Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

virstai/ComfyRefinery

https://github.com/virstai/ComfyRefinery · scanned 2026-06-16 00:51 UTC (2 months, 1 week ago)

116 raw signals (0 security + 116 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 116 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
71.9
/100
Security checks
72
0 findings
System graph
72
77.8% cov · 116 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: layer: api × excluding tests × Reset all
Severity: Critical 0 High 18 Medium 24 Low 64 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 116 Crowd 0 Layer: Frontend 7 Security 2 Cicd 1 Quality 38 Api 68
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 71.9/100 with 77.8% coverage. It contains 473 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 116 findings — concentrated in api (68), quality (38), frontend (7). Risk profile is high: 0 critical, 18 high, 24 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 68 of 116 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph api Wiring conf 1.00 Dangling fetch: DELETE http://127.0.0.1:${appPort}/api/generate/sessions?status=all (test/integration/generate.test.js:366)
`test/integration/generate.test.js:366` calls `DELETE http://127.0.0.1:${appPort}/api/generate/sessions?status=all` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/generate/sessions` If this …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: DELETE http://127.0.0.1:${appPort}/api/generate/sessions?status=error (test/integration/generate.test.js:346)
`test/integration/generate.test.js:346` calls `DELETE http://127.0.0.1:${appPort}/api/generate/sessions?status=error` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/generate/sessions` If thi…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: DELETE http://127.0.0.1:${appPort}/api/queue/nonexistent-id (test/integration/queue-routes.test.js:48)
`test/integration/queue-routes.test.js:48` calls `DELETE http://127.0.0.1:${appPort}/api/queue/nonexistent-id` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/queue/nonexistent-id` If this po…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/generate/events (ui/src/stores/generate.js:434)
`ui/src/stores/generate.js:434` calls `GET /api/generate/events` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/generate/events` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/arch-help/..%2Fconfig (test/integration/archHelp.test.js:67)
`test/integration/archHelp.test.js:67` calls `GET http://127.0.0.1:${appPort}/api/arch-help/..%2Fconfig` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/arch-help/..%2fconfig` If this points …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/arch-help/nonexistent (test/integration/archHelp.test.js:62)
`test/integration/archHelp.test.js:62` calls `GET http://127.0.0.1:${appPort}/api/arch-help/nonexistent` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/arch-help/nonexistent` If this points …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/arch-help/sd15 (test/integration/archHelp.test.js:54)
`test/integration/archHelp.test.js:54` calls `GET http://127.0.0.1:${appPort}/api/arch-help/sd15` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/arch-help/sd15` If this points at an external…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/generate/sessions/${sessionId} (test/integration/references.test.js:126)
`test/integration/references.test.js:126` calls `GET http://127.0.0.1:${appPort}/api/generate/sessions/${sessionId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/generate/sessions/<p>` If …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/generate/sessions/${sessionId} (test/integration/references.test.js:136)
`test/integration/references.test.js:136` calls `GET http://127.0.0.1:${appPort}/api/generate/sessions/${sessionId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/generate/sessions/<p>` If …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/queue (test/integration/queue-routes.test.js:39)
`test/integration/queue-routes.test.js:39` calls `GET http://127.0.0.1:${appPort}/api/queue` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/queue` If this points at an external API, prefix i…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${appPort}/api/queue/events (test/integration/queue-routes.test.js:63)
`test/integration/queue-routes.test.js:63` calls `GET http://127.0.0.1:${appPort}/api/queue/events` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/queue/events` If this points at an external…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/generate (ui/src/stores/generate.js:315)
`ui/src/stores/generate.js:315` calls `POST /api/generate` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/generate` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/generate/continue/${sessionId} (ui/src/stores/generate.js:337)
`ui/src/stores/generate.js:337` calls `POST /api/generate/continue/${sessionId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/generate/continue/<p>` If this points at an external API, prefix it with `https://` so …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://${host}/api/generate/kill (src/routes/sdapi.js:285)
`src/routes/sdapi.js:285` calls `POST http://${host}/api/generate/kill` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/<p>/api/generate/kill` If this points at an external API, prefix it with `https://` so the…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${appPort}/api/queue/nonexistent-id/stop (test/integration/queue-routes.test.js:55)
`test/integration/queue-routes.test.js:55` calls `POST http://127.0.0.1:${appPort}/api/queue/nonexistent-id/stop` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/queue/nonexistent-id/stop` If…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${appPort}/api/references/upload (test/integration/references.test.js:106)
`test/integration/references.test.js:106` calls `POST http://127.0.0.1:${appPort}/api/references/upload` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/references/upload` If this points at a…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${appPort}/api/references/upload (test/integration/references.test.js:80)
`test/integration/references.test.js:80` calls `POST http://127.0.0.1:${appPort}/api/references/upload` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/references/upload` If this points at an…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${appPort}/api/references/upload (test/integration/references.test.js:96)
`test/integration/references.test.js:96` calls `POST http://127.0.0.1:${appPort}/api/references/upload` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/references/upload` If this points at an…
Dangling fetchFetch
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /:id
`src/routes/queue.js` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /models/:id
`src/routes/sessions.js` declares `DELETE /models/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /sessions
`src/routes/generate.js` declares `DELETE /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /sessions/:id
`src/routes/generate.js` declares `DELETE /sessions/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /workflows/:id
`src/routes/sessions.js` declares `DELETE /workflows/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`src/routes/queue.js` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /:arch
`src/routes/archHelp.js` declares `GET /:arch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/image
`server.js` declares `GET /api/image` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/video
`server.js` declares `GET /api/video` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /config
`src/routes/sessions.js` declares `GET /config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /events
`src/routes/queue.js` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /latent-upscale-modes
`src/routes/sdapi.js` declares `GET /latent-upscale-modes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /models/list
`src/routes/sessions.js` declares `GET /models/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /options
`src/routes/sdapi.js` declares `GET /options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /progress
`src/routes/sdapi.js` declares `GET /progress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /samplers
`src/routes/sdapi.js` declares `GET /samplers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /schedulers
`src/routes/sdapi.js` declares `GET /schedulers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sd-models
`src/routes/sdapi.js` declares `GET /sd-models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sd-vae
`src/routes/sdapi.js` declares `GET /sd-vae` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sessions
`src/routes/generate.js` declares `GET /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sessions/:id
`src/routes/generate.js` declares `GET /sessions/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /skills/:modelId
`src/routes/sessions.js` declares `GET /skills/:modelId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /upscalers
`src/routes/sdapi.js` declares `GET /upscalers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /workflows
`src/routes/sessions.js` declares `GET /workflows` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /config
`src/routes/sessions.js` declares `PATCH /config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /skills/:modelId/notes
`src/routes/sessions.js` declares `PATCH /skills/:modelId/notes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /
`src/routes/generate.js` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /:id/stop
`src/routes/queue.js` declares `POST /:id/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /continue/:id
`src/routes/generate.js` declares `POST /continue/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /human-review/:sessionId
`src/routes/generate.js` declares `POST /human-review/:sessionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /img2img
`src/routes/sdapi.js` declares `POST /img2img` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /interrupt
`src/routes/sdapi.js` declares `POST /interrupt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /kill
`src/routes/generate.js` declares `POST /kill` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /models
`src/routes/sessions.js` declares `POST /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /options
`src/routes/sdapi.js` declares `POST /options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /run
`src/routes/generate.js` declares `POST /run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sessions/:id/refuse-accepted
`src/routes/generate.js` declares `POST /sessions/:id/refuse-accepted` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /skills/:modelId/refresh
`src/routes/sessions.js` declares `POST /skills/:modelId/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /skills/:modelId/versions/:versionId/activate
`src/routes/sessions.js` declares `POST /skills/:modelId/versions/:versionId/activate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /txt2img
`src/routes/sdapi.js` declares `POST /txt2img` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /upload
`src/routes/references.js` declares `POST /upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /workflows
`src/routes/sessions.js` declares `POST /workflows` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /models/:id
`src/routes/sessions.js` declares `PUT /models/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /workflows/:id
`src/routes/sessions.js` declares `PUT /workflows/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: USE /api/arch-help
`server.js` declares `USE /api/arch-help` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: USE /api/generate
`server.js` declares `USE /api/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: USE /api/queue
`server.js` declares `USE /api/queue` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: USE /api/references
`server.js` declares `USE /api/references` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: USE /api/sessions
`server.js` declares `USE /api/sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: USE /sdapi/v1
`server.js` declares `USE /sdapi/v1` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/538f5566-1c18-4928-8243-c42049d70c3a/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/538f5566-1c18-4928-8243-c42049d70c3a/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.