{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-03395897743dd708", "name": "Possibly dead Python function: do_run_migrations", "shortDescription": {"text": "Possibly dead Python function: do_run_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c892105e6b3dbfc0", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-237c3f14cdd088fd", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-584ee25f834ee513", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7ecfede9b057911", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fadd31d3e1ff652", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-449e1aed96d28617", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbcd7377d347c6aa", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4e4643c28c72328", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1d7e011e7a1d0e9", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-783b34f38405c3fd", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35d11adc9f25559f", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae1dbdaf2ff58654", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aea30b2b8d850e59", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63dfa09ca9ff2793", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2ab8ecc703a3c74", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f956a9c3a57e8cfe", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbb9f88fc3dd1251", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71b24598c7d3f53f", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-902e44db96cf353b", "name": "Possibly dead Python function: require_admin", "shortDescription": {"text": "Possibly dead Python function: require_admin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89c3ddeb2fcd3a25", "name": "Possibly dead Python function: run_daily_push_for_all_irs", "shortDescription": {"text": "Possibly dead Python function: run_daily_push_for_all_irs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5983760bd8c5dd10", "name": "Possibly dead Python function: run_milestone_outreach_for_all_irs", "shortDescription": {"text": "Possibly dead Python function: run_milestone_outreach_for_all_irs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4834e0d51dc25ea3", "name": "Possibly dead Python function: run_schedule_reminders", "shortDescription": {"text": "Possibly dead Python function: run_schedule_reminders"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-132b3c8121ef2be0", "name": "Possibly dead Python function: dispatch_outreach_impl", "shortDescription": {"text": "Possibly dead Python function: dispatch_outreach_impl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-690a5f6ae5187904", "name": "Possibly dead Python function: review_node", "shortDescription": {"text": "Possibly dead Python function: review_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a2d6d9d9db58d9d", "name": "Possibly dead Python function: fetch_candidates_node", "shortDescription": {"text": "Possibly dead Python function: fetch_candidates_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f1f3e1fb64b396f", "name": "Possibly dead Python function: rank_node", "shortDescription": {"text": "Possibly dead Python function: rank_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d8ed59267e3a163", "name": "Docker base image is tag-pinned but not digest-pinned: docker.m.daocloud.io/library/python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: docker.m.daocloud.io/library/python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b055815d5033aea", "name": "Possible secret in scripts/deploy_mvp.sh", "shortDescription": {"text": "Possible secret in scripts/deploy_mvp.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d4fede809a93b27", "name": "Very large file: backend/agent/orchestrator_tools/direct.py (1252 lines)", "shortDescription": {"text": "Very large file: backend/agent/orchestrator_tools/direct.py (1252 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a9ea1a785b3da1c8", "name": "Commented-code block (6 lines) in tests/test_calendar_month.py:97", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_calendar_month.py:97"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-513009cffb01b422", "name": "Commented-code block (5 lines) in backend/skills/claude_skill.py:20", "shortDescription": {"text": "Commented-code block (5 lines) in backend/skills/claude_skill.py:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DATABASE_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/skills/qmingpian.py:qmingpian_search_person_by_phone, backend/skills/qmingpian.py:qmingpian_search_person\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c16415e789606dd", "name": "FastAPI POST `wechat_login` without auth dependency \u2014 backend/auth/router.py:42", "shortDescription": {"text": "FastAPI POST `wechat_login` without auth dependency \u2014 backend/auth/router.py:42"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb833d67c6678093", "name": "FastAPI POST `bind_phone` without auth dependency \u2014 backend/auth/router.py:69", "shortDescription": {"text": "FastAPI POST `bind_phone` without auth dependency \u2014 backend/auth/router.py:69"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-965088c6c4b83123", "name": "FastAPI POST `dismiss_event` without auth dependency \u2014 backend/api/calendar.py:463", "shortDescription": {"text": "FastAPI POST `dismiss_event` without auth dependency \u2014 backend/api/calendar.py:463"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cff2e209c2e94820", "name": "FastAPI POST `create_schedule_event` without auth dependency \u2014 backend/api/calendar.py:550", "shortDescription": {"text": "FastAPI POST `create_schedule_event` without auth dependency \u2014 backend/api/calendar.py:550"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e9088f9143c788d", "name": "FastAPI PUT `update_schedule_event` without auth dependency \u2014 backend/api/calendar.py:582", "shortDescription": {"text": "FastAPI PUT `update_schedule_event` without auth dependency \u2014 backend/api/calendar.py:582"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf97bef80d6e5678", "name": "FastAPI DELETE `delete_schedule_event` without auth dependency \u2014 backend/api/calendar.py:618", "shortDescription": {"text": "FastAPI DELETE `delete_schedule_event` without auth dependency \u2014 backend/api/calendar.py:618"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd755d43ff8f2263", "name": "FastAPI POST `upload_business_card` without auth dependency \u2014 backend/api/investors.py:402", "shortDescription": {"text": "FastAPI POST `upload_business_card` without auth dependency \u2014 backend/api/investors.py:402"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7654e05f0e8191a8", "name": "FastAPI POST `create_investor` without auth dependency \u2014 backend/api/investors.py:490", "shortDescription": {"text": "FastAPI POST `create_investor` without auth dependency \u2014 backend/api/investors.py:490"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59ed23fd185f7633", "name": "FastAPI PUT `update_investor` without auth dependency \u2014 backend/api/investors.py:611", "shortDescription": {"text": "FastAPI PUT `update_investor` without auth dependency \u2014 backend/api/investors.py:611"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9114b32b46b5a4bd", "name": "FastAPI DELETE `delete_investor` without auth dependency \u2014 backend/api/investors.py:744", "shortDescription": {"text": "FastAPI DELETE `delete_investor` without auth dependency \u2014 backend/api/investors.py:744"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-190f59f8c24ee40c", "name": "FastAPI POST `create_interaction` without auth dependency \u2014 backend/api/interactions.py:35", "shortDescription": {"text": "FastAPI POST `create_interaction` without auth dependency \u2014 backend/api/interactions.py:35"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be6907b952a6fa6e", "name": "FastAPI DELETE `delete_interaction` without auth dependency \u2014 backend/api/interactions.py:68", "shortDescription": {"text": "FastAPI DELETE `delete_interaction` without auth dependency \u2014 backend/api/interactions.py:68"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-77d9130e738f3b6e", "name": "FastAPI POST `get_upload_token` without auth dependency \u2014 backend/api/upload.py:32", "shortDescription": {"text": "FastAPI POST `get_upload_token` without auth dependency \u2014 backend/api/upload.py:32"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd57ea180799382e", "name": "FastAPI PUT `update_me` without auth dependency \u2014 backend/api/me.py:53", "shortDescription": {"text": "FastAPI PUT `update_me` without auth dependency \u2014 backend/api/me.py:53"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-affb1dbfc36ced16", "name": "FastAPI PUT `configure_tencent` without auth dependency \u2014 backend/api/me.py:92", "shortDescription": {"text": "FastAPI PUT `configure_tencent` without auth dependency \u2014 backend/api/me.py:92"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b74049e33f4da520", "name": "FastAPI POST `test_tencent_token` without auth dependency \u2014 backend/api/me.py:115", "shortDescription": {"text": "FastAPI POST `test_tencent_token` without auth dependency \u2014 backend/api/me.py:115"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2a6191697ace53a", "name": "FastAPI POST `report_subscribe_grant` without auth dependency \u2014 backend/api/me.py:147", "shortDescription": {"text": "FastAPI POST `report_subscribe_grant` without auth dependency \u2014 backend/api/me.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4a0801db2048cc70", "name": "FastAPI POST `start_workflow` without auth dependency \u2014 backend/api/agent.py:160", "shortDescription": {"text": "FastAPI POST `start_workflow` without auth dependency \u2014 backend/api/agent.py:160"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4251a6dd0ab6c803", "name": "FastAPI POST `submit_review` without auth dependency \u2014 backend/api/agent.py:243", "shortDescription": {"text": "FastAPI POST `submit_review` without auth dependency \u2014 backend/api/agent.py:243"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ac6a428f870ea5d", "name": "FastAPI POST `free_chat` without auth dependency \u2014 backend/api/agent.py:375", "shortDescription": {"text": "FastAPI POST `free_chat` without auth dependency \u2014 backend/api/agent.py:375"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-16d877b115d3b3d4", "name": "FastAPI DELETE `delete_outreach` without auth dependency \u2014 backend/api/outreach.py:59", "shortDescription": {"text": "FastAPI DELETE `delete_outreach` without auth dependency \u2014 backend/api/outreach.py:59"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`backend/auth/router.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-127e8e2ad0e6d2c1", "name": "Unused endpoint: POST /bind_phone", "shortDescription": {"text": "Unused endpoint: POST /bind_phone"}, "fullDescription": {"text": "`backend/auth/router.py` declares `POST /bind_phone` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86ce60f456918c1e", "name": "Unused endpoint: GET /daily", "shortDescription": {"text": "Unused endpoint: GET /daily"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `GET /daily` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a565329de9a05ae5", "name": "Unused endpoint: GET /month", "shortDescription": {"text": "Unused endpoint: GET /month"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `GET /month` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce31eddc0c4b64e0", "name": "Unused endpoint: POST /dismiss", "shortDescription": {"text": "Unused endpoint: POST /dismiss"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `POST /dismiss` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9036859bef072758", "name": "Unused endpoint: GET /events/{event_id}", "shortDescription": {"text": "Unused endpoint: GET /events/{event_id}"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `GET /events/{event_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-150a51bfa1c53963", "name": "Unused endpoint: POST /events", "shortDescription": {"text": "Unused endpoint: POST /events"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `POST /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35f69c68a6615621", "name": "Unused endpoint: PUT /events/{event_id}", "shortDescription": {"text": "Unused endpoint: PUT /events/{event_id}"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `PUT /events/{event_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adedb733b8888689", "name": "Unused endpoint: DELETE /events/{event_id}", "shortDescription": {"text": "Unused endpoint: DELETE /events/{event_id}"}, "fullDescription": {"text": "`backend/api/calendar.py` declares `DELETE /events/{event_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/api/investors.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d16e4fa529c520e9", "name": "Unused endpoint: GET /search", "shortDescription": {"text": "Unused endpoint: GET /search"}, "fullDescription": {"text": "`backend/api/investors.py` declares `GET /search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e7937acb2d73dcd", "name": "Unused endpoint: GET /qmingpian/searchhit", "shortDescription": {"text": "Unused endpoint: GET /qmingpian/searchhit"}, "fullDescription": {"text": "`backend/api/investors.py` declares `GET /qmingpian/searchhit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01271a48c30c9d88", "name": "Unused endpoint: POST /upload-business-card", "shortDescription": {"text": "Unused endpoint: POST /upload-business-card"}, "fullDescription": {"text": "`backend/api/investors.py` declares `POST /upload-business-card` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b223c848b572ca2f", "name": "Unused endpoint: GET /qmingpian/by-name", "shortDescription": {"text": "Unused endpoint: GET /qmingpian/by-name"}, "fullDescription": {"text": "`backend/api/investors.py` declares `GET /qmingpian/by-name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-446790c3ce79f71e", "name": "Unused endpoint: GET /{investor_id}", "shortDescription": {"text": "Unused endpoint: GET /{investor_id}"}, "fullDescription": {"text": "`backend/api/investors.py` declares `GET /{investor_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`backend/api/investors.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7419de41fc723ea", "name": "Unused endpoint: PUT /{investor_id}", "shortDescription": {"text": "Unused endpoint: PUT /{investor_id}"}, "fullDescription": {"text": "`backend/api/investors.py` declares `PUT /{investor_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77450bfe19185064", "name": "Unused endpoint: DELETE /{investor_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{investor_id}"}, "fullDescription": {"text": "`backend/api/investors.py` declares `DELETE /{investor_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1faf6dc7146e626c", "name": "Unused endpoint: POST /{investor_id}/interactions", "shortDescription": {"text": "Unused endpoint: POST /{investor_id}/interactions"}, "fullDescription": {"text": "`backend/api/interactions.py` declares `POST /{investor_id}/interactions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d8d9a4d9cc542c8", "name": "Unused endpoint: DELETE /{investor_id}/interactions/{interaction_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{investor_id}/interactions/{interaction_id}"}, "fullDescription": {"text": "`backend/api/interactions.py` declares `DELETE /{investor_id}/interactions/{interaction_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0ef5995787ff495", "name": "Unused endpoint: GET /{investor_id}/interactions", "shortDescription": {"text": "Unused endpoint: GET /{investor_id}/interactions"}, "fullDescription": {"text": "`backend/api/interactions.py` declares `GET /{investor_id}/interactions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-358815753e8867f1", "name": "Unused endpoint: POST /token", "shortDescription": {"text": "Unused endpoint: POST /token"}, "fullDescription": {"text": "`backend/api/upload.py` declares `POST /token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44022c514e5015e7", "name": "Unused endpoint: GET /sign", "shortDescription": {"text": "Unused endpoint: GET /sign"}, "fullDescription": {"text": "`backend/api/upload.py` declares `GET /sign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bca8100a44f7f25", "name": "Unused endpoint: POST /users", "shortDescription": {"text": "Unused endpoint: POST /users"}, "fullDescription": {"text": "`backend/api/admin.py` declares `POST /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc679d62b533e7b6", "name": "Unused endpoint: PATCH /users/{user_id}", "shortDescription": {"text": "Unused endpoint: PATCH /users/{user_id}"}, "fullDescription": {"text": "`backend/api/admin.py` declares `PATCH /users/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d28fa8cd6bb12f", "name": "Unused endpoint: PUT /", "shortDescription": {"text": "Unused endpoint: PUT /"}, "fullDescription": {"text": "`backend/api/me.py` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fef0d997f85d06dd", "name": "Unused endpoint: PUT /tencent", "shortDescription": {"text": "Unused endpoint: PUT /tencent"}, "fullDescription": {"text": "`backend/api/me.py` declares `PUT /tencent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-342cf258261efca9", "name": "Unused endpoint: POST /tencent/test", "shortDescription": {"text": "Unused endpoint: POST /tencent/test"}, "fullDescription": {"text": "`backend/api/me.py` declares `POST /tencent/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-365f0986d17746b8", "name": "Unused endpoint: POST /subscribe", "shortDescription": {"text": "Unused endpoint: POST /subscribe"}, "fullDescription": {"text": "`backend/api/me.py` declares `POST /subscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bc9bdb5d34a629f", "name": "Unused endpoint: GET /tencent/meetings/{meeting_id}/records", "shortDescription": {"text": "Unused endpoint: GET /tencent/meetings/{meeting_id}/records"}, "fullDescription": {"text": "`backend/api/me.py` declares `GET /tencent/meetings/{meeting_id}/records` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-685734163a460286", "name": "Unused endpoint: GET /tencent/meetings", "shortDescription": {"text": "Unused endpoint: GET /tencent/meetings"}, "fullDescription": {"text": "`backend/api/me.py` declares `GET /tencent/meetings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69a693dfc33637f4", "name": "Unused endpoint: POST /run", "shortDescription": {"text": "Unused endpoint: POST /run"}, "fullDescription": {"text": "`backend/api/agent.py` declares `POST /run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-812e6d4ec2de4632", "name": "Unused endpoint: POST /{thread_id}/review", "shortDescription": {"text": "Unused endpoint: POST /{thread_id}/review"}, "fullDescription": {"text": "`backend/api/agent.py` declares `POST /{thread_id}/review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64d2e4a8cf00a704", "name": "Unused endpoint: GET /{thread_id}/state", "shortDescription": {"text": "Unused endpoint: GET /{thread_id}/state"}, "fullDescription": {"text": "`backend/api/agent.py` declares `GET /{thread_id}/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff8da5fbc19c76d", "name": "Unused endpoint: POST /chat", "shortDescription": {"text": "Unused endpoint: POST /chat"}, "fullDescription": {"text": "`backend/api/agent.py` declares `POST /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9de4cecd0e235584", "name": "Unused endpoint: GET /pending", "shortDescription": {"text": "Unused endpoint: GET /pending"}, "fullDescription": {"text": "`backend/api/outreach.py` declares `GET /pending` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afc064028ae39ea9", "name": "Unused endpoint: GET /history", "shortDescription": {"text": "Unused endpoint: GET /history"}, "fullDescription": {"text": "`backend/api/outreach.py` declares `GET /history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-347228e334452f2b", "name": "Unused endpoint: DELETE /{record_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{record_id}"}, "fullDescription": {"text": "`backend/api/outreach.py` declares `DELETE /{record_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb1d8f3f6903e5fd", "name": "Unused endpoint: POST /api/me/subscribe", "shortDescription": {"text": "Unused endpoint: POST /api/me/subscribe"}, "fullDescription": {"text": "`miniprogram/utils/subscribe.ts` declares `POST /api/me/subscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-625a893b217624aa", "name": "Unused endpoint: PUT /api/me/tencent", "shortDescription": {"text": "Unused endpoint: PUT /api/me/tencent"}, "fullDescription": {"text": "`miniprogram/pages/tencent-setup/index.ts` declares `PUT /api/me/tencent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26551b3bc3ade2f4", "name": "Unused endpoint: POST /api/calendar/dismiss", "shortDescription": {"text": "Unused endpoint: POST /api/calendar/dismiss"}, "fullDescription": {"text": "`miniprogram/pages/calendar-day/index.ts` declares `POST /api/calendar/dismiss` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17534e44084f45be", "name": "Unused endpoint: POST /api/calendar/events", "shortDescription": {"text": "Unused endpoint: POST /api/calendar/events"}, "fullDescription": {"text": "`miniprogram/pages/schedule-edit/index.ts` declares `POST /api/calendar/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31ae57b8e012eb02", "name": "Unused endpoint: PUT /api/me", "shortDescription": {"text": "Unused endpoint: PUT /api/me"}, "fullDescription": {"text": "`miniprogram/pages/me/index.ts` declares `PUT /api/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23004"}, "properties": {"repository": "xiayansummer/fa-agent", "repoUrl": "https://github.com/xiayansummer/fa-agent", "branch": "main"}, "results": [{"ruleId": "scanner-03395897743dd708", "level": "note", "message": {"text": "Possibly dead Python function: do_run_migrations"}, "properties": {"repobilityId": "087acb17722cfd2f", "scanner": "scanner-primary", "fingerprint": "03395897743dd708", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/env.py:45"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c892105e6b3dbfc0", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "c892105e6b3dbfc0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/2b56329d65d3_initial_schema.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-237c3f14cdd088fd", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "237c3f14cdd088fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/2b56329d65d3_initial_schema.py:120"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-584ee25f834ee513", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "584ee25f834ee513", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/9f1c8a2d4e6b_ir_investor_membership.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c7ecfede9b057911", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "c7ecfede9b057911", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/9f1c8a2d4e6b_ir_investor_membership.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fadd31d3e1ff652", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "4fadd31d3e1ff652", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/b2c3d4e5f6a7_wx_schedule_reminders.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-449e1aed96d28617", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "449e1aed96d28617", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/b2c3d4e5f6a7_wx_schedule_reminders.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbcd7377d347c6aa", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "dbcd7377d347c6aa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/5b9c8d4e3f7a_add_familiarity_qmingpian_username.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4e4643c28c72328", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e4e4643c28c72328", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/5b9c8d4e3f7a_add_familiarity_qmingpian_username.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1d7e011e7a1d0e9", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "e1d7e011e7a1d0e9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/6e30809e653d_mvp_schema_phone_unique_token_.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-783b34f38405c3fd", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "783b34f38405c3fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/6e30809e653d_mvp_schema_phone_unique_token_.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35d11adc9f25559f", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "35d11adc9f25559f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/4a8b7c2e1d5f_investors_add_avatar_card.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae1dbdaf2ff58654", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "ae1dbdaf2ff58654", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/4a8b7c2e1d5f_investors_add_avatar_card.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aea30b2b8d850e59", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "aea30b2b8d850e59", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/30cc917a9faf_investors_add_qmingpian_person_id.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63dfa09ca9ff2793", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "63dfa09ca9ff2793", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/30cc917a9faf_investors_add_qmingpian_person_id.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2ab8ecc703a3c74", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "e2ab8ecc703a3c74", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/c3d4e5f6a7b8_remind_ahead.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f956a9c3a57e8cfe", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "f956a9c3a57e8cfe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/c3d4e5f6a7b8_remind_ahead.py:24"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbb9f88fc3dd1251", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "fbb9f88fc3dd1251", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/a1b2c3d4e5f6_calendar_events.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71b24598c7d3f53f", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "71b24598c7d3f53f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "alembic/versions/a1b2c3d4e5f6_calendar_events.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-902e44db96cf353b", "level": "note", "message": {"text": "Possibly dead Python function: require_admin"}, "properties": {"repobilityId": "3c06db2e25566bf7", "scanner": "scanner-primary", "fingerprint": "902e44db96cf353b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/auth/jwt.py:26"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89c3ddeb2fcd3a25", "level": "note", "message": {"text": "Possibly dead Python function: run_daily_push_for_all_irs"}, "properties": {"repobilityId": "e519dfbe69542e66", "scanner": "scanner-primary", "fingerprint": "89c3ddeb2fcd3a25", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/scheduled.py:52"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5983760bd8c5dd10", "level": "note", "message": {"text": "Possibly dead Python function: run_milestone_outreach_for_all_irs"}, "properties": {"repobilityId": "27ed6bb410a67128", "scanner": "scanner-primary", "fingerprint": "5983760bd8c5dd10", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/scheduled.py:85"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4834e0d51dc25ea3", "level": "note", "message": {"text": "Possibly dead Python function: run_schedule_reminders"}, "properties": {"repobilityId": "83057c4ccbbae339", "scanner": "scanner-primary", "fingerprint": "4834e0d51dc25ea3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/scheduled.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-132b3c8121ef2be0", "level": "note", "message": {"text": "Possibly dead Python function: dispatch_outreach_impl"}, "properties": {"repobilityId": "b8a07e3ca25b0126", "scanner": "scanner-primary", "fingerprint": "132b3c8121ef2be0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/dispatch_outreach.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-690a5f6ae5187904", "level": "note", "message": {"text": "Possibly dead Python function: review_node"}, "properties": {"repobilityId": "2f677865ad963050", "scanner": "scanner-primary", "fingerprint": "690a5f6ae5187904", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/nodes/review_node.py:5"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a2d6d9d9db58d9d", "level": "note", "message": {"text": "Possibly dead Python function: fetch_candidates_node"}, "properties": {"repobilityId": "dadcc308b51bfff0", "scanner": "scanner-primary", "fingerprint": "6a2d6d9d9db58d9d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/workflows/smart_list.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f1f3e1fb64b396f", "level": "note", "message": {"text": "Possibly dead Python function: rank_node"}, "properties": {"repobilityId": "ba651a82c601303c", "scanner": "scanner-primary", "fingerprint": "5f1f3e1fb64b396f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agent/workflows/smart_list.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-7d8ed59267e3a163", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: docker.m.daocloud.io/library/python:3.11-slim"}, "properties": {"repobilityId": "89cad14290ec0d32", "scanner": "scanner-primary", "fingerprint": "7d8ed59267e3a163", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-1b055815d5033aea", "level": "error", "message": {"text": "Possible secret in scripts/deploy_mvp.sh"}, "properties": {"repobilityId": "5d4a1bd88529e0e9", "scanner": "scanner-primary", "fingerprint": "1b055815d5033aea", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/deploy_mvp.sh"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3d4fede809a93b27", "level": "note", "message": {"text": "Very large file: backend/agent/orchestrator_tools/direct.py (1252 lines)"}, "properties": {"repobilityId": "7efb8d7139d64d62", "scanner": "scanner-primary", "fingerprint": "3d4fede809a93b27", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "729e91a5ea568609", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "ba0910126825074f", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "39704a1789ac24fd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "1dcd97b0f7cee501", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ac829df3ee7fc27a", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "6c6f66e72d27105e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5d5dd6ad07ddf152", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a9ea1a785b3da1c8", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_calendar_month.py:97"}, "properties": {"repobilityId": "dbd072daa871467f", "scanner": "scanner-primary", "fingerprint": "a9ea1a785b3da1c8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-513009cffb01b422", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/skills/claude_skill.py:20"}, "properties": {"repobilityId": "bfc9d92e10f94be2", "scanner": "scanner-primary", "fingerprint": "513009cffb01b422", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dccfa16d0296e28c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0aebbdb235d72d67", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6b9269cb1bdae2e0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-5c16415e789606dd", "level": "error", "message": {"text": "FastAPI POST `wechat_login` without auth dependency \u2014 backend/auth/router.py:42"}, "properties": {"repobilityId": "9788d8eec9b3a954", "scanner": "scanner-primary", "fingerprint": "5c16415e789606dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/auth/router.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-eb833d67c6678093", "level": "error", "message": {"text": "FastAPI POST `bind_phone` without auth dependency \u2014 backend/auth/router.py:69"}, "properties": {"repobilityId": "ef1e427f884f2be5", "scanner": "scanner-primary", "fingerprint": "eb833d67c6678093", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/auth/router.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-965088c6c4b83123", "level": "error", "message": {"text": "FastAPI POST `dismiss_event` without auth dependency \u2014 backend/api/calendar.py:463"}, "properties": {"repobilityId": "46ba89cc6fbb25b9", "scanner": "scanner-primary", "fingerprint": "965088c6c4b83123", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/calendar.py"}, "region": {"startLine": 463}}}]}, {"ruleId": "scanner-cff2e209c2e94820", "level": "error", "message": {"text": "FastAPI POST `create_schedule_event` without auth dependency \u2014 backend/api/calendar.py:550"}, "properties": {"repobilityId": "ed9e9e9c8f7739be", "scanner": "scanner-primary", "fingerprint": "cff2e209c2e94820", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/calendar.py"}, "region": {"startLine": 550}}}]}, {"ruleId": "scanner-0e9088f9143c788d", "level": "error", "message": {"text": "FastAPI PUT `update_schedule_event` without auth dependency \u2014 backend/api/calendar.py:582"}, "properties": {"repobilityId": "2aae105889064fdd", "scanner": "scanner-primary", "fingerprint": "0e9088f9143c788d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/calendar.py"}, "region": {"startLine": 582}}}]}, {"ruleId": "scanner-bf97bef80d6e5678", "level": "error", "message": {"text": "FastAPI DELETE `delete_schedule_event` without auth dependency \u2014 backend/api/calendar.py:618"}, "properties": {"repobilityId": "acac46d3dbbdae69", "scanner": "scanner-primary", "fingerprint": "bf97bef80d6e5678", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/calendar.py"}, "region": {"startLine": 618}}}]}, {"ruleId": "scanner-dd755d43ff8f2263", "level": "error", "message": {"text": "FastAPI POST `upload_business_card` without auth dependency \u2014 backend/api/investors.py:402"}, "properties": {"repobilityId": "1c8eed03b6128004", "scanner": "scanner-primary", "fingerprint": "dd755d43ff8f2263", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/investors.py"}, "region": {"startLine": 402}}}]}, {"ruleId": "scanner-7654e05f0e8191a8", "level": "error", "message": {"text": "FastAPI POST `create_investor` without auth dependency \u2014 backend/api/investors.py:490"}, "properties": {"repobilityId": "43e7b689e9a2be7d", "scanner": "scanner-primary", "fingerprint": "7654e05f0e8191a8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/investors.py"}, "region": {"startLine": 490}}}]}, {"ruleId": "scanner-59ed23fd185f7633", "level": "error", "message": {"text": "FastAPI PUT `update_investor` without auth dependency \u2014 backend/api/investors.py:611"}, "properties": {"repobilityId": "51c3fa973bbad2ef", "scanner": "scanner-primary", "fingerprint": "59ed23fd185f7633", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/investors.py"}, "region": {"startLine": 611}}}]}, {"ruleId": "scanner-9114b32b46b5a4bd", "level": "error", "message": {"text": "FastAPI DELETE `delete_investor` without auth dependency \u2014 backend/api/investors.py:744"}, "properties": {"repobilityId": "d6ae7b2336851a7d", "scanner": "scanner-primary", "fingerprint": "9114b32b46b5a4bd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/investors.py"}, "region": {"startLine": 744}}}]}, {"ruleId": "scanner-190f59f8c24ee40c", "level": "error", "message": {"text": "FastAPI POST `create_interaction` without auth dependency \u2014 backend/api/interactions.py:35"}, "properties": {"repobilityId": "caf65e1fe9af875c", "scanner": "scanner-primary", "fingerprint": "190f59f8c24ee40c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/interactions.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-be6907b952a6fa6e", "level": "error", "message": {"text": "FastAPI DELETE `delete_interaction` without auth dependency \u2014 backend/api/interactions.py:68"}, "properties": {"repobilityId": "09636a880f851ecd", "scanner": "scanner-primary", "fingerprint": "be6907b952a6fa6e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/interactions.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-77d9130e738f3b6e", "level": "error", "message": {"text": "FastAPI POST `get_upload_token` without auth dependency \u2014 backend/api/upload.py:32"}, "properties": {"repobilityId": "4d9c84e79ed1d8d0", "scanner": "scanner-primary", "fingerprint": "77d9130e738f3b6e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/upload.py"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-dd57ea180799382e", "level": "error", "message": {"text": "FastAPI PUT `update_me` without auth dependency \u2014 backend/api/me.py:53"}, "properties": {"repobilityId": "87348b5e00d93ac9", "scanner": "scanner-primary", "fingerprint": "dd57ea180799382e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/me.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-affb1dbfc36ced16", "level": "error", "message": {"text": "FastAPI PUT `configure_tencent` without auth dependency \u2014 backend/api/me.py:92"}, "properties": {"repobilityId": "f15eec0b14315b91", "scanner": "scanner-primary", "fingerprint": "affb1dbfc36ced16", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/me.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-b74049e33f4da520", "level": "error", "message": {"text": "FastAPI POST `test_tencent_token` without auth dependency \u2014 backend/api/me.py:115"}, "properties": {"repobilityId": "700eec4f564c9a4c", "scanner": "scanner-primary", "fingerprint": "b74049e33f4da520", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/me.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-e2a6191697ace53a", "level": "error", "message": {"text": "FastAPI POST `report_subscribe_grant` without auth dependency \u2014 backend/api/me.py:147"}, "properties": {"repobilityId": "b9adee3e1dfad1a3", "scanner": "scanner-primary", "fingerprint": "e2a6191697ace53a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/me.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-4a0801db2048cc70", "level": "error", "message": {"text": "FastAPI POST `start_workflow` without auth dependency \u2014 backend/api/agent.py:160"}, "properties": {"repobilityId": "f6b1cb64b871f046", "scanner": "scanner-primary", "fingerprint": "4a0801db2048cc70", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agent.py"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-4251a6dd0ab6c803", "level": "error", "message": {"text": "FastAPI POST `submit_review` without auth dependency \u2014 backend/api/agent.py:243"}, "properties": {"repobilityId": "0959992b21a91564", "scanner": "scanner-primary", "fingerprint": "4251a6dd0ab6c803", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agent.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-9ac6a428f870ea5d", "level": "error", "message": {"text": "FastAPI POST `free_chat` without auth dependency \u2014 backend/api/agent.py:375"}, "properties": {"repobilityId": "7a28bbd8622b8f62", "scanner": "scanner-primary", "fingerprint": "9ac6a428f870ea5d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agent.py"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-16d877b115d3b3d4", "level": "error", "message": {"text": "FastAPI DELETE `delete_outreach` without auth dependency \u2014 backend/api/outreach.py:59"}, "properties": {"repobilityId": "a28f5077dc7845eb", "scanner": "scanner-primary", "fingerprint": "16d877b115d3b3d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/outreach.py"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "11935d174e45e681", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-127e8e2ad0e6d2c1", "level": "note", "message": {"text": "Unused endpoint: POST /bind_phone"}, "properties": {"repobilityId": "edc48e87792aff22", "scanner": "scanner-primary", "fingerprint": "127e8e2ad0e6d2c1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86ce60f456918c1e", "level": "note", "message": {"text": "Unused endpoint: GET /daily"}, "properties": {"repobilityId": "44bc22e01331804c", "scanner": "scanner-primary", "fingerprint": "86ce60f456918c1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a565329de9a05ae5", "level": "note", "message": {"text": "Unused endpoint: GET /month"}, "properties": {"repobilityId": "8a6ee6729c7a684a", "scanner": "scanner-primary", "fingerprint": "a565329de9a05ae5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce31eddc0c4b64e0", "level": "note", "message": {"text": "Unused endpoint: POST /dismiss"}, "properties": {"repobilityId": "47fbbbf5613572e8", "scanner": "scanner-primary", "fingerprint": "ce31eddc0c4b64e0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9036859bef072758", "level": "note", "message": {"text": "Unused endpoint: GET /events/{event_id}"}, "properties": {"repobilityId": "4a79517b31762312", "scanner": "scanner-primary", "fingerprint": "9036859bef072758", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-150a51bfa1c53963", "level": "note", "message": {"text": "Unused endpoint: POST /events"}, "properties": {"repobilityId": "847c5500c9dd0988", "scanner": "scanner-primary", "fingerprint": "150a51bfa1c53963", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35f69c68a6615621", "level": "note", "message": {"text": "Unused endpoint: PUT /events/{event_id}"}, "properties": {"repobilityId": "e21a3b7121789f2d", "scanner": "scanner-primary", "fingerprint": "35f69c68a6615621", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-adedb733b8888689", "level": "note", "message": {"text": "Unused endpoint: DELETE /events/{event_id}"}, "properties": {"repobilityId": "151465bece782913", "scanner": "scanner-primary", "fingerprint": "adedb733b8888689", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "675161c67902cc65", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d16e4fa529c520e9", "level": "note", "message": {"text": "Unused endpoint: GET /search"}, "properties": {"repobilityId": "150222538bbaf84a", "scanner": "scanner-primary", "fingerprint": "d16e4fa529c520e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e7937acb2d73dcd", "level": "note", "message": {"text": "Unused endpoint: GET /qmingpian/searchhit"}, "properties": {"repobilityId": "2ccc2d28d6138dd9", "scanner": "scanner-primary", "fingerprint": "8e7937acb2d73dcd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01271a48c30c9d88", "level": "note", "message": {"text": "Unused endpoint: POST /upload-business-card"}, "properties": {"repobilityId": "a6d3a8d6cd41374b", "scanner": "scanner-primary", "fingerprint": "01271a48c30c9d88", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b223c848b572ca2f", "level": "note", "message": {"text": "Unused endpoint: GET /qmingpian/by-name"}, "properties": {"repobilityId": "db91c4ad03b0999c", "scanner": "scanner-primary", "fingerprint": "b223c848b572ca2f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-446790c3ce79f71e", "level": "note", "message": {"text": "Unused endpoint: GET /{investor_id}"}, "properties": {"repobilityId": "a60174cf1c4a45ac", "scanner": "scanner-primary", "fingerprint": "446790c3ce79f71e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "703930f112ae8485", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7419de41fc723ea", "level": "note", "message": {"text": "Unused endpoint: PUT /{investor_id}"}, "properties": {"repobilityId": "c32d4c9e25f3e766", "scanner": "scanner-primary", "fingerprint": "d7419de41fc723ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-77450bfe19185064", "level": "note", "message": {"text": "Unused endpoint: DELETE /{investor_id}"}, "properties": {"repobilityId": "4c326b853e6b678e", "scanner": "scanner-primary", "fingerprint": "77450bfe19185064", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1faf6dc7146e626c", "level": "note", "message": {"text": "Unused endpoint: POST /{investor_id}/interactions"}, "properties": {"repobilityId": "a14d1f7a2c8c2d46", "scanner": "scanner-primary", "fingerprint": "1faf6dc7146e626c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d8d9a4d9cc542c8", "level": "note", "message": {"text": "Unused endpoint: DELETE /{investor_id}/interactions/{interaction_id}"}, "properties": {"repobilityId": "d1765de8092f621c", "scanner": "scanner-primary", "fingerprint": "5d8d9a4d9cc542c8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0ef5995787ff495", "level": "note", "message": {"text": "Unused endpoint: GET /{investor_id}/interactions"}, "properties": {"repobilityId": "19720b7f787c35ec", "scanner": "scanner-primary", "fingerprint": "c0ef5995787ff495", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-358815753e8867f1", "level": "note", "message": {"text": "Unused endpoint: POST /token"}, "properties": {"repobilityId": "62c04f23225d9e96", "scanner": "scanner-primary", "fingerprint": "358815753e8867f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44022c514e5015e7", "level": "note", "message": {"text": "Unused endpoint: GET /sign"}, "properties": {"repobilityId": "9223b6d6832b3cab", "scanner": "scanner-primary", "fingerprint": "44022c514e5015e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1bca8100a44f7f25", "level": "note", "message": {"text": "Unused endpoint: POST /users"}, "properties": {"repobilityId": "59acdd630a2c84d7", "scanner": "scanner-primary", "fingerprint": "1bca8100a44f7f25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc679d62b533e7b6", "level": "note", "message": {"text": "Unused endpoint: PATCH /users/{user_id}"}, "properties": {"repobilityId": "6a9f8034d368a3c7", "scanner": "scanner-primary", "fingerprint": "cc679d62b533e7b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d28fa8cd6bb12f", "level": "note", "message": {"text": "Unused endpoint: PUT /"}, "properties": {"repobilityId": "7b5c9f09e2c59721", "scanner": "scanner-primary", "fingerprint": "67d28fa8cd6bb12f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fef0d997f85d06dd", "level": "note", "message": {"text": "Unused endpoint: PUT /tencent"}, "properties": {"repobilityId": "9f49ce478fb95a24", "scanner": "scanner-primary", "fingerprint": "fef0d997f85d06dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-342cf258261efca9", "level": "note", "message": {"text": "Unused endpoint: POST /tencent/test"}, "properties": {"repobilityId": "745f24e7d5e1e8a9", "scanner": "scanner-primary", "fingerprint": "342cf258261efca9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-365f0986d17746b8", "level": "note", "message": {"text": "Unused endpoint: POST /subscribe"}, "properties": {"repobilityId": "b0209e04eb98b2fe", "scanner": "scanner-primary", "fingerprint": "365f0986d17746b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bc9bdb5d34a629f", "level": "note", "message": {"text": "Unused endpoint: GET /tencent/meetings/{meeting_id}/records"}, "properties": {"repobilityId": "19d0e10ae99ab4a1", "scanner": "scanner-primary", "fingerprint": "2bc9bdb5d34a629f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-685734163a460286", "level": "note", "message": {"text": "Unused endpoint: GET /tencent/meetings"}, "properties": {"repobilityId": "831525e75c45dae8", "scanner": "scanner-primary", "fingerprint": "685734163a460286", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69a693dfc33637f4", "level": "note", "message": {"text": "Unused endpoint: POST /run"}, "properties": {"repobilityId": "3403522aab7fa34b", "scanner": "scanner-primary", "fingerprint": "69a693dfc33637f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-812e6d4ec2de4632", "level": "note", "message": {"text": "Unused endpoint: POST /{thread_id}/review"}, "properties": {"repobilityId": "e3ae8b03eb527e13", "scanner": "scanner-primary", "fingerprint": "812e6d4ec2de4632", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64d2e4a8cf00a704", "level": "note", "message": {"text": "Unused endpoint: GET /{thread_id}/state"}, "properties": {"repobilityId": "078bd65bba31481e", "scanner": "scanner-primary", "fingerprint": "64d2e4a8cf00a704", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cff8da5fbc19c76d", "level": "note", "message": {"text": "Unused endpoint: POST /chat"}, "properties": {"repobilityId": "eeae5f7fc3fbc380", "scanner": "scanner-primary", "fingerprint": "cff8da5fbc19c76d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9de4cecd0e235584", "level": "note", "message": {"text": "Unused endpoint: GET /pending"}, "properties": {"repobilityId": "19c8113c4185a43d", "scanner": "scanner-primary", "fingerprint": "9de4cecd0e235584", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-afc064028ae39ea9", "level": "note", "message": {"text": "Unused endpoint: GET /history"}, "properties": {"repobilityId": "6fdaee5591c3e988", "scanner": "scanner-primary", "fingerprint": "afc064028ae39ea9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-347228e334452f2b", "level": "note", "message": {"text": "Unused endpoint: DELETE /{record_id}"}, "properties": {"repobilityId": "98c85a4e184a8b82", "scanner": "scanner-primary", "fingerprint": "347228e334452f2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fb1d8f3f6903e5fd", "level": "note", "message": {"text": "Unused endpoint: POST /api/me/subscribe"}, "properties": {"repobilityId": "3a340db0d6da824a", "scanner": "scanner-primary", "fingerprint": "fb1d8f3f6903e5fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-625a893b217624aa", "level": "note", "message": {"text": "Unused endpoint: PUT /api/me/tencent"}, "properties": {"repobilityId": "0ae3abda02080ffb", "scanner": "scanner-primary", "fingerprint": "625a893b217624aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-26551b3bc3ade2f4", "level": "note", "message": {"text": "Unused endpoint: POST /api/calendar/dismiss"}, "properties": {"repobilityId": "3995ab3403171853", "scanner": "scanner-primary", "fingerprint": "26551b3bc3ade2f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17534e44084f45be", "level": "note", "message": {"text": "Unused endpoint: POST /api/calendar/events"}, "properties": {"repobilityId": "98dab46b96759f0e", "scanner": "scanner-primary", "fingerprint": "17534e44084f45be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-31ae57b8e012eb02", "level": "note", "message": {"text": "Unused endpoint: PUT /api/me"}, "properties": {"repobilityId": "d856770b959dd818", "scanner": "scanner-primary", "fingerprint": "31ae57b8e012eb02", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}