner-primary", "fingerprint": "87536038ad543230", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-28280ed1932b9a2f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/voice-status"}, "properties": {"repobilityId": "a73b5489886a9e38", "scanner": "scanner-primary", "fingerprint": "28280ed1932b9a2f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-823f4d973f8176d1", "level": "note", "message": {"text": "Unused endpoint: ANY /api/tts"}, "properties": {"repobilityId": "bc07dcafe2740201", "scanner": "scanner-primary", "fingerprint": "823f4d973f8176d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-38856b65b03ecb1a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/brief"}, "properties": {"repobilityId": "0c9510db701f0bcd", "scanner": "scanner-primary", "fingerprint": "38856b65b03ecb1a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71c154a169506cf7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/greeting"}, "properties": {"repobilityId": "c0731f211d5ef590", "scanner": "scanner-primary", "fingerprint": "71c154a169506cf7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee8536c87a2c831a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/voice-config"}, "properties": {"repobilityId": "ecb0eada8fcf22c9", "scanner": "scanner-primary", "fingerprint": "ee8536c87a2c831a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cead6881e852cf81", "level": "note", "message": {"text": "Unused endpoint: ANY /audio/entrance"}, "properties": {"repobilityId": "9429b64b38ebbf6d", "scanner": "scanner-primary", "fingerprint": "cead6881e852cf81", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-19d146f5c28ee3eb", "level": "note", "message": {"text": "Unused endpoint: ANY /api/entrance-audio"}, "properties": {"repobilityId": "e5ac47b8a481c366", "scanner": "scanner-primary", "fingerprint": "19d146f5c28ee3eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1179d84e208891a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/hiring-scenario"}, "properties": {"repobilityId": "9f4939bb6565577c", "scanner": "scanner-primary", "fingerprint": "c1179d84e208891a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a56a74bc24f39ac5", "level": "note", "message": {"text": "Unused endpoint: ANY /api/sales-summary"}, "properties": {"repobilityId": "64256d65ac31d8bb", "scanner": "scanner-primary", "fingerprint": "a56a74bc24f39ac5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01985aa4b2715cba", "level": "note", "message": {"text": "Unused endpoint: ANY /api/briefing-pdf"}, "properties": {"repobilityId": "cfa7526780a9b829", "scanner": "scanner-primary", "fingerprint": "01985aa4b2715cba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd2e5f273f9750ee", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat"}, "properties": {"repobilityId": "1d501053b39750ce", "scanner": "scanner-primary", "fingerprint": "cd2e5f273f9750ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}