{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-40f0ec72a779448e", "name": "Possibly dead Python function: build_similarity_query", "shortDescription": {"text": "Possibly dead Python function: build_similarity_query"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51c9d51c999932fd", "name": "Possibly dead Python function: find_similar_backlog", "shortDescription": {"text": "Possibly dead Python function: find_similar_backlog"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1bce0c220852a28", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1629", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1629"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-806eef0e7d338cfd", "name": "Very large file: api.py (2161 lines)", "shortDescription": {"text": "Very large file: api.py (2161 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb1e651e3ceb9e81", "name": "Flask mutation route `send_to_brain` without `@login_required` \u2014 api.py:553", "shortDescription": {"text": "Flask mutation route `send_to_brain` without `@login_required` \u2014 api.py:553"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b7118234fa94355a", "name": "Flask mutation route `auth` without `@login_required` \u2014 api.py:587", "shortDescription": {"text": "Flask mutation route `auth` without `@login_required` \u2014 api.py:587"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-695bc098f86f3f5b", "name": "Flask mutation route `update_entry` without `@login_required` \u2014 api.py:620", "shortDescription": {"text": "Flask mutation route `update_entry` without `@login_required` \u2014 api.py:620"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8d2d2501701a377", "name": "Flask mutation route `create_entry` without `@login_required` \u2014 api.py:685", "shortDescription": {"text": "Flask mutation route `create_entry` without `@login_required` \u2014 api.py:685"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5160e500b81bfd7f", "name": "Flask mutation route `update_status` without `@login_required` \u2014 api.py:855", "shortDescription": {"text": "Flask mutation route `update_status` without `@login_required` \u2014 api.py:855"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4c08b0dd13d1d86d", "name": "Flask mutation route `update_tags` without `@login_required` \u2014 api.py:872", "shortDescription": {"text": "Flask mutation route `update_tags` without `@login_required` \u2014 api.py:872"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-654c98d17c586e28", "name": "Flask mutation route `update_notes` without `@login_required` \u2014 api.py:885", "shortDescription": {"text": "Flask mutation route `update_notes` without `@login_required` \u2014 api.py:885"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d4ee578b0e35ab4b", "name": "Flask mutation route `delete_entry` without `@login_required` \u2014 api.py:898", "shortDescription": {"text": "Flask mutation route `delete_entry` without `@login_required` \u2014 api.py:898"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4b4ba955077504f", "name": "Flask mutation route `create_presentation` without `@login_required` \u2014 api.py:918", "shortDescription": {"text": "Flask mutation route `create_presentation` without `@login_required` \u2014 api.py:918"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b5ab963a3347457d", "name": "Flask mutation route `delete_presentation` without `@login_required` \u2014 api.py:942", "shortDescription": {"text": "Flask mutation route `delete_presentation` without `@login_required` \u2014 api.py:942"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35aba2be11e609d2", "name": "Flask mutation route `find_images` without `@login_required` \u2014 api.py:1095", "shortDescription": {"text": "Flask mutation route `find_images` without `@login_required` \u2014 api.py:1095"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2bb6368a9b88f0a6", "name": "Flask mutation route `set_presentation` without `@login_required` \u2014 api.py:1129", "shortDescription": {"text": "Flask mutation route `set_presentation` without `@login_required` \u2014 api.py:1129"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1cab744ce7677e1", "name": "Flask mutation route `select_image` without `@login_required` \u2014 api.py:1145", "shortDescription": {"text": "Flask mutation route `select_image` without `@login_required` \u2014 api.py:1145"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23e548a1b0e99e7a", "name": "Flask mutation route `generate_slide` without `@login_required` \u2014 api.py:1163", "shortDescription": {"text": "Flask mutation route `generate_slide` without `@login_required` \u2014 api.py:1163"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca3879ae06e5259d", "name": "Flask mutation route `agent_create_entry` without `@login_required` \u2014 api.py:1875", "shortDescription": {"text": "Flask mutation route `agent_create_entry` without `@login_required` \u2014 api.py:1875"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7120f117e235c8a2", "name": "Flask mutation route `agent_update_entry` without `@login_required` \u2014 api.py:2064", "shortDescription": {"text": "Flask mutation route `agent_update_entry` without `@login_required` \u2014 api.py:2064"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b3f208566e14e13", "name": "Flask mutation route `agent_delete_entry` without `@login_required` \u2014 api.py:2136", "shortDescription": {"text": "Flask mutation route `agent_delete_entry` without `@login_required` \u2014 api.py:2136"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/26189"}, "properties": {"repository": "gsalami/knowledge-bridge", "repoUrl": "https://github.com/gsalami/knowledge-bridge", "branch": "main"}, "results": [{"ruleId": "scanner-40f0ec72a779448e", "level": "note", "message": {"text": "Possibly dead Python function: build_similarity_query"}, "properties": {"repobilityId": "b7a9e0ae2c886a99", "scanner": "scanner-primary", "fingerprint": "40f0ec72a779448e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py:418"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51c9d51c999932fd", "level": "note", "message": {"text": "Possibly dead Python function: find_similar_backlog"}, "properties": {"repobilityId": "cf35f8652fe40286", "scanner": "scanner-primary", "fingerprint": "51c9d51c999932fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py:485"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1bce0c220852a28", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1629"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "b1bce0c220852a28", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 1629}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-806eef0e7d338cfd", "level": "note", "message": {"text": "Very large file: api.py (2161 lines)"}, "properties": {"repobilityId": "ad3b8140270f67c4", "scanner": "scanner-primary", "fingerprint": "806eef0e7d338cfd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eb1e651e3ceb9e81", "level": "error", "message": {"text": "Flask mutation route `send_to_brain` without `@login_required` \u2014 api.py:553"}, "properties": {"repobilityId": "41e69a569c4ed2e4", "scanner": "scanner-primary", "fingerprint": "eb1e651e3ceb9e81", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 553}}}]}, {"ruleId": "scanner-b7118234fa94355a", "level": "error", "message": {"text": "Flask mutation route `auth` without `@login_required` \u2014 api.py:587"}, "properties": {"repobilityId": "d6de1589a43bc78e", "scanner": "scanner-primary", "fingerprint": "b7118234fa94355a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 587}}}]}, {"ruleId": "scanner-695bc098f86f3f5b", "level": "error", "message": {"text": "Flask mutation route `update_entry` without `@login_required` \u2014 api.py:620"}, "properties": {"repobilityId": "f873f946e3f6c601", "scanner": "scanner-primary", "fingerprint": "695bc098f86f3f5b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 620}}}]}, {"ruleId": "scanner-d8d2d2501701a377", "level": "error", "message": {"text": "Flask mutation route `create_entry` without `@login_required` \u2014 api.py:685"}, "properties": {"repobilityId": "45aa8402beb815f4", "scanner": "scanner-primary", "fingerprint": "d8d2d2501701a377", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 685}}}]}, {"ruleId": "scanner-5160e500b81bfd7f", "level": "error", "message": {"text": "Flask mutation route `update_status` without `@login_required` \u2014 api.py:855"}, "properties": {"repobilityId": "b77f20e56ab67f24", "scanner": "scanner-primary", "fingerprint": "5160e500b81bfd7f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 855}}}]}, {"ruleId": "scanner-4c08b0dd13d1d86d", "level": "error", "message": {"text": "Flask mutation route `update_tags` without `@login_required` \u2014 api.py:872"}, "properties": {"repobilityId": "1c5959db2e0f7c75", "scanner": "scanner-primary", "fingerprint": "4c08b0dd13d1d86d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 872}}}]}, {"ruleId": "scanner-654c98d17c586e28", "level": "error", "message": {"text": "Flask mutation route `update_notes` without `@login_required` \u2014 api.py:885"}, "properties": {"repobilityId": "b9c2bbba18086a59", "scanner": "scanner-primary", "fingerprint": "654c98d17c586e28", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 885}}}]}, {"ruleId": "scanner-d4ee578b0e35ab4b", "level": "error", "message": {"text": "Flask mutation route `delete_entry` without `@login_required` \u2014 api.py:898"}, "properties": {"repobilityId": "f884acaedc4a0595", "scanner": "scanner-primary", "fingerprint": "d4ee578b0e35ab4b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 898}}}]}, {"ruleId": "scanner-e4b4ba955077504f", "level": "error", "message": {"text": "Flask mutation route `create_presentation` without `@login_required` \u2014 api.py:918"}, "properties": {"repobilityId": "bbd6a6258aef592b", "scanner": "scanner-primary", "fingerprint": "e4b4ba955077504f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 918}}}]}, {"ruleId": "scanner-b5ab963a3347457d", "level": "error", "message": {"text": "Flask mutation route `delete_presentation` without `@login_required` \u2014 api.py:942"}, "properties": {"repobilityId": "f70e65162a3fb493", "scanner": "scanner-primary", "fingerprint": "b5ab963a3347457d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 942}}}]}, {"ruleId": "scanner-35aba2be11e609d2", "level": "error", "message": {"text": "Flask mutation route `find_images` without `@login_required` \u2014 api.py:1095"}, "properties": {"repobilityId": "46d220156a00b7e3", "scanner": "scanner-primary", "fingerprint": "35aba2be11e609d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 1095}}}]}, {"ruleId": "scanner-2bb6368a9b88f0a6", "level": "error", "message": {"text": "Flask mutation route `set_presentation` without `@login_required` \u2014 api.py:1129"}, "properties": {"repobilityId": "9dc31c40fd9d9b60", "scanner": "scanner-primary", "fingerprint": "2bb6368a9b88f0a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 1129}}}]}, {"ruleId": "scanner-a1cab744ce7677e1", "level": "error", "message": {"text": "Flask mutation route `select_image` without `@login_required` \u2014 api.py:1145"}, "properties": {"repobilityId": "327ada36b21a6bd2", "scanner": "scanner-primary", "fingerprint": "a1cab744ce7677e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 1145}}}]}, {"ruleId": "scanner-23e548a1b0e99e7a", "level": "error", "message": {"text": "Flask mutation route `generate_slide` without `@login_required` \u2014 api.py:1163"}, "properties": {"repobilityId": "eb0a102a5b0081b4", "scanner": "scanner-primary", "fingerprint": "23e548a1b0e99e7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 1163}}}]}, {"ruleId": "scanner-ca3879ae06e5259d", "level": "error", "message": {"text": "Flask mutation route `agent_create_entry` without `@login_required` \u2014 api.py:1875"}, "properties": {"repobilityId": "8f2069990774aee7", "scanner": "scanner-primary", "fingerprint": "ca3879ae06e5259d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 1875}}}]}, {"ruleId": "scanner-7120f117e235c8a2", "level": "error", "message": {"text": "Flask mutation route `agent_update_entry` without `@login_required` \u2014 api.py:2064"}, "properties": {"repobilityId": "0aaceca142da4537", "scanner": "scanner-primary", "fingerprint": "7120f117e235c8a2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 2064}}}]}, {"ruleId": "scanner-7b3f208566e14e13", "level": "error", "message": {"text": "Flask mutation route `agent_delete_entry` without `@login_required` \u2014 api.py:2136"}, "properties": {"repobilityId": "ed9f4907ff0e3751", "scanner": "scanner-primary", "fingerprint": "7b3f208566e14e13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.py"}, "region": {"startLine": 2136}}}]}]}]}