{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-759e8e9b9a8ee846", "name": "Possibly dead Python function: lut_mono", "shortDescription": {"text": "Possibly dead Python function: lut_mono"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c42e745771ecae8", "name": "Possibly dead Python function: lut_silvertone", "shortDescription": {"text": "Possibly dead Python function: lut_silvertone"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f73ed0d54d00167d", "name": "Possibly dead Python function: lut_noir", "shortDescription": {"text": "Possibly dead Python function: lut_noir"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0f350395fe5941a", "name": "Possibly dead Python function: lut_vivid_warm", "shortDescription": {"text": "Possibly dead Python function: lut_vivid_warm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d99e974b67e5922f", "name": "Possibly dead Python function: lut_vivid_cool", "shortDescription": {"text": "Possibly dead Python function: lut_vivid_cool"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-319466eb0f1d54aa", "name": "Possibly dead Python function: lut_dramatic_warm", "shortDescription": {"text": "Possibly dead Python function: lut_dramatic_warm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bdbc63f1868609e", "name": "Possibly dead Python function: lut_dramatic_cool", "shortDescription": {"text": "Possibly dead Python function: lut_dramatic_cool"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea528afc0203eb41", "name": "Insecure pattern 'cors_wildcard' in infra/render-server/main.py:54", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in infra/render-server/main.py:54"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b060463cdd3ed727", "name": "Insecure pattern 'direct_innerhtml_assignment' in mockups/theme-cyberpunk.html:1820", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/theme-cyberpunk.html:1820"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf4f230d263a4d92", "name": "Insecure pattern 'direct_innerhtml_assignment' in mockups/trending-tab.html:556", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/trending-tab.html:556"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e1443c4b542183c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c02c3f64bd103ebd", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 6 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 13 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2eca6270e555e68", "name": "Commented-code block (5 lines) in scripts/refresh-ios-pool.py:64", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/refresh-ios-pool.py:64"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4c95e4bcd41f39ab", "name": "Legacy-named symbol `_purge_old` in infra/render-server/main.py:63", "shortDescription": {"text": "Legacy-named symbol `_purge_old` in infra/render-server/main.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47a5fb36b1522546", "name": "Commented-code block (15 lines) in infra/render-server/main.py:81", "shortDescription": {"text": "Commented-code block (15 lines) in infra/render-server/main.py:81"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b7b0994d664b5abe", "name": "FastAPI POST `render` without auth dependency \u2014 infra/render-server/main.py:373", "shortDescription": {"text": "FastAPI POST `render` without auth dependency \u2014 infra/render-server/main.py:373"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f05b18a4041916f", "name": "Unused endpoint: POST /render", "shortDescription": {"text": "Unused endpoint: POST /render"}, "fullDescription": {"text": "`infra/render-server/main.py` declares `POST /render` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19278"}, "properties": {"repository": "seraphimmgmt/Snapchat-editor", "repoUrl": "https://github.com/seraphimmgmt/Snapchat-editor", "branch": "main"}, "results": [{"ruleId": "scanner-759e8e9b9a8ee846", "level": "note", "message": {"text": "Possibly dead Python function: lut_mono"}, "properties": {"repobilityId": "4b6146a170bb2b04", "scanner": "scanner-primary", "fingerprint": "759e8e9b9a8ee846", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c42e745771ecae8", "level": "note", "message": {"text": "Possibly dead Python function: lut_silvertone"}, "properties": {"repobilityId": "b33245bcdc546bdf", "scanner": "scanner-primary", "fingerprint": "0c42e745771ecae8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f73ed0d54d00167d", "level": "note", "message": {"text": "Possibly dead Python function: lut_noir"}, "properties": {"repobilityId": "6b09425a7dbad500", "scanner": "scanner-primary", "fingerprint": "f73ed0d54d00167d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:85"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0f350395fe5941a", "level": "note", "message": {"text": "Possibly dead Python function: lut_vivid_warm"}, "properties": {"repobilityId": "693078fbac258a6f", "scanner": "scanner-primary", "fingerprint": "a0f350395fe5941a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:95"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d99e974b67e5922f", "level": "note", "message": {"text": "Possibly dead Python function: lut_vivid_cool"}, "properties": {"repobilityId": "268ac314fe6300f9", "scanner": "scanner-primary", "fingerprint": "d99e974b67e5922f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-319466eb0f1d54aa", "level": "note", "message": {"text": "Possibly dead Python function: lut_dramatic_warm"}, "properties": {"repobilityId": "ea2ba8168c9948e3", "scanner": "scanner-primary", "fingerprint": "319466eb0f1d54aa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:108"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2bdbc63f1868609e", "level": "note", "message": {"text": "Possibly dead Python function: lut_dramatic_cool"}, "properties": {"repobilityId": "68c0515d399660ff", "scanner": "scanner-primary", "fingerprint": "2bdbc63f1868609e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/build_luts.py:112"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ea528afc0203eb41", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in infra/render-server/main.py:54"}, "properties": {"repobilityId": "3c0ebedb7ce2dbda", "scanner": "scanner-primary", "fingerprint": "ea528afc0203eb41", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/main.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-b060463cdd3ed727", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/theme-cyberpunk.html:1820"}, "properties": {"repobilityId": "e03e7c6410837c2f", "scanner": "scanner-primary", "fingerprint": "b060463cdd3ed727", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mockups/theme-cyberpunk.html"}, "region": {"startLine": 1820}}}]}, {"ruleId": "scanner-bf4f230d263a4d92", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/trending-tab.html:556"}, "properties": {"repobilityId": "6f1bc045c478fc65", "scanner": "scanner-primary", "fingerprint": "bf4f230d263a4d92", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mockups/trending-tab.html"}, "region": {"startLine": 556}}}]}, {"ruleId": "scanner-6e1443c4b542183c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "880902cd53dc9aeb", "scanner": "scanner-primary", "fingerprint": "6e1443c4b542183c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-ios-pool.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-6e1443c4b542183c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b59006c29a846332", "scanner": "scanner-primary", "fingerprint": "6e1443c4b542183c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-ios-pool.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-6e1443c4b542183c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c0308b33031b41ea", "scanner": "scanner-primary", "fingerprint": "6e1443c4b542183c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-ios-pool.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-c02c3f64bd103ebd", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "422ab4138a4540ac", "scanner": "scanner-primary", "fingerprint": "c02c3f64bd103ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-ios-pool.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "064101bca44dd360", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "02d17bc6b90f3ad7", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b3aadd75f1154740", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "970937e993e9aaab", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a14cae881368ed8f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7894f8065a17b33f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f2eca6270e555e68", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/refresh-ios-pool.py:64"}, "properties": {"repobilityId": "0eaa3728c83c86ec", "scanner": "scanner-primary", "fingerprint": "f2eca6270e555e68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4c95e4bcd41f39ab", "level": "note", "message": {"text": "Legacy-named symbol `_purge_old` in infra/render-server/main.py:63"}, "properties": {"repobilityId": "aa1d68fd7b05a5cb", "scanner": "scanner-primary", "fingerprint": "4c95e4bcd41f39ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-47a5fb36b1522546", "level": "none", "message": {"text": "Commented-code block (15 lines) in infra/render-server/main.py:81"}, "properties": {"repobilityId": "350551031b9eaf7b", "scanner": "scanner-primary", "fingerprint": "47a5fb36b1522546", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b7b0994d664b5abe", "level": "error", "message": {"text": "FastAPI POST `render` without auth dependency \u2014 infra/render-server/main.py:373"}, "properties": {"repobilityId": "b95e5c165962ef75", "scanner": "scanner-primary", "fingerprint": "b7b0994d664b5abe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/render-server/main.py"}, "region": {"startLine": 373}}}]}, {"ruleId": "scanner-0f05b18a4041916f", "level": "note", "message": {"text": "Unused endpoint: POST /render"}, "properties": {"repobilityId": "aabe5962f1b26a1e", "scanner": "scanner-primary", "fingerprint": "0f05b18a4041916f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}