{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-35cd4031c50b36a6", "name": "Possibly dead Python function: create_app", "shortDescription": {"text": "Possibly dead Python function: create_app"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a35a161c37a0ffe", "name": "Possibly dead Python function: parse", "shortDescription": {"text": "Possibly dead Python function: parse"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-058127ae96bcafd3", "name": "Possibly dead Python function: session", "shortDescription": {"text": "Possibly dead Python function: session"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c11065fa45df22e", "name": "Possibly dead Python function: formatTimestamp", "shortDescription": {"text": "Possibly dead Python function: formatTimestamp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d459b666bb37a9e2", "name": "Possibly dead Python function: inner", "shortDescription": {"text": "Possibly dead Python function: inner"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-309fa2ca0dd500ab", "name": "Possibly dead Python function: funOperator", "shortDescription": {"text": "Possibly dead Python function: funOperator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ed544912ff2cd66", "name": "Stray `console.log` in TS/JS \u2014 js/webpack.config.js:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/webpack.config.js:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1758f55b234411dd", "name": "TODO/FIXME marker in shipping code \u2014 js/views/modules/zoneuserdata.js:93", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 js/views/modules/zoneuserdata.js:93"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0fba7f505cd93d2", "name": "TODO/FIXME marker in shipping code \u2014 js/views/modules/seat.js:344", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 js/views/modules/seat.js:344"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-82b392436d0ba9d6", "name": "TODO/FIXME marker in shipping code \u2014 js/views/modules/zoneModify_seat.js:5", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 js/views/modules/zoneModify_seat.js:5"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83a5448b4541615f", "name": "Stray `console.log` in TS/JS \u2014 e2e/global-teardown.ts:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 e2e/global-teardown.ts:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a17eed1cc6e9009", "name": "Stray `console.log` in TS/JS \u2014 e2e/global-setup.ts:60", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 e2e/global-setup.ts:60"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-311cf2f918064d9b", "name": "Dockerfile runs as root: containers/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: containers/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17d1932ddafc1b64", "name": "Docker base image uses a mutable or implicit tag: alpine:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b84717855f2e2f19", "name": "Insecure pattern 'document_write' in js/base/base.js:46", "shortDescription": {"text": "Insecure pattern 'document_write' in js/base/base.js:46"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fc3b754e41e253e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/base/base.js:243", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/base/base.js:243"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4557217c1013fe38", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/zone.js:459", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/zone.js:459"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b24b239e6b2feaaa", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/planModify.js:49", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/planModify.js:49"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b963bbc75f578274", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/groupAssign.js:105", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/groupAssign.js:105"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bcc829ae0730e9a3", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/users.js:98", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/users.js:98"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-694e8e250b6f18a6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/zones.js:160", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/zones.js:160"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc8b382470157523", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/modules/zoneModify_marquee.js:90", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/modules/zoneModify_marquee.js:90"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7eb47a05bc993b3e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/views/modules/modal.js:33", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/modules/modal.js:33"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f0329ac74e131d9", "name": "Possible secret in warp/config.py", "shortDescription": {"text": "Possible secret in warp/config.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-766735e55b35e64e", "name": "Insecure pattern 'direct_innerhtml_assignment' in warp/static/materialize/materialize.min.js:6", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in warp/static/materialize/materialize.min.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a83de1c6d96d1ac", "name": "Insecure pattern 'insert_adjacent_html' in warp/static/materialize/materialize.min.js:6", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in warp/static/materialize/materialize.min.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb67619d288279ae", "name": "Insecure pattern 'node_child_process' in e2e/global-teardown.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in e2e/global-teardown.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d7f4613ed44fefe", "name": "Insecure pattern 'node_child_process' in e2e/global-setup.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in e2e/global-setup.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38722bdee4adbe03", "name": "Possible secret in e2e/helpers/users.ts", "shortDescription": {"text": "Possible secret in e2e/helpers/users.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b10efa133fc2ba07", "name": "Possible secret in e2e/helpers/admin.ts", "shortDescription": {"text": "Possible secret in e2e/helpers/admin.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-42081915318e25d7", "name": "Possible secret in e2e/helpers/db.ts", "shortDescription": {"text": "Possible secret in e2e/helpers/db.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c8064fb84d871725", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/metadata-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bbca7f73c5477df", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d7e834080dbebed", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65c9bd56493a81d3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 36 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 23 placeholder/mock markers across 4 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1d20e1eac5cdc10", "name": "Network/subprocess call without timeout or try/except \u2014 setup.py:14", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 setup.py:14"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad6b000473c2e92d", "name": "Legacy-named symbol `cal_copy` in js/base/base.js:195", "shortDescription": {"text": "Legacy-named symbol `cal_copy` in js/base/base.js:195"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-379926cdd108d181", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/base/base.js:149", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/base/base.js:149"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b97eb2662efd719a", "name": "Commented-code block (7 lines) in js/views/modules/zoneModify_marquee.js:217", "shortDescription": {"text": "Commented-code block (7 lines) in js/views/modules/zoneModify_marquee.js:217"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-42e2521ff29adef9", "name": "Commented-code block (5 lines) in js/views/modules/utils.js:146", "shortDescription": {"text": "Commented-code block (5 lines) in js/views/modules/utils.js:146"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d4b99d0c933535d", "name": "Commented-code block (5 lines) in warp/db.py:50", "shortDescription": {"text": "Commented-code block (5 lines) in warp/db.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74505160e0b52b55", "name": "Commented-code block (7 lines) in warp/config.py:89", "shortDescription": {"text": "Commented-code block (7 lines) in warp/config.py:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-369cf8b7f7e0372c", "name": "Commented-code block (5 lines) in warp/utils.py:44", "shortDescription": {"text": "Commented-code block (5 lines) in warp/utils.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea1178f2c7e288ba", "name": "Commented-code block (8 lines) in warp/xhr/plans.py:170", "shortDescription": {"text": "Commented-code block (8 lines) in warp/xhr/plans.py:170"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-148475698a77f8fe", "name": "Commented-code block (8 lines) in warp/xhr/zone.py:14", "shortDescription": {"text": "Commented-code block (8 lines) in warp/xhr/zone.py:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18a5097f82922703", "name": "`fetch()` without try/.catch or AbortSignal \u2014 e2e/fixtures.ts:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 e2e/fixtures.ts:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48e2f1ea832ef2da", "name": "Legacy-named symbol `tooOld` in e2e/tests/settings/calendar.spec.ts:175", "shortDescription": {"text": "Legacy-named symbol `tooOld` in e2e/tests/settings/calendar.spec.ts:175"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8cc9de8c3adf623", "name": "Commented-code block (5 lines) in e2e/helpers/db.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in e2e/helpers/db.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nwarp/auth.py:loginMatch, warp/auth.py:login\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nwarp/xhr/plans.py:addOrEdit, warp/xhr/zones.py:addOrEdit, warp/xhr/zones.py:assign\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9906b1b7cddeec5", "name": "Flask mutation route `set_time_offset` without `@login_required` \u2014 warp/debug.py:20", "shortDescription": {"text": "Flask mutation route `set_time_offset` without `@login_required` \u2014 warp/debug.py:20"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b9aae175573c4204", "name": "Flask mutation route `login` without `@login_required` \u2014 warp/auth_oidc.py:92", "shortDescription": {"text": "Flask mutation route `login` without `@login_required` \u2014 warp/auth_oidc.py:92"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ef037afd8fd3487b", "name": "Flask mutation route `login` without `@login_required` \u2014 warp/auth_ldap.py:170", "shortDescription": {"text": "Flask mutation route `login` without `@login_required` \u2014 warp/auth_ldap.py:170"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6229fa888a1821d0", "name": "Flask mutation route `calendar_post` without `@login_required` \u2014 warp/xhr/calendar.py:83", "shortDescription": {"text": "Flask mutation route `calendar_post` without `@login_required` \u2014 warp/xhr/calendar.py:83"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-662c09a308ea522c", "name": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/plans.py:16", "shortDescription": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/plans.py:16"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2836ca1e2ae25bb8", "name": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/plans.py:87", "shortDescription": {"text": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/plans.py:87"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d73488b4c8d16b23", "name": "Flask mutation route `addOrEdit` without `@login_required` \u2014 warp/xhr/plans.py:115", "shortDescription": {"text": "Flask mutation route `addOrEdit` without `@login_required` \u2014 warp/xhr/plans.py:115"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7fac08cc48c251ae", "name": "Flask mutation route `modify` without `@login_required` \u2014 warp/xhr/plans.py:179", "shortDescription": {"text": "Flask mutation route `modify` without `@login_required` \u2014 warp/xhr/plans.py:179"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e49d6ba6a9934dfb", "name": "Flask mutation route `apply` without `@login_required` \u2014 warp/xhr/zone.py:274", "shortDescription": {"text": "Flask mutation route `apply` without `@login_required` \u2014 warp/xhr/zone.py:274"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a87dc40eeb612f1c", "name": "Flask mutation route `autoBook` without `@login_required` \u2014 warp/xhr/zone.py:849", "shortDescription": {"text": "Flask mutation route `autoBook` without `@login_required` \u2014 warp/xhr/zone.py:849"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c535a0510810e78", "name": "Flask mutation route `prefs_set` without `@login_required` \u2014 warp/xhr/prefs.py:78", "shortDescription": {"text": "Flask mutation route `prefs_set` without `@login_required` \u2014 warp/xhr/prefs.py:78"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b94150fef8ea3de", "name": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/users.py:11", "shortDescription": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/users.py:11"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d701aa301451040", "name": "Flask mutation route `edit` without `@login_required` \u2014 warp/xhr/users.py:54", "shortDescription": {"text": "Flask mutation route `edit` without `@login_required` \u2014 warp/xhr/users.py:54"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd6c82ed933f5c19", "name": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/users.py:140", "shortDescription": {"text": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/users.py:140"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1539c5f2832db68d", "name": "Flask mutation route `report` without `@login_required` \u2014 warp/xhr/bookings.py:13", "shortDescription": {"text": "Flask mutation route `report` without `@login_required` \u2014 warp/xhr/bookings.py:13"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72e66bb547ccb0bc", "name": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/bookings.py:50", "shortDescription": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/bookings.py:50"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee05119ec1889c63", "name": "Flask mutation route `members` without `@login_required` \u2014 warp/xhr/groups.py:17", "shortDescription": {"text": "Flask mutation route `members` without `@login_required` \u2014 warp/xhr/groups.py:17"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb00938b4d3d8ee2", "name": "Flask mutation route `assign` without `@login_required` \u2014 warp/xhr/groups.py:71", "shortDescription": {"text": "Flask mutation route `assign` without `@login_required` \u2014 warp/xhr/groups.py:71"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e5d4d8ce6ee5bf7", "name": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/zones.py:15", "shortDescription": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/zones.py:15"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b8da3a446cbad76", "name": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/zones.py:89", "shortDescription": {"text": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/zones.py:89"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01ed6bdbe4fd4979", "name": "Flask mutation route `addOrEdit` without `@login_required` \u2014 warp/xhr/zones.py:154", "shortDescription": {"text": "Flask mutation route `addOrEdit` without `@login_required` \u2014 warp/xhr/zones.py:154"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7adc86b4fd15ff69", "name": "Flask mutation route `members` without `@login_required` \u2014 warp/xhr/zones.py:197", "shortDescription": {"text": "Flask mutation route `members` without `@login_required` \u2014 warp/xhr/zones.py:197"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-db2180528b7a47f6", "name": "Flask mutation route `assign` without `@login_required` \u2014 warp/xhr/zones.py:242", "shortDescription": {"text": "Flask mutation route `assign` without `@login_required` \u2014 warp/xhr/zones.py:242"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8cdbc66dadda834", "name": "Dangling fetch: GET /xhr/prefs (js/base/base.js:127)", "shortDescription": {"text": "Dangling fetch: GET /xhr/prefs (js/base/base.js:127)"}, "fullDescription": {"text": "`js/base/base.js:127` calls `GET /xhr/prefs` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/xhr/prefs`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ed9b091092799f9", "name": "Dangling fetch: POST /xhr/prefs (js/base/base.js:149)", "shortDescription": {"text": "Dangling fetch: POST /xhr/prefs (js/base/base.js:149)"}, "fullDescription": {"text": "`js/base/base.js:149` calls `POST /xhr/prefs` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/xhr/prefs`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8589b9f51faeebe", "name": "Dangling fetch: GET /xhr/calendar (js/base/base.js:449)", "shortDescription": {"text": "Dangling fetch: GET /xhr/calendar (js/base/base.js:449)"}, "fullDescription": {"text": "`js/base/base.js:449` calls `GET /xhr/calendar` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/xhr/calendar`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-07e8bd0b530d4061", "name": "Dangling fetch: POST /xhr/calendar (js/base/base.js:462)", "shortDescription": {"text": "Dangling fetch: POST /xhr/calendar (js/base/base.js:462)"}, "fullDescription": {"text": "`js/base/base.js:462` calls `POST /xhr/calendar` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/xhr/calendar`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba351d892794949b", "name": "Dangling fetch: POST /xhr/calendar (js/base/base.js:484)", "shortDescription": {"text": "Dangling fetch: POST /xhr/calendar (js/base/base.js:484)"}, "fullDescription": {"text": "`js/base/base.js:484` calls `POST /xhr/calendar` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/xhr/calendar`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3250b035cea6ad7", "name": "Unused endpoint: ANY /bookings/<string:report>", "shortDescription": {"text": "Unused endpoint: ANY /bookings/<string:report>"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /bookings/<string:report>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-096c2e3023f24953", "name": "Unused endpoint: ANY /bookings", "shortDescription": {"text": "Unused endpoint: ANY /bookings"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /bookings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1c42c6e296ba0b7", "name": "Unused endpoint: ANY /plan/<pid>", "shortDescription": {"text": "Unused endpoint: ANY /plan/<pid>"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /plan/<pid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e030df35dc4f12ee", "name": "Unused endpoint: ANY /plan/image/<pid>", "shortDescription": {"text": "Unused endpoint: ANY /plan/image/<pid>"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /plan/image/<pid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-844f255ceef7cc7d", "name": "Unused endpoint: ANY /users", "shortDescription": {"text": "Unused endpoint: ANY /users"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d48ba027d34668b", "name": "Unused endpoint: ANY /groups", "shortDescription": {"text": "Unused endpoint: ANY /groups"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28791337d6106379", "name": "Unused endpoint: ANY /zones", "shortDescription": {"text": "Unused endpoint: ANY /zones"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /zones` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa4d402d8fb02299", "name": "Unused endpoint: ANY /plans", "shortDescription": {"text": "Unused endpoint: ANY /plans"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /plans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-411da5ff43c840cd", "name": "Unused endpoint: ANY /groups/assign/<group_login>", "shortDescription": {"text": "Unused endpoint: ANY /groups/assign/<group_login>"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /groups/assign/<group_login>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef65b7b1399a5570", "name": "Unused endpoint: ANY /zones/assign/<zid>", "shortDescription": {"text": "Unused endpoint: ANY /zones/assign/<zid>"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /zones/assign/<zid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6266b7428141251", "name": "Unused endpoint: ANY /plans/modify/<pid>", "shortDescription": {"text": "Unused endpoint: ANY /plans/modify/<pid>"}, "fullDescription": {"text": "`warp/view.py` declares `ANY /plans/modify/<pid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c7ad61ba1b23915", "name": "Unused endpoint: ANY /login", "shortDescription": {"text": "Unused endpoint: ANY /login"}, "fullDescription": {"text": "`warp/auth_aad.py` declares `ANY /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-769d6c3304500084", "name": "Unused endpoint: ANY /signin-oidc", "shortDescription": {"text": "Unused endpoint: ANY /signin-oidc"}, "fullDescription": {"text": "`warp/auth_aad.py` declares `ANY /signin-oidc` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4504ac13a22a1b1f", "name": "Unused endpoint: ANY /debug/time", "shortDescription": {"text": "Unused endpoint: ANY /debug/time"}, "fullDescription": {"text": "`warp/debug.py` declares `ANY /debug/time` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d1c8b97537394d4", "name": "Unused endpoint: ANY /debug/set_time_offset", "shortDescription": {"text": "Unused endpoint: ANY /debug/set_time_offset"}, "fullDescription": {"text": "`warp/debug.py` declares `ANY /debug/set_time_offset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9db48a6a92c59ef1", "name": "Unused endpoint: ANY /debug/endpoints", "shortDescription": {"text": "Unused endpoint: ANY /debug/endpoints"}, "fullDescription": {"text": "`warp/debug.py` declares `ANY /debug/endpoints` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e449c3b9e73b73", "name": "Unused endpoint: ANY /logout", "shortDescription": {"text": "Unused endpoint: ANY /logout"}, "fullDescription": {"text": "`warp/auth_mellon.py` declares `ANY /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e2940fb03caa461", "name": "Unused endpoint: ANY /oidc/start", "shortDescription": {"text": "Unused endpoint: ANY /oidc/start"}, "fullDescription": {"text": "`warp/auth_oidc.py` declares `ANY /oidc/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e878ecff0d59c125", "name": "Unused endpoint: ANY /oidc/callback", "shortDescription": {"text": "Unused endpoint: ANY /oidc/callback"}, "fullDescription": {"text": "`warp/auth_oidc.py` declares `ANY /oidc/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-057ea0df0212cd36", "name": "Unused endpoint: ANY /calendar/<login>/events.ics", "shortDescription": {"text": "Unused endpoint: ANY /calendar/<login>/events.ics"}, "fullDescription": {"text": "`warp/ical.py` declares `ANY /calendar/<login>/events.ics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eae87937c8965b9c", "name": "Unused endpoint: ANY /calendar/<login>/book", "shortDescription": {"text": "Unused endpoint: ANY /calendar/<login>/book"}, "fullDescription": {"text": "`warp/ical.py` declares `ANY /calendar/<login>/book` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00b15c97548066ed", "name": "Unused endpoint: ANY /calendar/<login>/delete", "shortDescription": {"text": "Unused endpoint: ANY /calendar/<login>/delete"}, "fullDescription": {"text": "`warp/ical.py` declares `ANY /calendar/<login>/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16fb83a7ef5afa3b", "name": "Unused endpoint: ANY /calendar/cancelled", "shortDescription": {"text": "Unused endpoint: ANY /calendar/cancelled"}, "fullDescription": {"text": "`warp/ical.py` declares `ANY /calendar/cancelled` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc00879f11401d04", "name": "Unused endpoint: ANY /calendar", "shortDescription": {"text": "Unused endpoint: ANY /calendar"}, "fullDescription": {"text": "`warp/xhr/calendar.py` declares `ANY /calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c17bcaa65c711562", "name": "Unused endpoint: ANY /list", "shortDescription": {"text": "Unused endpoint: ANY /list"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b23fa5c5cd240ff6", "name": "Unused endpoint: ANY /delete", "shortDescription": {"text": "Unused endpoint: ANY /delete"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b4cf217390b5abf", "name": "Unused endpoint: ANY /addoredit", "shortDescription": {"text": "Unused endpoint: ANY /addoredit"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /addoredit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-867c761e509d10ab", "name": "Unused endpoint: ANY /getSeats/<int:pid>", "shortDescription": {"text": "Unused endpoint: ANY /getSeats/<int:pid>"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /getSeats/<int:pid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e6a511bc06c1fdf", "name": "Unused endpoint: ANY /modify", "shortDescription": {"text": "Unused endpoint: ANY /modify"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /modify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bef9cacdf8ae374", "name": "Unused endpoint: ANY /zonesForPlan", "shortDescription": {"text": "Unused endpoint: ANY /zonesForPlan"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /zonesForPlan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d5ba4ec724c4f7", "name": "Unused endpoint: ANY /allZones", "shortDescription": {"text": "Unused endpoint: ANY /allZones"}, "fullDescription": {"text": "`warp/xhr/plans.py` declares `ANY /allZones` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b9315cdc4aaabd1", "name": "Unused endpoint: ANY /apply", "shortDescription": {"text": "Unused endpoint: ANY /apply"}, "fullDescription": {"text": "`warp/xhr/zone.py` declares `ANY /apply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae77b26997455072", "name": "Unused endpoint: ANY /autoBook/<int:pid>", "shortDescription": {"text": "Unused endpoint: ANY /autoBook/<int:pid>"}, "fullDescription": {"text": "`warp/xhr/zone.py` declares `ANY /autoBook/<int:pid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b3fac0ccd4d026f", "name": "Unused endpoint: ANY /getUsers/<int:pid>", "shortDescription": {"text": "Unused endpoint: ANY /getUsers/<int:pid>"}, "fullDescription": {"text": "`warp/xhr/zone.py` declares `ANY /getUsers/<int:pid>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72d4076b7d9fbbd1", "name": "Unused endpoint: ANY /prefs", "shortDescription": {"text": "Unused endpoint: ANY /prefs"}, "fullDescription": {"text": "`warp/xhr/prefs.py` declares `ANY /prefs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7052868335447ec", "name": "Unused endpoint: ANY /edit", "shortDescription": {"text": "Unused endpoint: ANY /edit"}, "fullDescription": {"text": "`warp/xhr/users.py` declares `ANY /edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b3f7eae9c418e28", "name": "Unused endpoint: ANY /groups/<login>", "shortDescription": {"text": "Unused endpoint: ANY /groups/<login>"}, "fullDescription": {"text": "`warp/xhr/users.py` declares `ANY /groups/<login>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7ba4be6a94cc362", "name": "Unused endpoint: ANY /report", "shortDescription": {"text": "Unused endpoint: ANY /report"}, "fullDescription": {"text": "`warp/xhr/bookings.py` declares `ANY /report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc4abab8a997ed32", "name": "Unused endpoint: ANY /members", "shortDescription": {"text": "Unused endpoint: ANY /members"}, "fullDescription": {"text": "`warp/xhr/groups.py` declares `ANY /members` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47588f2e9b759517", "name": "Unused endpoint: ANY /assign", "shortDescription": {"text": "Unused endpoint: ANY /assign"}, "fullDescription": {"text": "`warp/xhr/groups.py` declares `ANY /assign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88e7f36df43aff1e", "name": "Unused endpoint: ANY /names", "shortDescription": {"text": "Unused endpoint: ANY /names"}, "fullDescription": {"text": "`warp/xhr/zones.py` declares `ANY /names` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19174"}, "properties": {"repository": "sebo-b/warp", "repoUrl": "https://github.com/sebo-b/warp", "branch": "main"}, "results": [{"ruleId": "scanner-35cd4031c50b36a6", "level": "note", "message": {"text": "Possibly dead Python function: create_app"}, "properties": {"repobilityId": "a79cd2100928826c", "scanner": "scanner-primary", "fingerprint": "35cd4031c50b36a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/__init__.py:5"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a35a161c37a0ffe", "level": "note", "message": {"text": "Possibly dead Python function: parse"}, "properties": {"repobilityId": "a81183814e752e15", "scanner": "scanner-primary", "fingerprint": "4a35a161c37a0ffe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/config.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-058127ae96bcafd3", "level": "note", "message": {"text": "Possibly dead Python function: session"}, "properties": {"repobilityId": "59ab1f5f328b31ab", "scanner": "scanner-primary", "fingerprint": "058127ae96bcafd3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/auth.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c11065fa45df22e", "level": "note", "message": {"text": "Possibly dead Python function: formatTimestamp"}, "properties": {"repobilityId": "80e9984788cd955e", "scanner": "scanner-primary", "fingerprint": "2c11065fa45df22e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/utils.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d459b666bb37a9e2", "level": "note", "message": {"text": "Possibly dead Python function: inner"}, "properties": {"repobilityId": "d48a210cecd2a9b7", "scanner": "scanner-primary", "fingerprint": "d459b666bb37a9e2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/utils.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-309fa2ca0dd500ab", "level": "note", "message": {"text": "Possibly dead Python function: funOperator"}, "properties": {"repobilityId": "e2fd55f707dd3bbc", "scanner": "scanner-primary", "fingerprint": "309fa2ca0dd500ab", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/bookings.py:85"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ed544912ff2cd66", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/webpack.config.js:24"}, "properties": {"repobilityId": "69e419aed3418f80", "scanner": "scanner-primary", "fingerprint": "2ed544912ff2cd66", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1758f55b234411dd", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 js/views/modules/zoneuserdata.js:93"}, "properties": {"repobilityId": "f7ac0b59b71a04c0", "scanner": "scanner-primary", "fingerprint": "1758f55b234411dd", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-b0fba7f505cd93d2", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 js/views/modules/seat.js:344"}, "properties": {"repobilityId": "a80a50ee4bda531b", "scanner": "scanner-primary", "fingerprint": "b0fba7f505cd93d2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-82b392436d0ba9d6", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 js/views/modules/zoneModify_seat.js:5"}, "properties": {"repobilityId": "563b6200daf6543a", "scanner": "scanner-primary", "fingerprint": "82b392436d0ba9d6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-83a5448b4541615f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 e2e/global-teardown.ts:16"}, "properties": {"repobilityId": "dd8d374e880f9ae4", "scanner": "scanner-primary", "fingerprint": "83a5448b4541615f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7a17eed1cc6e9009", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 e2e/global-setup.ts:60"}, "properties": {"repobilityId": "47b4f7ec079f9271", "scanner": "scanner-primary", "fingerprint": "7a17eed1cc6e9009", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-311cf2f918064d9b", "level": "warning", "message": {"text": "Dockerfile runs as root: containers/Dockerfile"}, "properties": {"repobilityId": "0f334707f3ff6c93", "scanner": "scanner-primary", "fingerprint": "311cf2f918064d9b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-17d1932ddafc1b64", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "properties": {"repobilityId": "08a4e1bb264ce007", "scanner": "scanner-primary", "fingerprint": "17d1932ddafc1b64", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "containers/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17d1932ddafc1b64", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "properties": {"repobilityId": "f3cf8fb6244facef", "scanner": "scanner-primary", "fingerprint": "17d1932ddafc1b64", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "containers/Dockerfile"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b84717855f2e2f19", "level": "note", "message": {"text": "Insecure pattern 'document_write' in js/base/base.js:46"}, "properties": {"repobilityId": "265b4f021dba5c91", "scanner": "scanner-primary", "fingerprint": "b84717855f2e2f19", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/base/base.js"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-7fc3b754e41e253e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/base/base.js:243"}, "properties": {"repobilityId": "d55fcd97636f66a3", "scanner": "scanner-primary", "fingerprint": "7fc3b754e41e253e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/base/base.js"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-4557217c1013fe38", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/zone.js:459"}, "properties": {"repobilityId": "c4114e48163cac6e", "scanner": "scanner-primary", "fingerprint": "4557217c1013fe38", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/zone.js"}, "region": {"startLine": 459}}}]}, {"ruleId": "scanner-b24b239e6b2feaaa", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/planModify.js:49"}, "properties": {"repobilityId": "76f284b95c349d83", "scanner": "scanner-primary", "fingerprint": "b24b239e6b2feaaa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/planModify.js"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-b963bbc75f578274", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/groupAssign.js:105"}, "properties": {"repobilityId": "05fb375d3536768d", "scanner": "scanner-primary", "fingerprint": "b963bbc75f578274", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/groupAssign.js"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-bcc829ae0730e9a3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/users.js:98"}, "properties": {"repobilityId": "3a9e1594144a45c0", "scanner": "scanner-primary", "fingerprint": "bcc829ae0730e9a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/users.js"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-694e8e250b6f18a6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/zones.js:160"}, "properties": {"repobilityId": "7a1733ec3c85a66b", "scanner": "scanner-primary", "fingerprint": "694e8e250b6f18a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/zones.js"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-cc8b382470157523", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/modules/zoneModify_marquee.js:90"}, "properties": {"repobilityId": "4a5359d327e080be", "scanner": "scanner-primary", "fingerprint": "cc8b382470157523", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/modules/zoneModify_marquee.js"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-7eb47a05bc993b3e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/views/modules/modal.js:33"}, "properties": {"repobilityId": "9277bfe62ebf0ed3", "scanner": "scanner-primary", "fingerprint": "7eb47a05bc993b3e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/views/modules/modal.js"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-7f0329ac74e131d9", "level": "error", "message": {"text": "Possible secret in warp/config.py"}, "properties": {"repobilityId": "83e0d197639eafc1", "scanner": "scanner-primary", "fingerprint": "7f0329ac74e131d9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/config.py"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-766735e55b35e64e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in warp/static/materialize/materialize.min.js:6"}, "properties": {"repobilityId": "4dc235bc6fcad8a5", "scanner": "scanner-primary", "fingerprint": "766735e55b35e64e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/static/materialize/materialize.min.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-8a83de1c6d96d1ac", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in warp/static/materialize/materialize.min.js:6"}, "properties": {"repobilityId": "391326c614a55aa8", "scanner": "scanner-primary", "fingerprint": "8a83de1c6d96d1ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/static/materialize/materialize.min.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-eb67619d288279ae", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in e2e/global-teardown.ts:1"}, "properties": {"repobilityId": "7be59f2084e10150", "scanner": "scanner-primary", "fingerprint": "eb67619d288279ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/global-teardown.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d7f4613ed44fefe", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in e2e/global-setup.ts:1"}, "properties": {"repobilityId": "fe88519c5800749a", "scanner": "scanner-primary", "fingerprint": "9d7f4613ed44fefe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/global-setup.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38722bdee4adbe03", "level": "error", "message": {"text": "Possible secret in e2e/helpers/users.ts"}, "properties": {"repobilityId": "d8e33abe2a68037b", "scanner": "scanner-primary", "fingerprint": "38722bdee4adbe03", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers/users.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-38722bdee4adbe03", "level": "error", "message": {"text": "Possible secret in e2e/helpers/users.ts"}, "properties": {"repobilityId": "d8e33abe2a68037b", "scanner": "scanner-primary", "fingerprint": "38722bdee4adbe03", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers/users.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-38722bdee4adbe03", "level": "error", "message": {"text": "Possible secret in e2e/helpers/users.ts"}, "properties": {"repobilityId": "d8e33abe2a68037b", "scanner": "scanner-primary", "fingerprint": "38722bdee4adbe03", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers/users.ts"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-38722bdee4adbe03", "level": "error", "message": {"text": "Possible secret in e2e/helpers/users.ts"}, "properties": {"repobilityId": "d8e33abe2a68037b", "scanner": "scanner-primary", "fingerprint": "38722bdee4adbe03", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers/users.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-b10efa133fc2ba07", "level": "error", "message": {"text": "Possible secret in e2e/helpers/admin.ts"}, "properties": {"repobilityId": "fe13ed2da42ccaab", "scanner": "scanner-primary", "fingerprint": "b10efa133fc2ba07", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers/admin.ts"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-42081915318e25d7", "level": "error", "message": {"text": "Possible secret in e2e/helpers/db.ts"}, "properties": {"repobilityId": "04a635cdd5d83a08", "scanner": "scanner-primary", "fingerprint": "42081915318e25d7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/helpers/db.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e74e8824fc46ef72", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e8ff6f22c2b1e2a4", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab246c72dbfa9e52", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b1fc7b2d57b0df0", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f001567a57c3c8ef", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "205ae63a5b6d08dc", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e8ff6f22c2b1e2a4", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab246c72dbfa9e52", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-c8064fb84d871725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e74e8824fc46ef72", "scanner": "scanner-primary", "fingerprint": "c8064fb84d871725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-6bbca7f73c5477df", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "7300c46c7c30e094", "scanner": "scanner-primary", "fingerprint": "6bbca7f73c5477df", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/containers.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d7e834080dbebed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fb0624fe856400e8", "scanner": "scanner-primary", "fingerprint": "1d7e834080dbebed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main.yml"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-65c9bd56493a81d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0594fc417402ba44", "scanner": "scanner-primary", "fingerprint": "65c9bd56493a81d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-65c9bd56493a81d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bb76062c68b107cd", "scanner": "scanner-primary", "fingerprint": "65c9bd56493a81d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "980954aa3eb5a0f1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "7063741f54cf1ecc", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "77d8424dc84db63e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a1dd732e04632b35", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "73496e5548e417fd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c1d20e1eac5cdc10", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 setup.py:14"}, "properties": {"repobilityId": "a1cbb4512833daa8", "scanner": "scanner-primary", "fingerprint": "c1d20e1eac5cdc10", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ad6b000473c2e92d", "level": "note", "message": {"text": "Legacy-named symbol `cal_copy` in js/base/base.js:195"}, "properties": {"repobilityId": "0a36e6688bb8ed4f", "scanner": "scanner-primary", "fingerprint": "ad6b000473c2e92d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-379926cdd108d181", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/base/base.js:149"}, "properties": {"repobilityId": "bf9be7914ff7afb7", "scanner": "scanner-primary", "fingerprint": "379926cdd108d181", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b97eb2662efd719a", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/views/modules/zoneModify_marquee.js:217"}, "properties": {"repobilityId": "42491399a12773e5", "scanner": "scanner-primary", "fingerprint": "b97eb2662efd719a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-42e2521ff29adef9", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/views/modules/utils.js:146"}, "properties": {"repobilityId": "a425f781dc60f62a", "scanner": "scanner-primary", "fingerprint": "42e2521ff29adef9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d4b99d0c933535d", "level": "none", "message": {"text": "Commented-code block (5 lines) in warp/db.py:50"}, "properties": {"repobilityId": "ffb04793961896c2", "scanner": "scanner-primary", "fingerprint": "5d4b99d0c933535d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74505160e0b52b55", "level": "none", "message": {"text": "Commented-code block (7 lines) in warp/config.py:89"}, "properties": {"repobilityId": "d86230c72f67872e", "scanner": "scanner-primary", "fingerprint": "74505160e0b52b55", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-369cf8b7f7e0372c", "level": "none", "message": {"text": "Commented-code block (5 lines) in warp/utils.py:44"}, "properties": {"repobilityId": "1e69f542c3eadf95", "scanner": "scanner-primary", "fingerprint": "369cf8b7f7e0372c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea1178f2c7e288ba", "level": "none", "message": {"text": "Commented-code block (8 lines) in warp/xhr/plans.py:170"}, "properties": {"repobilityId": "71798c4848901a7e", "scanner": "scanner-primary", "fingerprint": "ea1178f2c7e288ba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-148475698a77f8fe", "level": "none", "message": {"text": "Commented-code block (8 lines) in warp/xhr/zone.py:14"}, "properties": {"repobilityId": "77c06addc043b79f", "scanner": "scanner-primary", "fingerprint": "148475698a77f8fe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18a5097f82922703", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 e2e/fixtures.ts:12"}, "properties": {"repobilityId": "5f2eff13a4cd030c", "scanner": "scanner-primary", "fingerprint": "18a5097f82922703", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-48e2f1ea832ef2da", "level": "note", "message": {"text": "Legacy-named symbol `tooOld` in e2e/tests/settings/calendar.spec.ts:175"}, "properties": {"repobilityId": "faee1a9c642c0a58", "scanner": "scanner-primary", "fingerprint": "48e2f1ea832ef2da", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a8cc9de8c3adf623", "level": "none", "message": {"text": "Commented-code block (5 lines) in e2e/helpers/db.ts:6"}, "properties": {"repobilityId": "bf3596099eb763e1", "scanner": "scanner-primary", "fingerprint": "a8cc9de8c3adf623", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ce988c4ddf0af3b5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "9846d450489a32bd", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e9906b1b7cddeec5", "level": "error", "message": {"text": "Flask mutation route `set_time_offset` without `@login_required` \u2014 warp/debug.py:20"}, "properties": {"repobilityId": "c1ed46d5e8f55041", "scanner": "scanner-primary", "fingerprint": "e9906b1b7cddeec5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/debug.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-b9aae175573c4204", "level": "error", "message": {"text": "Flask mutation route `login` without `@login_required` \u2014 warp/auth_oidc.py:92"}, "properties": {"repobilityId": "3351157f054c518b", "scanner": "scanner-primary", "fingerprint": "b9aae175573c4204", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/auth_oidc.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-ef037afd8fd3487b", "level": "error", "message": {"text": "Flask mutation route `login` without `@login_required` \u2014 warp/auth_ldap.py:170"}, "properties": {"repobilityId": "1c66d89756c8e292", "scanner": "scanner-primary", "fingerprint": "ef037afd8fd3487b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/auth_ldap.py"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-6229fa888a1821d0", "level": "error", "message": {"text": "Flask mutation route `calendar_post` without `@login_required` \u2014 warp/xhr/calendar.py:83"}, "properties": {"repobilityId": "3d5c56fb25b73070", "scanner": "scanner-primary", "fingerprint": "6229fa888a1821d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/calendar.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-662c09a308ea522c", "level": "error", "message": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/plans.py:16"}, "properties": {"repobilityId": "16e6f8a93c00f618", "scanner": "scanner-primary", "fingerprint": "662c09a308ea522c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/plans.py"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-2836ca1e2ae25bb8", "level": "error", "message": {"text": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/plans.py:87"}, "properties": {"repobilityId": "d661e94572b0a20e", "scanner": "scanner-primary", "fingerprint": "2836ca1e2ae25bb8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/plans.py"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-d73488b4c8d16b23", "level": "error", "message": {"text": "Flask mutation route `addOrEdit` without `@login_required` \u2014 warp/xhr/plans.py:115"}, "properties": {"repobilityId": "6200b2d777c14606", "scanner": "scanner-primary", "fingerprint": "d73488b4c8d16b23", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/plans.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-7fac08cc48c251ae", "level": "error", "message": {"text": "Flask mutation route `modify` without `@login_required` \u2014 warp/xhr/plans.py:179"}, "properties": {"repobilityId": "ba10b97c40967833", "scanner": "scanner-primary", "fingerprint": "7fac08cc48c251ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/plans.py"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-e49d6ba6a9934dfb", "level": "error", "message": {"text": "Flask mutation route `apply` without `@login_required` \u2014 warp/xhr/zone.py:274"}, "properties": {"repobilityId": "5667b086297c0889", "scanner": "scanner-primary", "fingerprint": "e49d6ba6a9934dfb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zone.py"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-a87dc40eeb612f1c", "level": "error", "message": {"text": "Flask mutation route `autoBook` without `@login_required` \u2014 warp/xhr/zone.py:849"}, "properties": {"repobilityId": "5c6b0d152a32307c", "scanner": "scanner-primary", "fingerprint": "a87dc40eeb612f1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zone.py"}, "region": {"startLine": 849}}}]}, {"ruleId": "scanner-8c535a0510810e78", "level": "error", "message": {"text": "Flask mutation route `prefs_set` without `@login_required` \u2014 warp/xhr/prefs.py:78"}, "properties": {"repobilityId": "4f3fcaa9412d1075", "scanner": "scanner-primary", "fingerprint": "8c535a0510810e78", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/prefs.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-7b94150fef8ea3de", "level": "error", "message": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/users.py:11"}, "properties": {"repobilityId": "3e407650f58cf8a2", "scanner": "scanner-primary", "fingerprint": "7b94150fef8ea3de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/users.py"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-6d701aa301451040", "level": "error", "message": {"text": "Flask mutation route `edit` without `@login_required` \u2014 warp/xhr/users.py:54"}, "properties": {"repobilityId": "dcd12f98826a45a6", "scanner": "scanner-primary", "fingerprint": "6d701aa301451040", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/users.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-cd6c82ed933f5c19", "level": "error", "message": {"text": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/users.py:140"}, "properties": {"repobilityId": "4d428c8a740c3449", "scanner": "scanner-primary", "fingerprint": "cd6c82ed933f5c19", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/users.py"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-1539c5f2832db68d", "level": "error", "message": {"text": "Flask mutation route `report` without `@login_required` \u2014 warp/xhr/bookings.py:13"}, "properties": {"repobilityId": "f58dc1fed04d4dcb", "scanner": "scanner-primary", "fingerprint": "1539c5f2832db68d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/bookings.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-72e66bb547ccb0bc", "level": "error", "message": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/bookings.py:50"}, "properties": {"repobilityId": "7a6ef2fd78f8e0bc", "scanner": "scanner-primary", "fingerprint": "72e66bb547ccb0bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/bookings.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-ee05119ec1889c63", "level": "error", "message": {"text": "Flask mutation route `members` without `@login_required` \u2014 warp/xhr/groups.py:17"}, "properties": {"repobilityId": "b41bc73bed3c934b", "scanner": "scanner-primary", "fingerprint": "ee05119ec1889c63", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/groups.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-bb00938b4d3d8ee2", "level": "error", "message": {"text": "Flask mutation route `assign` without `@login_required` \u2014 warp/xhr/groups.py:71"}, "properties": {"repobilityId": "6bb7e5853d9e39f3", "scanner": "scanner-primary", "fingerprint": "bb00938b4d3d8ee2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/groups.py"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-6e5d4d8ce6ee5bf7", "level": "error", "message": {"text": "Flask mutation route `listW` without `@login_required` \u2014 warp/xhr/zones.py:15"}, "properties": {"repobilityId": "6395ead56e402f52", "scanner": "scanner-primary", "fingerprint": "6e5d4d8ce6ee5bf7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zones.py"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-7b8da3a446cbad76", "level": "error", "message": {"text": "Flask mutation route `delete` without `@login_required` \u2014 warp/xhr/zones.py:89"}, "properties": {"repobilityId": "dd266a9a779f17b3", "scanner": "scanner-primary", "fingerprint": "7b8da3a446cbad76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zones.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-01ed6bdbe4fd4979", "level": "error", "message": {"text": "Flask mutation route `addOrEdit` without `@login_required` \u2014 warp/xhr/zones.py:154"}, "properties": {"repobilityId": "0a9296aabf31abed", "scanner": "scanner-primary", "fingerprint": "01ed6bdbe4fd4979", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zones.py"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-7adc86b4fd15ff69", "level": "error", "message": {"text": "Flask mutation route `members` without `@login_required` \u2014 warp/xhr/zones.py:197"}, "properties": {"repobilityId": "7210c32944ad81cf", "scanner": "scanner-primary", "fingerprint": "7adc86b4fd15ff69", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zones.py"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-db2180528b7a47f6", "level": "error", "message": {"text": "Flask mutation route `assign` without `@login_required` \u2014 warp/xhr/zones.py:242"}, "properties": {"repobilityId": "be278574ba6335e2", "scanner": "scanner-primary", "fingerprint": "db2180528b7a47f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "warp/xhr/zones.py"}, "region": {"startLine": 242}}}]}, {"ruleId": "scanner-d8cdbc66dadda834", "level": "error", "message": {"text": "Dangling fetch: GET /xhr/prefs (js/base/base.js:127)"}, "properties": {"repobilityId": "5bf7a08ce9380198", "scanner": "scanner-primary", "fingerprint": "d8cdbc66dadda834", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1ed9b091092799f9", "level": "error", "message": {"text": "Dangling fetch: POST /xhr/prefs (js/base/base.js:149)"}, "properties": {"repobilityId": "a50551535c04d566", "scanner": "scanner-primary", "fingerprint": "1ed9b091092799f9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c8589b9f51faeebe", "level": "error", "message": {"text": "Dangling fetch: GET /xhr/calendar (js/base/base.js:449)"}, "properties": {"repobilityId": "61a46ab45d58a1f7", "scanner": "scanner-primary", "fingerprint": "c8589b9f51faeebe", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-07e8bd0b530d4061", "level": "error", "message": {"text": "Dangling fetch: POST /xhr/calendar (js/base/base.js:462)"}, "properties": {"repobilityId": "8babb2494a3da5c3", "scanner": "scanner-primary", "fingerprint": "07e8bd0b530d4061", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ba351d892794949b", "level": "error", "message": {"text": "Dangling fetch: POST /xhr/calendar (js/base/base.js:484)"}, "properties": {"repobilityId": "d5ea4874ad19694c", "scanner": "scanner-primary", "fingerprint": "ba351d892794949b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "93e7c60300b3914c", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d3250b035cea6ad7", "level": "note", "message": {"text": "Unused endpoint: ANY /bookings/<string:report>"}, "properties": {"repobilityId": "2d0a0cb26f20c494", "scanner": "scanner-primary", "fingerprint": "d3250b035cea6ad7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-096c2e3023f24953", "level": "note", "message": {"text": "Unused endpoint: ANY /bookings"}, "properties": {"repobilityId": "9c078336b1654c77", "scanner": "scanner-primary", "fingerprint": "096c2e3023f24953", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1c42c6e296ba0b7", "level": "note", "message": {"text": "Unused endpoint: ANY /plan/<pid>"}, "properties": {"repobilityId": "4dae13fae68aae6d", "scanner": "scanner-primary", "fingerprint": "f1c42c6e296ba0b7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e030df35dc4f12ee", "level": "note", "message": {"text": "Unused endpoint: ANY /plan/image/<pid>"}, "properties": {"repobilityId": "dbf11eff2aec0ba5", "scanner": "scanner-primary", "fingerprint": "e030df35dc4f12ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-844f255ceef7cc7d", "level": "note", "message": {"text": "Unused endpoint: ANY /users"}, "properties": {"repobilityId": "afc7b4add81fad13", "scanner": "scanner-primary", "fingerprint": "844f255ceef7cc7d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d48ba027d34668b", "level": "note", "message": {"text": "Unused endpoint: ANY /groups"}, "properties": {"repobilityId": "bf1c7f0e2bed1db4", "scanner": "scanner-primary", "fingerprint": "0d48ba027d34668b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-28791337d6106379", "level": "note", "message": {"text": "Unused endpoint: ANY /zones"}, "properties": {"repobilityId": "3fc4929dfc69bb23", "scanner": "scanner-primary", "fingerprint": "28791337d6106379", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aa4d402d8fb02299", "level": "note", "message": {"text": "Unused endpoint: ANY /plans"}, "properties": {"repobilityId": "131fac933971a45f", "scanner": "scanner-primary", "fingerprint": "aa4d402d8fb02299", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-411da5ff43c840cd", "level": "note", "message": {"text": "Unused endpoint: ANY /groups/assign/<group_login>"}, "properties": {"repobilityId": "1deb4111d5934845", "scanner": "scanner-primary", "fingerprint": "411da5ff43c840cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ef65b7b1399a5570", "level": "note", "message": {"text": "Unused endpoint: ANY /zones/assign/<zid>"}, "properties": {"repobilityId": "63a40da54708fca8", "scanner": "scanner-primary", "fingerprint": "ef65b7b1399a5570", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c6266b7428141251", "level": "note", "message": {"text": "Unused endpoint: ANY /plans/modify/<pid>"}, "properties": {"repobilityId": "4cca7c61a9d0f9d1", "scanner": "scanner-primary", "fingerprint": "c6266b7428141251", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c7ad61ba1b23915", "level": "note", "message": {"text": "Unused endpoint: ANY /login"}, "properties": {"repobilityId": "1b5b23075df01932", "scanner": "scanner-primary", "fingerprint": "4c7ad61ba1b23915", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-769d6c3304500084", "level": "note", "message": {"text": "Unused endpoint: ANY /signin-oidc"}, "properties": {"repobilityId": "7ef0f67d57e8f0db", "scanner": "scanner-primary", "fingerprint": "769d6c3304500084", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4504ac13a22a1b1f", "level": "note", "message": {"text": "Unused endpoint: ANY /debug/time"}, "properties": {"repobilityId": "5feac915edc008a2", "scanner": "scanner-primary", "fingerprint": "4504ac13a22a1b1f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d1c8b97537394d4", "level": "note", "message": {"text": "Unused endpoint: ANY /debug/set_time_offset"}, "properties": {"repobilityId": "d8ce9eac3274befb", "scanner": "scanner-primary", "fingerprint": "5d1c8b97537394d4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9db48a6a92c59ef1", "level": "note", "message": {"text": "Unused endpoint: ANY /debug/endpoints"}, "properties": {"repobilityId": "848d6d9515c95e37", "scanner": "scanner-primary", "fingerprint": "9db48a6a92c59ef1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c9e449c3b9e73b73", "level": "note", "message": {"text": "Unused endpoint: ANY /logout"}, "properties": {"repobilityId": "5ab58b07a017d45c", "scanner": "scanner-primary", "fingerprint": "c9e449c3b9e73b73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e2940fb03caa461", "level": "note", "message": {"text": "Unused endpoint: ANY /oidc/start"}, "properties": {"repobilityId": "b34061cfa93f5395", "scanner": "scanner-primary", "fingerprint": "4e2940fb03caa461", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e878ecff0d59c125", "level": "note", "message": {"text": "Unused endpoint: ANY /oidc/callback"}, "properties": {"repobilityId": "62700e47a190177a", "scanner": "scanner-primary", "fingerprint": "e878ecff0d59c125", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-057ea0df0212cd36", "level": "note", "message": {"text": "Unused endpoint: ANY /calendar/<login>/events.ics"}, "properties": {"repobilityId": "01101fd7d7d4085d", "scanner": "scanner-primary", "fingerprint": "057ea0df0212cd36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eae87937c8965b9c", "level": "note", "message": {"text": "Unused endpoint: ANY /calendar/<login>/book"}, "properties": {"repobilityId": "0a1e3f92e92bb969", "scanner": "scanner-primary", "fingerprint": "eae87937c8965b9c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00b15c97548066ed", "level": "note", "message": {"text": "Unused endpoint: ANY /calendar/<login>/delete"}, "properties": {"repobilityId": "df35ab6ac5d1a21e", "scanner": "scanner-primary", "fingerprint": "00b15c97548066ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-16fb83a7ef5afa3b", "level": "note", "message": {"text": "Unused endpoint: ANY /calendar/cancelled"}, "properties": {"repobilityId": "8c3f5f44bb1edc37", "scanner": "scanner-primary", "fingerprint": "16fb83a7ef5afa3b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fc00879f11401d04", "level": "note", "message": {"text": "Unused endpoint: ANY /calendar"}, "properties": {"repobilityId": "7e81eea174ec53b6", "scanner": "scanner-primary", "fingerprint": "fc00879f11401d04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c17bcaa65c711562", "level": "note", "message": {"text": "Unused endpoint: ANY /list"}, "properties": {"repobilityId": "2e31c530c944b973", "scanner": "scanner-primary", "fingerprint": "c17bcaa65c711562", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b23fa5c5cd240ff6", "level": "note", "message": {"text": "Unused endpoint: ANY /delete"}, "properties": {"repobilityId": "6773aa32fa81b2e2", "scanner": "scanner-primary", "fingerprint": "b23fa5c5cd240ff6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b4cf217390b5abf", "level": "note", "message": {"text": "Unused endpoint: ANY /addoredit"}, "properties": {"repobilityId": "89dc67b4fa337082", "scanner": "scanner-primary", "fingerprint": "2b4cf217390b5abf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-867c761e509d10ab", "level": "note", "message": {"text": "Unused endpoint: ANY /getSeats/<int:pid>"}, "properties": {"repobilityId": "4576bdaf77989a82", "scanner": "scanner-primary", "fingerprint": "867c761e509d10ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e6a511bc06c1fdf", "level": "note", "message": {"text": "Unused endpoint: ANY /modify"}, "properties": {"repobilityId": "f0040eb92df6de9b", "scanner": "scanner-primary", "fingerprint": "4e6a511bc06c1fdf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5bef9cacdf8ae374", "level": "note", "message": {"text": "Unused endpoint: ANY /zonesForPlan"}, "properties": {"repobilityId": "02e2f318c8548394", "scanner": "scanner-primary", "fingerprint": "5bef9cacdf8ae374", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00d5ba4ec724c4f7", "level": "note", "message": {"text": "Unused endpoint: ANY /allZones"}, "properties": {"repobilityId": "81eb9fa75f427de0", "scanner": "scanner-primary", "fingerprint": "00d5ba4ec724c4f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b9315cdc4aaabd1", "level": "note", "message": {"text": "Unused endpoint: ANY /apply"}, "properties": {"repobilityId": "8764041342fe62d3", "scanner": "scanner-primary", "fingerprint": "3b9315cdc4aaabd1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ae77b26997455072", "level": "note", "message": {"text": "Unused endpoint: ANY /autoBook/<int:pid>"}, "properties": {"repobilityId": "85a49e70531dc661", "scanner": "scanner-primary", "fingerprint": "ae77b26997455072", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b3fac0ccd4d026f", "level": "note", "message": {"text": "Unused endpoint: ANY /getUsers/<int:pid>"}, "properties": {"repobilityId": "78c9f44e415b3d24", "scanner": "scanner-primary", "fingerprint": "3b3fac0ccd4d026f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72d4076b7d9fbbd1", "level": "note", "message": {"text": "Unused endpoint: ANY /prefs"}, "properties": {"repobilityId": "3243ba6df72ac9fc", "scanner": "scanner-primary", "fingerprint": "72d4076b7d9fbbd1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c7052868335447ec", "level": "note", "message": {"text": "Unused endpoint: ANY /edit"}, "properties": {"repobilityId": "590aaf32d0db1e76", "scanner": "scanner-primary", "fingerprint": "c7052868335447ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b3f7eae9c418e28", "level": "note", "message": {"text": "Unused endpoint: ANY /groups/<login>"}, "properties": {"repobilityId": "e955d3b4813c5387", "scanner": "scanner-primary", "fingerprint": "0b3f7eae9c418e28", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a7ba4be6a94cc362", "level": "note", "message": {"text": "Unused endpoint: ANY /report"}, "properties": {"repobilityId": "8f28d34b23eb2906", "scanner": "scanner-primary", "fingerprint": "a7ba4be6a94cc362", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dc4abab8a997ed32", "level": "note", "message": {"text": "Unused endpoint: ANY /members"}, "properties": {"repobilityId": "d0c8614940550b67", "scanner": "scanner-primary", "fingerprint": "dc4abab8a997ed32", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47588f2e9b759517", "level": "note", "message": {"text": "Unused endpoint: ANY /assign"}, "properties": {"repobilityId": "ac93c2bf0a68d308", "scanner": "scanner-primary", "fingerprint": "47588f2e9b759517", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-88e7f36df43aff1e", "level": "note", "message": {"text": "Unused endpoint: ANY /names"}, "properties": {"repobilityId": "c08e35048fc90bb7", "scanner": "scanner-primary", "fingerprint": "88e7f36df43aff1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}