Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Why-Gee/YgLicenseServer

https://github.com/Why-Gee/YgLicenseServer · scanned 2026-06-16 00:57 UTC (2 months, 1 week ago)

140 raw signals (0 security + 140 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 121 actionable findings from 1 signal source. 19 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
61.9
/100
Security checks
62
0 findings
System graph
62
100.0% cov · 121 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 31 Medium 4 Low 73 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 121 Crowd 0 Layer: Software 10 Hardware 2 Frontend 1 Security 32 Cicd 2 Quality 24 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 61.9/100 with 100.0% coverage. It contains 1007 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 140 findings — concentrated in api (50), security (32), quality (28). Risk profile is high: 0 critical, 31 high, 7 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 108 of 121 actionable findings. 140 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security auth conf 1.00 FastAPI POST `backup_create` without auth dependency — app/routers/admin_ui/backups.py:46
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/backups.py:46 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `backup_delete_one` without auth dependency — app/routers/admin_ui/backups.py:123
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/backups.py:123 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `backup_restore_local` without auth dependency — app/routers/admin_ui/backups.py:75
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/backups.py:75 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `backup_restore_upload` without auth dependency — app/routers/admin_ui/backups.py:99
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/backups.py:99 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `backups_bulk_delete` without auth dependency — app/routers/admin_ui/backups.py:139
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/backups.py:139 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `check` without auth dependency — app/routers/api.py:82
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/api.py:82 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `customer_edit` without auth dependency — app/routers/admin_ui/customers.py:81
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/customers.py:81 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_delete_one` without auth dependency — app/routers/admin_ui/licenses.py:323
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:323 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_disable` without auth dependency — app/routers/admin_ui/licenses.py:291
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:291 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_edit` without auth dependency — app/routers/admin_ui/licenses.py:79
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:79 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_enable` without auth dependency — app/routers/admin_ui/licenses.py:307
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:307 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_issue` without auth dependency — app/routers/admin_ui/licenses.py:25
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:25 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_revoke` without auth dependency — app/routers/admin_ui/licenses.py:276
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:276 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_webhook_convert_to_self` without auth dependency — app/routers/admin_ui/licenses.py:222
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:222 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_webhook_test` without auth dependency — app/routers/admin_ui/licenses.py:249
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:249 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `license_webhook_update` without auth dependency — app/routers/admin_ui/licenses.py:128
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:128 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `licenses_bulk_delete` without auth dependency — app/routers/admin_ui/licenses.py:339
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/licenses.py:339 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `mfa_disable` without auth dependency — app/routers/admin_ui/mfa.py:60
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/mfa.py:60 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `mfa_enroll` without auth dependency — app/routers/admin_ui/mfa.py:32
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/mfa.py:32 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `mfa_regen_recovery` without auth dependency — app/routers/admin_ui/mfa.py:72
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/mfa.py:72 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `mfa_verify_enroll` without auth dependency — app/routers/admin_ui/mfa.py:47
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/mfa.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `preset_create` without auth dependency — app/routers/admin_ui/presets.py:33
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/presets.py:33 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `preset_delete_one` without auth dependency — app/routers/admin_ui/presets.py:87
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/presets.py:87 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `preset_edit` without auth dependency — app/routers/admin_ui/presets.py:61
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/presets.py:61 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `presets_bulk_delete` without auth dependency — app/routers/admin_ui/presets.py:102
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/presets.py:102 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `product_create` without auth dependency — app/routers/admin_ui/products.py:34
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/products.py:34 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `product_delete_one` without auth dependency — app/routers/admin_ui/products.py:122
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/products.py:122 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `product_edit` without auth dependency — app/routers/admin_ui/products.py:61
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/products.py:61 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `products_bulk_delete` without auth dependency — app/routers/admin_ui/products.py:141
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/products.py:141 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `retry_delivery` without auth dependency — app/routers/admin_ui/webhook_deliveries.py:67
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/routers/admin_ui/webhook_deliveries.py:67 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stripe_webhook` without auth dependency — app/stripe_webhook.py:64
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/stripe_webhook.py:64 securityAuth fastapi unauth mutation
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph cicd CI/CD security conf 1.00 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned
docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 4 locations
.github/workflows/release.yml:20, 31, 41 (3 hits)
.github/workflows/test.yml:39
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/release.yml CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in app/static/admin.js:89
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
app/static/admin.js:89 Direct innerhtml assignment
low System graph quality Integrity conf 1.00 17 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `BACKUP_DIR`, `BACKUP_RETENTION_COUNT`, `BACKUP_RETENTION_DAYS`, `BACKUP_S3_ACCESS_KEY`, `BACKUP_S3_BUCKET`, `BACKUP_S3_ENDPOINT`, `BACKUP_S3_PREFIX`, `BACKUP_S3_REGION` + 9 more. Add them (with a placeholder/comment) to .env.example so onboarding …
config drift
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 10 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.12-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:1 containersPinned dependencies
low System graph quality Integrity conf 1.00 4 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: app/main.py:healthz, app/main.py:health This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
4 occurrences
repo-level (4 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 2 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: app/routers/exports.py:gen, app/routers/exports.py:gen, app/routers/exports.py:gen This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
2 occurrences
repo-level (2 hits)
duplicatesduplication
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in app/routers/admin_ui/backups.py:54
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in app/services/backups.py:36
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `list_objects_v2` in app/backup_s3.py:56
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `restore_backup` in tests/test_backups.py:210
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `run_backup` in app/scripts/run_backup.py:4
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: decorate
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/stripe_webhook.py:56
low System graph software Dead code conf 1.00 Possibly dead Python function: deliver_deleted
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/webhooks.py:240
low System graph software Dead code conf 1.00 Possibly dead Python function: deliver_status_change
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/webhooks.py:192
low System graph software Dead code conf 1.00 Possibly dead Python function: deliver_update
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/webhooks.py:215
low System graph software Dead code conf 1.00 13 occurrences Possibly dead Python function: downgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
12 files, 12 locations
alembic/versions/1413d5d1702b_license_key_hash.py:85
alembic/versions/28989ac123c6_processed_stripe_events.py:43
alembic/versions/3f8b2c91d4ae_feature_presets.py:59
alembic/versions/4a247674ec5e_webhook_deliveries.py:70
alembic/versions/570f101254e2_admin_mfa_table.py:39
alembic/versions/5c836611873a_webhook_url_source.py:54
alembic/versions/5d46e445251c_0001_initial_schema.py:113
alembic/versions/62011ea1b324_add_license_webhook_url_webhook_secret.py:33
low System graph software Dead code conf 1.00 Possibly dead Python function: is_safe_for_delivery
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/security.py:198
low System graph software Dead code conf 1.00 Possibly dead Python function: list_customers_with_counts
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/services/customers.py:24
low System graph software Dead code conf 1.00 Possibly dead Python function: list_products
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/services/products.py:225
low System graph software Dead code conf 1.00 Possibly dead Python function: reset_client
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/http_client.py:50
low System graph software Dead code conf 1.00 Possibly dead Python function: set_client
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/http_client.py:43
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`app/routers/admin_ui/auth.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin
`app/routers/admin_ui/dashboard.py` declares `GET /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/backups
`app/routers/admin_ui/backups.py` declares `GET /admin/backups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/backups/download/{name}
`app/routers/admin_ui/backups.py` declares `GET /admin/backups/download/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/customers
`app/routers/admin_ui/customers.py` declares `GET /admin/customers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/customers/lookup
`app/routers/admin_ui/customers.py` declares `GET /admin/customers/lookup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/events
`app/routers/admin_ui/events.py` declares `GET /admin/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/events.csv
`app/routers/admin_ui/events.py` declares `GET /admin/events.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/login
`app/routers/admin_ui/auth.py` declares `GET /admin/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/login/mfa
`app/routers/admin_ui/auth.py` declares `GET /admin/login/mfa` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/mfa
`app/routers/admin_ui/mfa.py` declares `GET /admin/mfa` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/products
`app/routers/admin_ui/products.py` declares `GET /admin/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/products/{slug}
`app/routers/admin_ui/products.py` declares `GET /admin/products/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/products/{slug}/pubkey.pem
`app/routers/admin_ui/products.py` declares `GET /admin/products/{slug}/pubkey.pem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/webhook-deliveries
`app/routers/admin_ui/webhook_deliveries.py` declares `GET /admin/webhook-deliveries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consu…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /customers.csv
`app/routers/exports.py` declares `GET /customers.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /products/{slug}/events.csv
`app/routers/exports.py` declares `GET /products/{slug}/events.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /products/{slug}/licenses.csv
`app/routers/exports.py` declares `GET /products/{slug}/licenses.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /v1/admin/customers
`app/routers/api.py` declares `GET /v1/admin/customers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /v1/admin/products
`app/routers/api.py` declares `GET /v1/admin/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /v1/admin/products/{slug}
`app/routers/api.py` declares `GET /v1/admin/products/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /v1/admin/products/{slug}/licenses
`app/routers/api.py` declares `GET /v1/admin/products/{slug}/licenses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /v1/products/{slug}/pubkey
`app/routers/api.py` declares `GET /v1/products/{slug}/pubkey` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/api/licenses/{license_id}/webhook
`app/routers/admin_ui/licenses.py` declares `POST /admin/api/licenses/{license_id}/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/backups/create
`app/routers/admin_ui/backups.py` declares `POST /admin/backups/create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/backups/delete
`app/routers/admin_ui/backups.py` declares `POST /admin/backups/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/backups/restore-upload
`app/routers/admin_ui/backups.py` declares `POST /admin/backups/restore-upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/backups/{name}/delete
`app/routers/admin_ui/backups.py` declares `POST /admin/backups/{name}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/backups/{name}/restore
`app/routers/admin_ui/backups.py` declares `POST /admin/backups/{name}/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/customers/{cid}/edit
`app/routers/admin_ui/customers.py` declares `POST /admin/customers/{cid}/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/licenses/{lid}/edit
`app/routers/admin_ui/licenses.py` declares `POST /admin/licenses/{lid}/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/licenses/{lid}/webhook
`app/routers/admin_ui/licenses.py` declares `POST /admin/licenses/{lid}/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/login
`app/routers/admin_ui/auth.py` declares `POST /admin/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/login/mfa
`app/routers/admin_ui/auth.py` declares `POST /admin/login/mfa` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/logout
`app/routers/admin_ui/auth.py` declares `POST /admin/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/mfa/disable
`app/routers/admin_ui/mfa.py` declares `POST /admin/mfa/disable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/mfa/enroll
`app/routers/admin_ui/mfa.py` declares `POST /admin/mfa/enroll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/mfa/regen-recovery
`app/routers/admin_ui/mfa.py` declares `POST /admin/mfa/regen-recovery` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/mfa/verify-enroll
`app/routers/admin_ui/mfa.py` declares `POST /admin/mfa/verify-enroll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/products
`app/routers/admin_ui/products.py` declares `POST /admin/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/products/delete
`app/routers/admin_ui/products.py` declares `POST /admin/products/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/products/{slug}/delete
`app/routers/admin_ui/products.py` declares `POST /admin/products/{slug}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/products/{slug}/edit
`app/routers/admin_ui/products.py` declares `POST /admin/products/{slug}/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/products/{slug}/licenses
`app/routers/admin_ui/licenses.py` declares `POST /admin/products/{slug}/licenses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/webhook-deliveries/{delivery_id}/retry
`app/routers/admin_ui/webhook_deliveries.py` declares `POST /admin/webhook-deliveries/{delivery_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /v1/admin/licenses/{lid}/revoke
`app/routers/api.py` declares `POST /v1/admin/licenses/{lid}/revoke` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /v1/admin/products
`app/routers/api.py` declares `POST /v1/admin/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /v1/admin/products/{slug}/licenses
`app/routers/api.py` declares `POST /v1/admin/products/{slug}/licenses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /v1/check
`app/routers/api.py` declares `POST /v1/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /v1/products/{slug}/stripe-webhook
`app/stripe_webhook.py` declares `POST /v1/products/{slug}/stripe-webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/531b497a-356b-475f-9ac4-bf50b6db0a38/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/531b497a-356b-475f-9ac4-bf50b6db0a38/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.