{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e407f35687c0510c", "name": "Stray `console.log` in TS/JS \u2014 src/api/server.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/api/server.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd167fbf138423d9", "name": "Stray `console.log` in TS/JS \u2014 src/scripts/create-user.ts:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/create-user.ts:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da09b855760193a5", "name": "Stray `console.log` in TS/JS \u2014 src/scripts/migrate-leads-from-amocrm.ts:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/migrate-leads-from-amocrm.ts:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2a1fde5d825adbe", "name": "Stray `console.log` in TS/JS \u2014 src/scripts/load-local.ts:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/load-local.ts:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bca5ec885104419", "name": "Stray `console.log` in TS/JS \u2014 src/scripts/migrate-from-amocrm.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/migrate-from-amocrm.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d7711e6d01430f7", "name": "Stray `console.log` in TS/JS \u2014 src/scripts/seed-valuation-comps.ts:191", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/seed-valuation-comps.ts:191"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b87ba7e19ab7d051", "name": "Stray `console.log` in TS/JS \u2014 src/lib/cutover.ts:75", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/cutover.ts:75"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fb57b79ca8d4003", "name": "Stray `console.log` in TS/JS \u2014 src/lib/load-leads.ts:122", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/load-leads.ts:122"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c23f102861f0328d", "name": "Stray `console.log` in TS/JS \u2014 src/lib/load.ts:112", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/load.ts:112"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-835eae4c7f17a2f8", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1c65ae021278f96", "name": "Insecure pattern 'cors_wildcard' in api/index.js:2340", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/index.js:2340"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04fc7977eab33c2b", "name": "Insecure pattern 'cors_wildcard' in src/api/app.ts:68", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/api/app.ts:68"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba268eedeca5ee82", "name": "Very large file: api/index.js (2733 lines)", "shortDescription": {"text": "Very large file: api/index.js (2733 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 32 source file(s) (ratio 0.03). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 44 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7602ac1e640e2f96", "name": "`fetch()` without try/.catch or AbortSignal \u2014 api/index.js:2079", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/index.js:2079"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4e04d1519a86d30", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/scripts/migrate-leads-from-amocrm.ts:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/scripts/migrate-leads-from-amocrm.ts:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d539a5bc24f21faf", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/contact-bot.ts:78", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/contact-bot.ts:78"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00c4f835ff183fc8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/amocrm-source.ts:33", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/amocrm-source.ts:33"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9fd1ef5a3a5ab8c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/amocrm-leads-source.ts:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/amocrm-leads-source.ts:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a311777cc046267a", "name": "Commented-code block (6 lines) in src/lib/queries.ts:44", "shortDescription": {"text": "Commented-code block (6 lines) in src/lib/queries.ts:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc9672dab22c4336", "name": "Commented-code block (10 lines) in src/db/schema.ts:490", "shortDescription": {"text": "Commented-code block (10 lines) in src/db/schema.ts:490"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc0f9d8e41b33b0e", "name": "11 env vars used in code but missing from .env.example", "shortDescription": {"text": "11 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANTHROPIC_API_KEY`, `ANTHROPIC_MODEL`, `API_PORT`, `API_TOKEN`, `CRON_SECRET`, `PGLITE_DIR`, `SITE_BASE_URL`, `TG_CONTACT_BOT_TOKEN` + 3 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-456dd58d71876324", "name": "Dangling fetch: POST https://api.telegram.org/bot${cfg.token}/${method} (api/index.js:2079)", "shortDescription": {"text": "Dangling fetch: POST https://api.telegram.org/bot${cfg.token}/${method} (api/index.js:2079)"}, "fullDescription": {"text": "`api/index.js:2079` calls `POST https://api.telegram.org/bot${cfg.token}/${method}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.telegram.org/bot/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b9bf07ac23645214", "name": "Dangling fetch: POST https://api.telegram.org/bot${cfg.token}/${method} (src/lib/contact-bot.ts:78)", "shortDescription": {"text": "Dangling fetch: POST https://api.telegram.org/bot${cfg.token}/${method} (src/lib/contact-bot.ts:78)"}, "fullDescription": {"text": "`src/lib/contact-bot.ts:78` calls `POST https://api.telegram.org/bot${cfg.token}/${method}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.telegram.org/bot/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6935c0ed1bc022ef", "name": "Dangling fetch: GET https://${DOMAIN}/api/v4${path} (src/lib/amocrm-leads-source.ts:29)", "shortDescription": {"text": "Dangling fetch: GET https://${DOMAIN}/api/v4${path} (src/lib/amocrm-leads-source.ts:29)"}, "fullDescription": {"text": "`src/lib/amocrm-leads-source.ts:29` calls `GET https://${DOMAIN}/api/v4${path}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/<p>/api/v4/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3abf952b8d28d710", "name": "Unused endpoint: USE /*", "shortDescription": {"text": "Unused endpoint: USE /*"}, "fullDescription": {"text": "`api/index.js` declares `USE /*` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-687d5cf4bdc792d1", "name": "Unused endpoint: POST /telegram/contact", "shortDescription": {"text": "Unused endpoint: POST /telegram/contact"}, "fullDescription": {"text": "`api/index.js` declares `POST /telegram/contact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fb53b44fbb1141c", "name": "Unused endpoint: GET /telegram/selfcheck", "shortDescription": {"text": "Unused endpoint: GET /telegram/selfcheck"}, "fullDescription": {"text": "`api/index.js` declares `GET /telegram/selfcheck` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fdbacfe9430a6ed", "name": "Unused endpoint: POST /auth/login", "shortDescription": {"text": "Unused endpoint: POST /auth/login"}, "fullDescription": {"text": "`api/index.js` declares `POST /auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-438e9d3bb87fa409", "name": "Unused endpoint: GET /objects", "shortDescription": {"text": "Unused endpoint: GET /objects"}, "fullDescription": {"text": "`api/index.js` declares `GET /objects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68ebcdfc37c566cd", "name": "Unused endpoint: GET /objects/all", "shortDescription": {"text": "Unused endpoint: GET /objects/all"}, "fullDescription": {"text": "`api/index.js` declares `GET /objects/all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2af78fd4c1a99511", "name": "Unused endpoint: GET /objects/recent-matches", "shortDescription": {"text": "Unused endpoint: GET /objects/recent-matches"}, "fullDescription": {"text": "`api/index.js` declares `GET /objects/recent-matches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e476ec3638f3a96d", "name": "Unused endpoint: GET /objects/:rw", "shortDescription": {"text": "Unused endpoint: GET /objects/:rw"}, "fullDescription": {"text": "`api/index.js` declares `GET /objects/:rw` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8cb94a93b8c6de3", "name": "Unused endpoint: POST /objects", "shortDescription": {"text": "Unused endpoint: POST /objects"}, "fullDescription": {"text": "`api/index.js` declares `POST /objects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c0df8c971c114cd", "name": "Unused endpoint: PATCH /objects/:rw", "shortDescription": {"text": "Unused endpoint: PATCH /objects/:rw"}, "fullDescription": {"text": "`api/index.js` declares `PATCH /objects/:rw` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8752455a3a1fc1d", "name": "Unused endpoint: POST /objects/:rw/photos", "shortDescription": {"text": "Unused endpoint: POST /objects/:rw/photos"}, "fullDescription": {"text": "`api/index.js` declares `POST /objects/:rw/photos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-417189a27da21531", "name": "Unused endpoint: POST /track/view", "shortDescription": {"text": "Unused endpoint: POST /track/view"}, "fullDescription": {"text": "`api/index.js` declares `POST /track/view` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-899bd4857526da1c", "name": "Unused endpoint: GET /views/summary", "shortDescription": {"text": "Unused endpoint: GET /views/summary"}, "fullDescription": {"text": "`api/index.js` declares `GET /views/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e89104d8a03d3ca9", "name": "Unused endpoint: GET /views/cross-shoppers", "shortDescription": {"text": "Unused endpoint: GET /views/cross-shoppers"}, "fullDescription": {"text": "`api/index.js` declares `GET /views/cross-shoppers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-890573b815f63b4a", "name": "Unused endpoint: POST /track/event", "shortDescription": {"text": "Unused endpoint: POST /track/event"}, "fullDescription": {"text": "`api/index.js` declares `POST /track/event` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ff1fa7e201e0446", "name": "Unused endpoint: GET /events/summary", "shortDescription": {"text": "Unused endpoint: GET /events/summary"}, "fullDescription": {"text": "`api/index.js` declares `GET /events/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88ff450e117c0de6", "name": "Unused endpoint: POST /track/referral", "shortDescription": {"text": "Unused endpoint: POST /track/referral"}, "fullDescription": {"text": "`api/index.js` declares `POST /track/referral` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec672336e589fcd2", "name": "Unused endpoint: GET /referrals/summary", "shortDescription": {"text": "Unused endpoint: GET /referrals/summary"}, "fullDescription": {"text": "`api/index.js` declares `GET /referrals/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-482d57ff64eb9db5", "name": "Unused endpoint: POST /track/search", "shortDescription": {"text": "Unused endpoint: POST /track/search"}, "fullDescription": {"text": "`api/index.js` declares `POST /track/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-889f03606689fcbb", "name": "Unused endpoint: GET /demand/summary", "shortDescription": {"text": "Unused endpoint: GET /demand/summary"}, "fullDescription": {"text": "`api/index.js` declares `GET /demand/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52c40df350200e83", "name": "Unused endpoint: POST /leads", "shortDescription": {"text": "Unused endpoint: POST /leads"}, "fullDescription": {"text": "`api/index.js` declares `POST /leads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb19a2be7a6629c", "name": "Unused endpoint: GET /leads", "shortDescription": {"text": "Unused endpoint: GET /leads"}, "fullDescription": {"text": "`api/index.js` declares `GET /leads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2748808021f259ec", "name": "Unused endpoint: GET /pipelines", "shortDescription": {"text": "Unused endpoint: GET /pipelines"}, "fullDescription": {"text": "`api/index.js` declares `GET /pipelines` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43269e4e79c2e69e", "name": "Unused endpoint: GET /events", "shortDescription": {"text": "Unused endpoint: GET /events"}, "fullDescription": {"text": "`api/index.js` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08877a04d68bc5f3", "name": "Unused endpoint: PATCH /leads/:id", "shortDescription": {"text": "Unused endpoint: PATCH /leads/:id"}, "fullDescription": {"text": "`api/index.js` declares `PATCH /leads/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81f77f242670cb45", "name": "Unused endpoint: GET /leads/:id", "shortDescription": {"text": "Unused endpoint: GET /leads/:id"}, "fullDescription": {"text": "`api/index.js` declares `GET /leads/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-512ccb0fd0b230ba", "name": "Unused endpoint: GET /settings", "shortDescription": {"text": "Unused endpoint: GET /settings"}, "fullDescription": {"text": "`api/index.js` declares `GET /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d16b1a1e2dd23ce7", "name": "Unused endpoint: GET /settings/:key", "shortDescription": {"text": "Unused endpoint: GET /settings/:key"}, "fullDescription": {"text": "`api/index.js` declares `GET /settings/:key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1388e7c08fe550cc", "name": "Unused endpoint: PUT /settings/:key", "shortDescription": {"text": "Unused endpoint: PUT /settings/:key"}, "fullDescription": {"text": "`api/index.js` declares `PUT /settings/:key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bd78be526f19cd9", "name": "Unused endpoint: PATCH /leads/:id/contact", "shortDescription": {"text": "Unused endpoint: PATCH /leads/:id/contact"}, "fullDescription": {"text": "`api/index.js` declares `PATCH /leads/:id/contact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c6424c6519b9691", "name": "Unused endpoint: DELETE /leads/:id", "shortDescription": {"text": "Unused endpoint: DELETE /leads/:id"}, "fullDescription": {"text": "`api/index.js` declares `DELETE /leads/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbb81b115043941f", "name": "Unused endpoint: POST /leads/:id/notes", "shortDescription": {"text": "Unused endpoint: POST /leads/:id/notes"}, "fullDescription": {"text": "`api/index.js` declares `POST /leads/:id/notes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50ef66f39fef1d23", "name": "Unused endpoint: POST /leads/:id/tasks", "shortDescription": {"text": "Unused endpoint: POST /leads/:id/tasks"}, "fullDescription": {"text": "`api/index.js` declares `POST /leads/:id/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b733c4d25decb64", "name": "Unused endpoint: PATCH /leads/:id/deal-checklist", "shortDescription": {"text": "Unused endpoint: PATCH /leads/:id/deal-checklist"}, "fullDescription": {"text": "`api/index.js` declares `PATCH /leads/:id/deal-checklist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4c3390024135dc8", "name": "Unused endpoint: PATCH /tasks/:id", "shortDescription": {"text": "Unused endpoint: PATCH /tasks/:id"}, "fullDescription": {"text": "`api/index.js` declares `PATCH /tasks/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd0e06afbaab19b3", "name": "Unused endpoint: GET /tasks", "shortDescription": {"text": "Unused endpoint: GET /tasks"}, "fullDescription": {"text": "`api/index.js` declares `GET /tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6327e7d63f12d827", "name": "Unused endpoint: GET /contacts", "shortDescription": {"text": "Unused endpoint: GET /contacts"}, "fullDescription": {"text": "`api/index.js` declares `GET /contacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56c76afbccd7686b", "name": "Unused endpoint: POST /contacts/merge", "shortDescription": {"text": "Unused endpoint: POST /contacts/merge"}, "fullDescription": {"text": "`api/index.js` declares `POST /contacts/merge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89ae0c205a8b79ad", "name": "Unused endpoint: POST /leads/:id/touch", "shortDescription": {"text": "Unused endpoint: POST /leads/:id/touch"}, "fullDescription": {"text": "`api/index.js` declares `POST /leads/:id/touch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-798f203c5b35860b", "name": "Unused endpoint: POST /leads/:id/shortlist-view", "shortDescription": {"text": "Unused endpoint: POST /leads/:id/shortlist-view"}, "fullDescription": {"text": "`api/index.js` declares `POST /leads/:id/shortlist-view` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8f3d8aecd30d9dd", "name": "Unused endpoint: GET /articles", "shortDescription": {"text": "Unused endpoint: GET /articles"}, "fullDescription": {"text": "`api/index.js` declares `GET /articles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81deed20ed5eb5af", "name": "Unused endpoint: GET /articles/pending-count", "shortDescription": {"text": "Unused endpoint: GET /articles/pending-count"}, "fullDescription": {"text": "`api/index.js` declares `GET /articles/pending-count` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-056a1c7e1f8ae906", "name": "Unused endpoint: GET /articles/slug/:slug", "shortDescription": {"text": "Unused endpoint: GET /articles/slug/:slug"}, "fullDescription": {"text": "`api/index.js` declares `GET /articles/slug/:slug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f67f801ef6c68460", "name": "Unused endpoint: GET /articles/:id", "shortDescription": {"text": "Unused endpoint: GET /articles/:id"}, "fullDescription": {"text": "`api/index.js` declares `GET /articles/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a2d53021b410f23", "name": "Unused endpoint: POST /articles", "shortDescription": {"text": "Unused endpoint: POST /articles"}, "fullDescription": {"text": "`api/index.js` declares `POST /articles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-805840ed982722fd", "name": "Unused endpoint: PATCH /articles/:id", "shortDescription": {"text": "Unused endpoint: PATCH /articles/:id"}, "fullDescription": {"text": "`api/index.js` declares `PATCH /articles/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45364cce6c34fc3e", "name": "Unused endpoint: DELETE /articles/:id", "shortDescription": {"text": "Unused endpoint: DELETE /articles/:id"}, "fullDescription": {"text": "`api/index.js` declares `DELETE /articles/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5a71f7d3b682b67", "name": "Unused endpoint: GET /valuation/factors", "shortDescription": {"text": "Unused endpoint: GET /valuation/factors"}, "fullDescription": {"text": "`api/index.js` declares `GET /valuation/factors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb33412d8da65082", "name": "Unused endpoint: PUT /valuation/factors", "shortDescription": {"text": "Unused endpoint: PUT /valuation/factors"}, "fullDescription": {"text": "`api/index.js` declares `PUT /valuation/factors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bda9136e138df928", "name": "Unused endpoint: GET /valuation/comps", "shortDescription": {"text": "Unused endpoint: GET /valuation/comps"}, "fullDescription": {"text": "`api/index.js` declares `GET /valuation/comps` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18154"}, "properties": {"repository": "right-way-phangan/backend", "repoUrl": "https://github.com/right-way-phangan/backend", "branch": "main"}, "results": [{"ruleId": "scanner-e407f35687c0510c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/api/server.ts:15"}, "properties": {"repobilityId": "7542565750146616", "scanner": "scanner-primary", "fingerprint": "e407f35687c0510c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cd167fbf138423d9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/create-user.ts:18"}, "properties": {"repobilityId": "c1621154af8dfc1c", "scanner": "scanner-primary", "fingerprint": "cd167fbf138423d9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-da09b855760193a5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/migrate-leads-from-amocrm.ts:46"}, "properties": {"repobilityId": "21b1553dde263542", "scanner": "scanner-primary", "fingerprint": "da09b855760193a5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c2a1fde5d825adbe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/load-local.ts:24"}, "properties": {"repobilityId": "ee90a17b11ee5450", "scanner": "scanner-primary", "fingerprint": "c2a1fde5d825adbe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9bca5ec885104419", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/migrate-from-amocrm.ts:32"}, "properties": {"repobilityId": "0d1a1057c3a9afb0", "scanner": "scanner-primary", "fingerprint": "9bca5ec885104419", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5d7711e6d01430f7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/scripts/seed-valuation-comps.ts:191"}, "properties": {"repobilityId": "d13a6449d74aad33", "scanner": "scanner-primary", "fingerprint": "5d7711e6d01430f7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b87ba7e19ab7d051", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/cutover.ts:75"}, "properties": {"repobilityId": "055702654a92d3cb", "scanner": "scanner-primary", "fingerprint": "b87ba7e19ab7d051", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2fb57b79ca8d4003", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/load-leads.ts:122"}, "properties": {"repobilityId": "34cb4062225a3573", "scanner": "scanner-primary", "fingerprint": "2fb57b79ca8d4003", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c23f102861f0328d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/lib/load.ts:112"}, "properties": {"repobilityId": "298cf1830cf72acc", "scanner": "scanner-primary", "fingerprint": "c23f102861f0328d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-835eae4c7f17a2f8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "d47593c20ef7b8bb", "scanner": "scanner-primary", "fingerprint": "835eae4c7f17a2f8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b1c65ae021278f96", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/index.js:2340"}, "properties": {"repobilityId": "47b85d77551ff262", "scanner": "scanner-primary", "fingerprint": "b1c65ae021278f96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/index.js"}, "region": {"startLine": 2340}}}]}, {"ruleId": "scanner-04fc7977eab33c2b", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/api/app.ts:68"}, "properties": {"repobilityId": "8f961389158f1388", "scanner": "scanner-primary", "fingerprint": "04fc7977eab33c2b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/api/app.ts"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ba268eedeca5ee82", "level": "note", "message": {"text": "Very large file: api/index.js (2733 lines)"}, "properties": {"repobilityId": "7155b63f09aa0c4e", "scanner": "scanner-primary", "fingerprint": "ba268eedeca5ee82", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "31bf06bd2e07e8a8", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b00a0c26173569ae", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "d24c869fa5412576", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "71e82408756b8327", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7610358b736d4b5c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7602ac1e640e2f96", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 api/index.js:2079"}, "properties": {"repobilityId": "3dc7d946367765f5", "scanner": "scanner-primary", "fingerprint": "7602ac1e640e2f96", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c4e04d1519a86d30", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/scripts/migrate-leads-from-amocrm.ts:6"}, "properties": {"repobilityId": "0d9e744b58846129", "scanner": "scanner-primary", "fingerprint": "c4e04d1519a86d30", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d539a5bc24f21faf", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/contact-bot.ts:78"}, "properties": {"repobilityId": "3179c751e7e9175c", "scanner": "scanner-primary", "fingerprint": "d539a5bc24f21faf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-00c4f835ff183fc8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/amocrm-source.ts:33"}, "properties": {"repobilityId": "3dba5717e09fbdf7", "scanner": "scanner-primary", "fingerprint": "00c4f835ff183fc8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b9fd1ef5a3a5ab8c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/amocrm-leads-source.ts:29"}, "properties": {"repobilityId": "7275639837e75c97", "scanner": "scanner-primary", "fingerprint": "b9fd1ef5a3a5ab8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a311777cc046267a", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/lib/queries.ts:44"}, "properties": {"repobilityId": "268be52fafd7760a", "scanner": "scanner-primary", "fingerprint": "a311777cc046267a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc9672dab22c4336", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/db/schema.ts:490"}, "properties": {"repobilityId": "ad6301d5fd959e9e", "scanner": "scanner-primary", "fingerprint": "fc9672dab22c4336", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc0f9d8e41b33b0e", "level": "note", "message": {"text": "11 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "c82cd8cd626c3599", "scanner": "scanner-primary", "fingerprint": "cc0f9d8e41b33b0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-456dd58d71876324", "level": "error", "message": {"text": "Dangling fetch: POST https://api.telegram.org/bot${cfg.token}/${method} (api/index.js:2079)"}, "properties": {"repobilityId": "402fd935e4fb1918", "scanner": "scanner-primary", "fingerprint": "456dd58d71876324", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b9bf07ac23645214", "level": "error", "message": {"text": "Dangling fetch: POST https://api.telegram.org/bot${cfg.token}/${method} (src/lib/contact-bot.ts:78)"}, "properties": {"repobilityId": "2d738272a6fbebd6", "scanner": "scanner-primary", "fingerprint": "b9bf07ac23645214", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6935c0ed1bc022ef", "level": "error", "message": {"text": "Dangling fetch: GET https://${DOMAIN}/api/v4${path} (src/lib/amocrm-leads-source.ts:29)"}, "properties": {"repobilityId": "0aa7079920a2ee4a", "scanner": "scanner-primary", "fingerprint": "6935c0ed1bc022ef", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3abf952b8d28d710", "level": "note", "message": {"text": "Unused endpoint: USE /*"}, "properties": {"repobilityId": "36b40b060808e564", "scanner": "scanner-primary", "fingerprint": "3abf952b8d28d710", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-687d5cf4bdc792d1", "level": "note", "message": {"text": "Unused endpoint: POST /telegram/contact"}, "properties": {"repobilityId": "99d8d8389e15c2aa", "scanner": "scanner-primary", "fingerprint": "687d5cf4bdc792d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7fb53b44fbb1141c", "level": "note", "message": {"text": "Unused endpoint: GET /telegram/selfcheck"}, "properties": {"repobilityId": "d8a8e2fc927b1c1c", "scanner": "scanner-primary", "fingerprint": "7fb53b44fbb1141c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8fdbacfe9430a6ed", "level": "note", "message": {"text": "Unused endpoint: POST /auth/login"}, "properties": {"repobilityId": "7e5a3f8e61545d16", "scanner": "scanner-primary", "fingerprint": "8fdbacfe9430a6ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-438e9d3bb87fa409", "level": "note", "message": {"text": "Unused endpoint: GET /objects"}, "properties": {"repobilityId": "4f19a1a9f5e7b2bd", "scanner": "scanner-primary", "fingerprint": "438e9d3bb87fa409", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68ebcdfc37c566cd", "level": "note", "message": {"text": "Unused endpoint: GET /objects/all"}, "properties": {"repobilityId": "321fd5523ea201ce", "scanner": "scanner-primary", "fingerprint": "68ebcdfc37c566cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2af78fd4c1a99511", "level": "note", "message": {"text": "Unused endpoint: GET /objects/recent-matches"}, "properties": {"repobilityId": "65603bde8ae0113e", "scanner": "scanner-primary", "fingerprint": "2af78fd4c1a99511", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e476ec3638f3a96d", "level": "note", "message": {"text": "Unused endpoint: GET /objects/:rw"}, "properties": {"repobilityId": "8a66f28d74575a78", "scanner": "scanner-primary", "fingerprint": "e476ec3638f3a96d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8cb94a93b8c6de3", "level": "note", "message": {"text": "Unused endpoint: POST /objects"}, "properties": {"repobilityId": "5662a557476e25a6", "scanner": "scanner-primary", "fingerprint": "b8cb94a93b8c6de3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c0df8c971c114cd", "level": "note", "message": {"text": "Unused endpoint: PATCH /objects/:rw"}, "properties": {"repobilityId": "e0bd910ed3e1522a", "scanner": "scanner-primary", "fingerprint": "6c0df8c971c114cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a8752455a3a1fc1d", "level": "note", "message": {"text": "Unused endpoint: POST /objects/:rw/photos"}, "properties": {"repobilityId": "c7c8989d77a8217f", "scanner": "scanner-primary", "fingerprint": "a8752455a3a1fc1d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-417189a27da21531", "level": "note", "message": {"text": "Unused endpoint: POST /track/view"}, "properties": {"repobilityId": "db2e19f31e7affc5", "scanner": "scanner-primary", "fingerprint": "417189a27da21531", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-899bd4857526da1c", "level": "note", "message": {"text": "Unused endpoint: GET /views/summary"}, "properties": {"repobilityId": "18eccf320b2555cc", "scanner": "scanner-primary", "fingerprint": "899bd4857526da1c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e89104d8a03d3ca9", "level": "note", "message": {"text": "Unused endpoint: GET /views/cross-shoppers"}, "properties": {"repobilityId": "a4cbd2bfced22db7", "scanner": "scanner-primary", "fingerprint": "e89104d8a03d3ca9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-890573b815f63b4a", "level": "note", "message": {"text": "Unused endpoint: POST /track/event"}, "properties": {"repobilityId": "54abf61b0d3b393f", "scanner": "scanner-primary", "fingerprint": "890573b815f63b4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ff1fa7e201e0446", "level": "note", "message": {"text": "Unused endpoint: GET /events/summary"}, "properties": {"repobilityId": "d57422889cac9a6a", "scanner": "scanner-primary", "fingerprint": "7ff1fa7e201e0446", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-88ff450e117c0de6", "level": "note", "message": {"text": "Unused endpoint: POST /track/referral"}, "properties": {"repobilityId": "05f1acadff52950f", "scanner": "scanner-primary", "fingerprint": "88ff450e117c0de6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec672336e589fcd2", "level": "note", "message": {"text": "Unused endpoint: GET /referrals/summary"}, "properties": {"repobilityId": "2e55b9462c7f6bd4", "scanner": "scanner-primary", "fingerprint": "ec672336e589fcd2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-482d57ff64eb9db5", "level": "note", "message": {"text": "Unused endpoint: POST /track/search"}, "properties": {"repobilityId": "a920788f4a2d3d8c", "scanner": "scanner-primary", "fingerprint": "482d57ff64eb9db5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-889f03606689fcbb", "level": "note", "message": {"text": "Unused endpoint: GET /demand/summary"}, "properties": {"repobilityId": "a4af4f4454b19de3", "scanner": "scanner-primary", "fingerprint": "889f03606689fcbb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52c40df350200e83", "level": "note", "message": {"text": "Unused endpoint: POST /leads"}, "properties": {"repobilityId": "b2ebf322ee2a96cd", "scanner": "scanner-primary", "fingerprint": "52c40df350200e83", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eb19a2be7a6629c", "level": "note", "message": {"text": "Unused endpoint: GET /leads"}, "properties": {"repobilityId": "b4a01497c490d4ae", "scanner": "scanner-primary", "fingerprint": "6eb19a2be7a6629c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2748808021f259ec", "level": "note", "message": {"text": "Unused endpoint: GET /pipelines"}, "properties": {"repobilityId": "2ce794cccff68d95", "scanner": "scanner-primary", "fingerprint": "2748808021f259ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43269e4e79c2e69e", "level": "note", "message": {"text": "Unused endpoint: GET /events"}, "properties": {"repobilityId": "14c06362a28e8e8b", "scanner": "scanner-primary", "fingerprint": "43269e4e79c2e69e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-08877a04d68bc5f3", "level": "note", "message": {"text": "Unused endpoint: PATCH /leads/:id"}, "properties": {"repobilityId": "057110c59cdc3fdd", "scanner": "scanner-primary", "fingerprint": "08877a04d68bc5f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81f77f242670cb45", "level": "note", "message": {"text": "Unused endpoint: GET /leads/:id"}, "properties": {"repobilityId": "9dfdd8c66cc348ed", "scanner": "scanner-primary", "fingerprint": "81f77f242670cb45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-512ccb0fd0b230ba", "level": "note", "message": {"text": "Unused endpoint: GET /settings"}, "properties": {"repobilityId": "4698f3b26656f99d", "scanner": "scanner-primary", "fingerprint": "512ccb0fd0b230ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d16b1a1e2dd23ce7", "level": "note", "message": {"text": "Unused endpoint: GET /settings/:key"}, "properties": {"repobilityId": "4c942f0f9c8db1a3", "scanner": "scanner-primary", "fingerprint": "d16b1a1e2dd23ce7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1388e7c08fe550cc", "level": "note", "message": {"text": "Unused endpoint: PUT /settings/:key"}, "properties": {"repobilityId": "5f584e541f89c1f2", "scanner": "scanner-primary", "fingerprint": "1388e7c08fe550cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5bd78be526f19cd9", "level": "note", "message": {"text": "Unused endpoint: PATCH /leads/:id/contact"}, "properties": {"repobilityId": "bd17f84a6eb9d28d", "scanner": "scanner-primary", "fingerprint": "5bd78be526f19cd9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c6424c6519b9691", "level": "note", "message": {"text": "Unused endpoint: DELETE /leads/:id"}, "properties": {"repobilityId": "6ad30c1cb9dbbe38", "scanner": "scanner-primary", "fingerprint": "5c6424c6519b9691", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bbb81b115043941f", "level": "note", "message": {"text": "Unused endpoint: POST /leads/:id/notes"}, "properties": {"repobilityId": "f719adcf5ddcf7e8", "scanner": "scanner-primary", "fingerprint": "bbb81b115043941f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-50ef66f39fef1d23", "level": "note", "message": {"text": "Unused endpoint: POST /leads/:id/tasks"}, "properties": {"repobilityId": "4e3777b45320a177", "scanner": "scanner-primary", "fingerprint": "50ef66f39fef1d23", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b733c4d25decb64", "level": "note", "message": {"text": "Unused endpoint: PATCH /leads/:id/deal-checklist"}, "properties": {"repobilityId": "9e7f9b8d66766a0e", "scanner": "scanner-primary", "fingerprint": "7b733c4d25decb64", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4c3390024135dc8", "level": "note", "message": {"text": "Unused endpoint: PATCH /tasks/:id"}, "properties": {"repobilityId": "e336867a96d84c15", "scanner": "scanner-primary", "fingerprint": "b4c3390024135dc8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd0e06afbaab19b3", "level": "note", "message": {"text": "Unused endpoint: GET /tasks"}, "properties": {"repobilityId": "52507d8ab7b54c39", "scanner": "scanner-primary", "fingerprint": "fd0e06afbaab19b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6327e7d63f12d827", "level": "note", "message": {"text": "Unused endpoint: GET /contacts"}, "properties": {"repobilityId": "fe3162e4829bfba5", "scanner": "scanner-primary", "fingerprint": "6327e7d63f12d827", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-56c76afbccd7686b", "level": "note", "message": {"text": "Unused endpoint: POST /contacts/merge"}, "properties": {"repobilityId": "7433477be3e2d7d1", "scanner": "scanner-primary", "fingerprint": "56c76afbccd7686b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89ae0c205a8b79ad", "level": "note", "message": {"text": "Unused endpoint: POST /leads/:id/touch"}, "properties": {"repobilityId": "ee766aa0c02c9cc7", "scanner": "scanner-primary", "fingerprint": "89ae0c205a8b79ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-798f203c5b35860b", "level": "note", "message": {"text": "Unused endpoint: POST /leads/:id/shortlist-view"}, "properties": {"repobilityId": "e86e1cfba0e6b814", "scanner": "scanner-primary", "fingerprint": "798f203c5b35860b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f8f3d8aecd30d9dd", "level": "note", "message": {"text": "Unused endpoint: GET /articles"}, "properties": {"repobilityId": "86c5835e10773f3d", "scanner": "scanner-primary", "fingerprint": "f8f3d8aecd30d9dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81deed20ed5eb5af", "level": "note", "message": {"text": "Unused endpoint: GET /articles/pending-count"}, "properties": {"repobilityId": "a000d83fd28ff02d", "scanner": "scanner-primary", "fingerprint": "81deed20ed5eb5af", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-056a1c7e1f8ae906", "level": "note", "message": {"text": "Unused endpoint: GET /articles/slug/:slug"}, "properties": {"repobilityId": "67e68c659968bf0b", "scanner": "scanner-primary", "fingerprint": "056a1c7e1f8ae906", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f67f801ef6c68460", "level": "note", "message": {"text": "Unused endpoint: GET /articles/:id"}, "properties": {"repobilityId": "c03bc131fbc469c3", "scanner": "scanner-primary", "fingerprint": "f67f801ef6c68460", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8a2d53021b410f23", "level": "note", "message": {"text": "Unused endpoint: POST /articles"}, "properties": {"repobilityId": "b960f9cdc587b099", "scanner": "scanner-primary", "fingerprint": "8a2d53021b410f23", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-805840ed982722fd", "level": "note", "message": {"text": "Unused endpoint: PATCH /articles/:id"}, "properties": {"repobilityId": "f6451f2b03b09e08", "scanner": "scanner-primary", "fingerprint": "805840ed982722fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45364cce6c34fc3e", "level": "note", "message": {"text": "Unused endpoint: DELETE /articles/:id"}, "properties": {"repobilityId": "e79434afca38dc9a", "scanner": "scanner-primary", "fingerprint": "45364cce6c34fc3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5a71f7d3b682b67", "level": "note", "message": {"text": "Unused endpoint: GET /valuation/factors"}, "properties": {"repobilityId": "a20e0c41e525ae4f", "scanner": "scanner-primary", "fingerprint": "c5a71f7d3b682b67", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb33412d8da65082", "level": "note", "message": {"text": "Unused endpoint: PUT /valuation/factors"}, "properties": {"repobilityId": "272478bf5c3e0e39", "scanner": "scanner-primary", "fingerprint": "cb33412d8da65082", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bda9136e138df928", "level": "note", "message": {"text": "Unused endpoint: GET /valuation/comps"}, "properties": {"repobilityId": "efc712a8258477ea", "scanner": "scanner-primary", "fingerprint": "bda9136e138df928", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}