{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3580f4a0add2df29", "name": "Possibly dead Python function: metrics_endpoint", "shortDescription": {"text": "Possibly dead Python function: metrics_endpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-804db8f29e0d31bd", "name": "Possibly dead Python function: should_apply_temporal_decay", "shortDescription": {"text": "Possibly dead Python function: should_apply_temporal_decay"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1da9a2a35f4ac2e", "name": "Dockerfile runs as root: api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8a3752fb7f9726f", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60427b03771411b6", "name": "Dockerfile runs as root: frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8230e895fcc016db", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b048d166901fd868", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e2460270d93a260", "name": "Dockerfile runs as root: mcp-server/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: mcp-server/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-103e69ca7b02fc1d", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6b56a011f4378b2", "name": "Possible secret in api/app/services/scanner.py", "shortDescription": {"text": "Possible secret in api/app/services/scanner.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "5 test file(s) for 107 source file(s) (ratio 0.05). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 51 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43b8f19aa0df12a1", "name": "Legacy-named symbol `nbase_dir_old` in api/fixtures/add_seed_traces_2.py:310", "shortDescription": {"text": "Legacy-named symbol `nbase_dir_old` in api/fixtures/add_seed_traces_2.py:310"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a26a5a2ffa83af78", "name": "Legacy-named symbol `postgres_backup` in api/fixtures/add_seed_traces_3.py:86", "shortDescription": {"text": "Legacy-named symbol `postgres_backup` in api/fixtures/add_seed_traces_3.py:86"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe7e6182b733edd6", "name": "Commented-code block (5 lines) in api/migrations/env.py:66", "shortDescription": {"text": "Commented-code block (5 lines) in api/migrations/env.py:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0611ee2526d779ea", "name": "Stub function `downgrade` (body is just `pass`/`return`) \u2014 api/migrations/versions/0018_fix_revision_ids.py:46", "shortDescription": {"text": "Stub function `downgrade` (body is just `pass`/`return`) \u2014 api/migrations/versions/0018_fix_revision_ids.py:46"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4d020fc5b838fc8", "name": "FastAPI POST `admin_mint_invitations` without auth dependency \u2014 api/app/routers/admin.py:341", "shortDescription": {"text": "FastAPI POST `admin_mint_invitations` without auth dependency \u2014 api/app/routers/admin.py:341"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5276c9d98e4ddef3", "name": "FastAPI POST `admin_grant_contributor` without auth dependency \u2014 api/app/routers/admin.py:391", "shortDescription": {"text": "FastAPI POST `admin_grant_contributor` without auth dependency \u2014 api/app/routers/admin.py:391"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3e59d64c9ba02b7", "name": "FastAPI DELETE `admin_delete_user` without auth dependency \u2014 api/app/routers/admin.py:424", "shortDescription": {"text": "FastAPI DELETE `admin_delete_user` without auth dependency \u2014 api/app/routers/admin.py:424"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2f36ca1f26a8b0d9", "name": "FastAPI POST `flag_trace` without auth dependency \u2014 api/app/routers/moderation.py:36", "shortDescription": {"text": "FastAPI POST `flag_trace` without auth dependency \u2014 api/app/routers/moderation.py:36"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f28c73219d42cc57", "name": "FastAPI DELETE `remove_trace` without auth dependency \u2014 api/app/routers/moderation.py:133", "shortDescription": {"text": "FastAPI DELETE `remove_trace` without auth dependency \u2014 api/app/routers/moderation.py:133"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-926f3fac433c1f58", "name": "FastAPI POST `report_trigger_stats` without auth dependency \u2014 api/app/routers/telemetry.py:42", "shortDescription": {"text": "FastAPI POST `report_trigger_stats` without auth dependency \u2014 api/app/routers/telemetry.py:42"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fca96f8478e64d9d", "name": "FastAPI POST `report_install` without auth dependency \u2014 api/app/routers/telemetry.py:83", "shortDescription": {"text": "FastAPI POST `report_install` without auth dependency \u2014 api/app/routers/telemetry.py:83"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7100e075b29f6dd", "name": "FastAPI POST `search_traces` without auth dependency \u2014 api/app/routers/search.py:197", "shortDescription": {"text": "FastAPI POST `search_traces` without auth dependency \u2014 api/app/routers/search.py:197"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ef90e3f11435427", "name": "FastAPI POST `mint_invitation` without auth dependency \u2014 api/app/routers/invitations.py:38", "shortDescription": {"text": "FastAPI POST `mint_invitation` without auth dependency \u2014 api/app/routers/invitations.py:38"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5cd89e6fe12a2b18", "name": "FastAPI POST `redeem_invitation` without auth dependency \u2014 api/app/routers/invitations.py:85", "shortDescription": {"text": "FastAPI POST `redeem_invitation` without auth dependency \u2014 api/app/routers/invitations.py:85"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66e68e213f96774d", "name": "FastAPI POST `generate_api_key` without auth dependency \u2014 api/app/routers/auth.py:27", "shortDescription": {"text": "FastAPI POST `generate_api_key` without auth dependency \u2014 api/app/routers/auth.py:27"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fd3ca9945c3102a6", "name": "FastAPI POST `submit_trace` without auth dependency \u2014 api/app/routers/traces.py:29", "shortDescription": {"text": "FastAPI POST `submit_trace` without auth dependency \u2014 api/app/routers/traces.py:29"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1840ef182bf39a88", "name": "FastAPI POST `cast_vote` without auth dependency \u2014 api/app/routers/votes.py:28", "shortDescription": {"text": "FastAPI POST `cast_vote` without auth dependency \u2014 api/app/routers/votes.py:28"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-55deade2f8874133", "name": "FastAPI POST `submit_amendment` without auth dependency \u2014 api/app/routers/amendments.py:21", "shortDescription": {"text": "FastAPI POST `submit_amendment` without auth dependency \u2014 api/app/routers/amendments.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25066"}, "properties": {"repository": "commontrace/server", "repoUrl": "https://github.com/commontrace/server", "branch": "main"}, "results": [{"ruleId": "scanner-3580f4a0add2df29", "level": "note", "message": {"text": "Possibly dead Python function: metrics_endpoint"}, "properties": {"repobilityId": "84e30d5f2edf5105", "scanner": "scanner-primary", "fingerprint": "3580f4a0add2df29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/metrics.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-804db8f29e0d31bd", "level": "note", "message": {"text": "Possibly dead Python function: should_apply_temporal_decay"}, "properties": {"repobilityId": "eac47d204e151ac1", "scanner": "scanner-primary", "fingerprint": "804db8f29e0d31bd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/services/maturity.py:62"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1da9a2a35f4ac2e", "level": "warning", "message": {"text": "Dockerfile runs as root: api/Dockerfile"}, "properties": {"repobilityId": "d158f2064abae541", "scanner": "scanner-primary", "fingerprint": "a1da9a2a35f4ac2e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e8a3752fb7f9726f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "de34b89e749e6511", "scanner": "scanner-primary", "fingerprint": "e8a3752fb7f9726f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60427b03771411b6", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "properties": {"repobilityId": "735c01d8531dfd2c", "scanner": "scanner-primary", "fingerprint": "60427b03771411b6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8230e895fcc016db", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12.12-slim"}, "properties": {"repobilityId": "882cac4618a63424", "scanner": "scanner-primary", "fingerprint": "8230e895fcc016db", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-b048d166901fd868", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "3a3986588f513e6b", "scanner": "scanner-primary", "fingerprint": "b048d166901fd868", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-0e2460270d93a260", "level": "warning", "message": {"text": "Dockerfile runs as root: mcp-server/Dockerfile"}, "properties": {"repobilityId": "2fc32db9c026ebf2", "scanner": "scanner-primary", "fingerprint": "0e2460270d93a260", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-103e69ca7b02fc1d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "b54f09aa8b360edf", "scanner": "scanner-primary", "fingerprint": "103e69ca7b02fc1d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mcp-server/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6b56a011f4378b2", "level": "error", "message": {"text": "Possible secret in api/app/services/scanner.py"}, "properties": {"repobilityId": "ce303305650b83d1", "scanner": "scanner-primary", "fingerprint": "c6b56a011f4378b2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/services/scanner.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "70da57c7fabefe2d", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f5cc1300e87950ca", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f0c043dbc0671669", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-43b8f19aa0df12a1", "level": "note", "message": {"text": "Legacy-named symbol `nbase_dir_old` in api/fixtures/add_seed_traces_2.py:310"}, "properties": {"repobilityId": "c507e021a11bafd4", "scanner": "scanner-primary", "fingerprint": "43b8f19aa0df12a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a26a5a2ffa83af78", "level": "note", "message": {"text": "Legacy-named symbol `postgres_backup` in api/fixtures/add_seed_traces_3.py:86"}, "properties": {"repobilityId": "9182ccdee4471907", "scanner": "scanner-primary", "fingerprint": "a26a5a2ffa83af78", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fe7e6182b733edd6", "level": "none", "message": {"text": "Commented-code block (5 lines) in api/migrations/env.py:66"}, "properties": {"repobilityId": "fea1dab5d70bd129", "scanner": "scanner-primary", "fingerprint": "fe7e6182b733edd6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0611ee2526d779ea", "level": "note", "message": {"text": "Stub function `downgrade` (body is just `pass`/`return`) \u2014 api/migrations/versions/0018_fix_revision_ids.py:46"}, "properties": {"repobilityId": "582e2aa86f3d26b3", "scanner": "scanner-primary", "fingerprint": "0611ee2526d779ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-e4d020fc5b838fc8", "level": "error", "message": {"text": "FastAPI POST `admin_mint_invitations` without auth dependency \u2014 api/app/routers/admin.py:341"}, "properties": {"repobilityId": "68b8951edfbb5393", "scanner": "scanner-primary", "fingerprint": "e4d020fc5b838fc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/admin.py"}, "region": {"startLine": 341}}}]}, {"ruleId": "scanner-5276c9d98e4ddef3", "level": "error", "message": {"text": "FastAPI POST `admin_grant_contributor` without auth dependency \u2014 api/app/routers/admin.py:391"}, "properties": {"repobilityId": "1536c5869c5016cb", "scanner": "scanner-primary", "fingerprint": "5276c9d98e4ddef3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/admin.py"}, "region": {"startLine": 391}}}]}, {"ruleId": "scanner-c3e59d64c9ba02b7", "level": "error", "message": {"text": "FastAPI DELETE `admin_delete_user` without auth dependency \u2014 api/app/routers/admin.py:424"}, "properties": {"repobilityId": "758d943924e563f8", "scanner": "scanner-primary", "fingerprint": "c3e59d64c9ba02b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/admin.py"}, "region": {"startLine": 424}}}]}, {"ruleId": "scanner-2f36ca1f26a8b0d9", "level": "error", "message": {"text": "FastAPI POST `flag_trace` without auth dependency \u2014 api/app/routers/moderation.py:36"}, "properties": {"repobilityId": "6837585ada1ab6c6", "scanner": "scanner-primary", "fingerprint": "2f36ca1f26a8b0d9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/moderation.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-f28c73219d42cc57", "level": "error", "message": {"text": "FastAPI DELETE `remove_trace` without auth dependency \u2014 api/app/routers/moderation.py:133"}, "properties": {"repobilityId": "06014a98afef26ce", "scanner": "scanner-primary", "fingerprint": "f28c73219d42cc57", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/moderation.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-926f3fac433c1f58", "level": "error", "message": {"text": "FastAPI POST `report_trigger_stats` without auth dependency \u2014 api/app/routers/telemetry.py:42"}, "properties": {"repobilityId": "925652040e5a0e85", "scanner": "scanner-primary", "fingerprint": "926f3fac433c1f58", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/telemetry.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-fca96f8478e64d9d", "level": "error", "message": {"text": "FastAPI POST `report_install` without auth dependency \u2014 api/app/routers/telemetry.py:83"}, "properties": {"repobilityId": "4cd50c0ff2b92062", "scanner": "scanner-primary", "fingerprint": "fca96f8478e64d9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/telemetry.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-d7100e075b29f6dd", "level": "error", "message": {"text": "FastAPI POST `search_traces` without auth dependency \u2014 api/app/routers/search.py:197"}, "properties": {"repobilityId": "530b88890747dfe5", "scanner": "scanner-primary", "fingerprint": "d7100e075b29f6dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/search.py"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-0ef90e3f11435427", "level": "error", "message": {"text": "FastAPI POST `mint_invitation` without auth dependency \u2014 api/app/routers/invitations.py:38"}, "properties": {"repobilityId": "3adde874b82b0d8d", "scanner": "scanner-primary", "fingerprint": "0ef90e3f11435427", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/invitations.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-5cd89e6fe12a2b18", "level": "error", "message": {"text": "FastAPI POST `redeem_invitation` without auth dependency \u2014 api/app/routers/invitations.py:85"}, "properties": {"repobilityId": "c92bd9ba01dbbe9c", "scanner": "scanner-primary", "fingerprint": "5cd89e6fe12a2b18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/invitations.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-66e68e213f96774d", "level": "error", "message": {"text": "FastAPI POST `generate_api_key` without auth dependency \u2014 api/app/routers/auth.py:27"}, "properties": {"repobilityId": "5c477611ce86e9b1", "scanner": "scanner-primary", "fingerprint": "66e68e213f96774d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/auth.py"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-fd3ca9945c3102a6", "level": "error", "message": {"text": "FastAPI POST `submit_trace` without auth dependency \u2014 api/app/routers/traces.py:29"}, "properties": {"repobilityId": "188136bf94cb652a", "scanner": "scanner-primary", "fingerprint": "fd3ca9945c3102a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/traces.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-1840ef182bf39a88", "level": "error", "message": {"text": "FastAPI POST `cast_vote` without auth dependency \u2014 api/app/routers/votes.py:28"}, "properties": {"repobilityId": "6f64a0cf0017da9c", "scanner": "scanner-primary", "fingerprint": "1840ef182bf39a88", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/votes.py"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-55deade2f8874133", "level": "error", "message": {"text": "FastAPI POST `submit_amendment` without auth dependency \u2014 api/app/routers/amendments.py:21"}, "properties": {"repobilityId": "79242f0404900f12", "scanner": "scanner-primary", "fingerprint": "55deade2f8874133", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/amendments.py"}, "region": {"startLine": 21}}}]}]}]}