{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-dd774cf9151de186", "name": "Possibly dead Python function: load_dataframe", "shortDescription": {"text": "Possibly dead Python function: load_dataframe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc73c41bb115833c", "name": "Possibly dead Python function: grade_predictions", "shortDescription": {"text": "Possibly dead Python function: grade_predictions"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-787042100682692e", "name": "Possibly dead Python function: strategy_connors_rsi2", "shortDescription": {"text": "Possibly dead Python function: strategy_connors_rsi2"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8b1e850c3a91309", "name": "Possibly dead Python function: strategy_short_squeeze", "shortDescription": {"text": "Possibly dead Python function: strategy_short_squeeze"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-863bc1884ecac983", "name": "Possibly dead Python function: strategy_vix_contrarian", "shortDescription": {"text": "Possibly dead Python function: strategy_vix_contrarian"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f2fde7f49b29529", "name": "Possibly dead Python function: strategy_pre_earnings_drift", "shortDescription": {"text": "Possibly dead Python function: strategy_pre_earnings_drift"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77958c0dfcf8930c", "name": "Possibly dead Python function: strategy_peer_lead_lag", "shortDescription": {"text": "Possibly dead Python function: strategy_peer_lead_lag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cce484f72d95366f", "name": "Possibly dead Python function: strategy_gap_fade", "shortDescription": {"text": "Possibly dead Python function: strategy_gap_fade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83563f8762f56f6a", "name": "Possibly dead Python function: strategy_52w_breakout", "shortDescription": {"text": "Possibly dead Python function: strategy_52w_breakout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-510205c6397c3328", "name": "Possibly dead Python function: strategy_news_overreaction", "shortDescription": {"text": "Possibly dead Python function: strategy_news_overreaction"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bd9767f6eebe032", "name": "Possibly dead Python function: run_all_strategies", "shortDescription": {"text": "Possibly dead Python function: run_all_strategies"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96ae0b84ea35dab8", "name": "Possibly dead Python function: record", "shortDescription": {"text": "Possibly dead Python function: record"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dc6aa7d791ef05c", "name": "Possibly dead Python function: grade_pending", "shortDescription": {"text": "Possibly dead Python function: grade_pending"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30ab6205641f43d8", "name": "Possibly dead Python function: load_recent", "shortDescription": {"text": "Possibly dead Python function: load_recent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45cd226b4a5a8c64", "name": "Possibly dead Python function: generate_and_validate_ml", "shortDescription": {"text": "Possibly dead Python function: generate_and_validate_ml"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-357980108753e60d", "name": "Icon-only button without accessible name \u2014 frontend/app/mine/page.tsx:318", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/app/mine/page.tsx:318"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21490736ea5ddb09", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/mine/page.tsx:977", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/mine/page.tsx:977"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a84605a624aec316", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/_components/edge-card.tsx:208", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/_components/edge-card.tsx:208"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-81d0148f10973247", "name": "Insecure pattern 'exec_used' in backend/api.py:666", "shortDescription": {"text": "Insecure pattern 'exec_used' in backend/api.py:666"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c6e75b42b1512ade", "name": "Insecure pattern 'exec_used' in backend/factors/ml_factor.py:104", "shortDescription": {"text": "Insecure pattern 'exec_used' in backend/factors/ml_factor.py:104"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-79e25700dec6922f", "name": "Insecure pattern 'exec_used' in backend/factors/generator.py:309", "shortDescription": {"text": "Insecure pattern 'exec_used' in backend/factors/generator.py:309"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3336d4b9c4d3e94d", "name": "Insecure pattern 'exec_used' in backend/execution/trader.py:143", "shortDescription": {"text": "Insecure pattern 'exec_used' in backend/execution/trader.py:143"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1e62c8a8becdce0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11fe6710547243fb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d665a0ced04c2bc", "name": "Very large file: frontend/app/mine/page.tsx (1389 lines)", "shortDescription": {"text": "Very large file: frontend/app/mine/page.tsx (1389 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b51287e1cdcd9b29", "name": "Very large file: backend/api.py (1268 lines)", "shortDescription": {"text": "Very large file: backend/api.py (1268 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 38 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 50 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e3b71f88412f64b8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/mine/page.tsx:697", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/mine/page.tsx:697"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03a3780062ae8812", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/_lib/data.ts:283", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/_lib/data.ts:283"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/dashboard/holdings.py:get_holdings_signal, backend/dashboard/reddit.py:fetch_reddit_signal, backend/dashboard/intraday.py:get_intraday_signal\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/factors/generator.py:generate_and_validate, backend/factors/generator.py:generate_and_validate_ml\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ae75c865b1fc590", "name": "FastAPI POST `admin_reset` without auth dependency \u2014 backend/api.py:594", "shortDescription": {"text": "FastAPI POST `admin_reset` without auth dependency \u2014 backend/api.py:594"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-233b6376a03f12a6", "name": "FastAPI POST `toggle_favorite` without auth dependency \u2014 backend/api.py:617", "shortDescription": {"text": "FastAPI POST `toggle_favorite` without auth dependency \u2014 backend/api.py:617"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3412c2570df50b78", "name": "FastAPI POST `refresh_brief` without auth dependency \u2014 backend/api.py:1037", "shortDescription": {"text": "FastAPI POST `refresh_brief` without auth dependency \u2014 backend/api.py:1037"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-54547dcba0b1e4b9", "name": "FastAPI POST `refresh_decision` without auth dependency \u2014 backend/api.py:1081", "shortDescription": {"text": "FastAPI POST `refresh_decision` without auth dependency \u2014 backend/api.py:1081"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34e1c005c837f757", "name": "Unused endpoint: GET /mining/stream", "shortDescription": {"text": "Unused endpoint: GET /mining/stream"}, "fullDescription": {"text": "`backend/api.py` declares `GET /mining/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e1da848e800b57c", "name": "Unused endpoint: POST /admin/reset", "shortDescription": {"text": "Unused endpoint: POST /admin/reset"}, "fullDescription": {"text": "`backend/api.py` declares `POST /admin/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add6dcb6007baef6", "name": "Unused endpoint: GET /leaderboard", "shortDescription": {"text": "Unused endpoint: GET /leaderboard"}, "fullDescription": {"text": "`backend/api.py` declares `GET /leaderboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c35b4026f424e5d", "name": "Unused endpoint: POST /factors/{factor_id}/favorite", "shortDescription": {"text": "Unused endpoint: POST /factors/{factor_id}/favorite"}, "fullDescription": {"text": "`backend/api.py` declares `POST /factors/{factor_id}/favorite` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b474318b6e84699b", "name": "Unused endpoint: GET /factors/{factor_id}/code", "shortDescription": {"text": "Unused endpoint: GET /factors/{factor_id}/code"}, "fullDescription": {"text": "`backend/api.py` declares `GET /factors/{factor_id}/code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-437f1116a4da8316", "name": "Unused endpoint: GET /factors/{factor_id}/chart", "shortDescription": {"text": "Unused endpoint: GET /factors/{factor_id}/chart"}, "fullDescription": {"text": "`backend/api.py` declares `GET /factors/{factor_id}/chart` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74e48d6e93739e19", "name": "Unused endpoint: GET /today/signals", "shortDescription": {"text": "Unused endpoint: GET /today/signals"}, "fullDescription": {"text": "`backend/api.py` declares `GET /today/signals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61f54b0d47081390", "name": "Unused endpoint: GET /dashboard/snapshot", "shortDescription": {"text": "Unused endpoint: GET /dashboard/snapshot"}, "fullDescription": {"text": "`backend/api.py` declares `GET /dashboard/snapshot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d36aa28c667f282d", "name": "Unused endpoint: POST /dashboard/brief/refresh", "shortDescription": {"text": "Unused endpoint: POST /dashboard/brief/refresh"}, "fullDescription": {"text": "`backend/api.py` declares `POST /dashboard/brief/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ba57cac4146654", "name": "Unused endpoint: GET /quote/live", "shortDescription": {"text": "Unused endpoint: GET /quote/live"}, "fullDescription": {"text": "`backend/api.py` declares `GET /quote/live` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f519760104895a5b", "name": "Unused endpoint: POST /dashboard/decision/refresh", "shortDescription": {"text": "Unused endpoint: POST /dashboard/decision/refresh"}, "fullDescription": {"text": "`backend/api.py` declares `POST /dashboard/decision/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79e631b6ba959b78", "name": "Unused endpoint: GET /dashboard/calibration", "shortDescription": {"text": "Unused endpoint: GET /dashboard/calibration"}, "fullDescription": {"text": "`backend/api.py` declares `GET /dashboard/calibration` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eaf43defca5bd267", "name": "Unused endpoint: GET /trading/status", "shortDescription": {"text": "Unused endpoint: GET /trading/status"}, "fullDescription": {"text": "`backend/api.py` declares `GET /trading/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f307088e70b2c1fb", "name": "Unused endpoint: GET /trading/execute", "shortDescription": {"text": "Unused endpoint: GET /trading/execute"}, "fullDescription": {"text": "`backend/api.py` declares `GET /trading/execute` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23487"}, "properties": {"repository": "z569045281/qbts-quant-lab", "repoUrl": "https://github.com/z569045281/qbts-quant-lab", "branch": "main"}, "results": [{"ruleId": "scanner-dd774cf9151de186", "level": "note", "message": {"text": "Possibly dead Python function: load_dataframe"}, "properties": {"repobilityId": "1c927a53f5c70c48", "scanner": "scanner-primary", "fingerprint": "dd774cf9151de186", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "data_pipeline.py:65"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc73c41bb115833c", "level": "note", "message": {"text": "Possibly dead Python function: grade_predictions"}, "properties": {"repobilityId": "d17693d635b8967f", "scanner": "scanner-primary", "fingerprint": "bc73c41bb115833c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/calibration.py:97"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-787042100682692e", "level": "note", "message": {"text": "Possibly dead Python function: strategy_connors_rsi2"}, "properties": {"repobilityId": "99bf119e054a3296", "scanner": "scanner-primary", "fingerprint": "787042100682692e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8b1e850c3a91309", "level": "note", "message": {"text": "Possibly dead Python function: strategy_short_squeeze"}, "properties": {"repobilityId": "5a938b78b5519b6c", "scanner": "scanner-primary", "fingerprint": "f8b1e850c3a91309", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:121"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-863bc1884ecac983", "level": "note", "message": {"text": "Possibly dead Python function: strategy_vix_contrarian"}, "properties": {"repobilityId": "1f95230d3f1e08da", "scanner": "scanner-primary", "fingerprint": "863bc1884ecac983", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:165"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f2fde7f49b29529", "level": "note", "message": {"text": "Possibly dead Python function: strategy_pre_earnings_drift"}, "properties": {"repobilityId": "d41e8f6b65b7e5b3", "scanner": "scanner-primary", "fingerprint": "1f2fde7f49b29529", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77958c0dfcf8930c", "level": "note", "message": {"text": "Possibly dead Python function: strategy_peer_lead_lag"}, "properties": {"repobilityId": "866222b22b78e4a3", "scanner": "scanner-primary", "fingerprint": "77958c0dfcf8930c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:245"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cce484f72d95366f", "level": "note", "message": {"text": "Possibly dead Python function: strategy_gap_fade"}, "properties": {"repobilityId": "64b67af63b6fba16", "scanner": "scanner-primary", "fingerprint": "cce484f72d95366f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:290"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83563f8762f56f6a", "level": "note", "message": {"text": "Possibly dead Python function: strategy_52w_breakout"}, "properties": {"repobilityId": "f7bcda5d836feaa7", "scanner": "scanner-primary", "fingerprint": "83563f8762f56f6a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:329"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-510205c6397c3328", "level": "note", "message": {"text": "Possibly dead Python function: strategy_news_overreaction"}, "properties": {"repobilityId": "38dd597327793f5c", "scanner": "scanner-primary", "fingerprint": "510205c6397c3328", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:369"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6bd9767f6eebe032", "level": "note", "message": {"text": "Possibly dead Python function: run_all_strategies"}, "properties": {"repobilityId": "c0572d30f4510cdd", "scanner": "scanner-primary", "fingerprint": "6bd9767f6eebe032", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/strategies.py:424"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96ae0b84ea35dab8", "level": "note", "message": {"text": "Possibly dead Python function: record"}, "properties": {"repobilityId": "954506f60a17269d", "scanner": "scanner-primary", "fingerprint": "96ae0b84ea35dab8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/journal.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7dc6aa7d791ef05c", "level": "note", "message": {"text": "Possibly dead Python function: grade_pending"}, "properties": {"repobilityId": "98fdede9ce2b9dc1", "scanner": "scanner-primary", "fingerprint": "7dc6aa7d791ef05c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/journal.py:87"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-30ab6205641f43d8", "level": "note", "message": {"text": "Possibly dead Python function: load_recent"}, "properties": {"repobilityId": "c1a38b95626fc909", "scanner": "scanner-primary", "fingerprint": "30ab6205641f43d8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/dashboard/journal.py:194"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45cd226b4a5a8c64", "level": "note", "message": {"text": "Possibly dead Python function: generate_and_validate_ml"}, "properties": {"repobilityId": "64dd125c908d0051", "scanner": "scanner-primary", "fingerprint": "45cd226b4a5a8c64", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/factors/generator.py:565"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-357980108753e60d", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/app/mine/page.tsx:318"}, "properties": {"repobilityId": "e0d82cb395dc9b99", "scanner": "scanner-primary", "fingerprint": "357980108753e60d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-21490736ea5ddb09", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/mine/page.tsx:977"}, "properties": {"repobilityId": "baf709f8e1d8d592", "scanner": "scanner-primary", "fingerprint": "21490736ea5ddb09", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a84605a624aec316", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/_components/edge-card.tsx:208"}, "properties": {"repobilityId": "cfc6ec8266e21807", "scanner": "scanner-primary", "fingerprint": "a84605a624aec316", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-81d0148f10973247", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in backend/api.py:666"}, "properties": {"repobilityId": "92ab1ca2190d90a3", "scanner": "scanner-primary", "fingerprint": "81d0148f10973247", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api.py"}, "region": {"startLine": 666}}}]}, {"ruleId": "scanner-c6e75b42b1512ade", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in backend/factors/ml_factor.py:104"}, "properties": {"repobilityId": "035375b7c056360f", "scanner": "scanner-primary", "fingerprint": "c6e75b42b1512ade", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/factors/ml_factor.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-79e25700dec6922f", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in backend/factors/generator.py:309"}, "properties": {"repobilityId": "ff1c2b3c75180238", "scanner": "scanner-primary", "fingerprint": "79e25700dec6922f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/factors/generator.py"}, "region": {"startLine": 309}}}]}, {"ruleId": "scanner-3336d4b9c4d3e94d", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in backend/execution/trader.py:143"}, "properties": {"repobilityId": "3cf7861c88bfd55d", "scanner": "scanner-primary", "fingerprint": "3336d4b9c4d3e94d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/execution/trader.py"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-c1e62c8a8becdce0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a5232ca5f9d3d6d", "scanner": "scanner-primary", "fingerprint": "c1e62c8a8becdce0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-11fe6710547243fb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c88f07fd35b9711f", "scanner": "scanner-primary", "fingerprint": "11fe6710547243fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d665a0ced04c2bc", "level": "note", "message": {"text": "Very large file: frontend/app/mine/page.tsx (1389 lines)"}, "properties": {"repobilityId": "fb4b1939d97a017f", "scanner": "scanner-primary", "fingerprint": "1d665a0ced04c2bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b51287e1cdcd9b29", "level": "note", "message": {"text": "Very large file: backend/api.py (1268 lines)"}, "properties": {"repobilityId": "88bade38451fcd93", "scanner": "scanner-primary", "fingerprint": "b51287e1cdcd9b29", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "42c35d309e7b2608", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0c56ac3aeb900744", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "7f661cb8a5f012ae", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "02e634a8d757d3d1", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "428bfe422488ae79", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f7bc80505e37dc7a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5a735dbb852b1df0", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "93384c44ee5eaf08", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e3b71f88412f64b8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/mine/page.tsx:697"}, "properties": {"repobilityId": "d47b7f8ccbb16f94", "scanner": "scanner-primary", "fingerprint": "e3b71f88412f64b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-03a3780062ae8812", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/_lib/data.ts:283"}, "properties": {"repobilityId": "a4d73f28b2ba2803", "scanner": "scanner-primary", "fingerprint": "03a3780062ae8812", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b20558009a746e53", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3310f1bd30e2e971", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7a0f00268d19d8f9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6ae75c865b1fc590", "level": "error", "message": {"text": "FastAPI POST `admin_reset` without auth dependency \u2014 backend/api.py:594"}, "properties": {"repobilityId": "47e49b3dfddf92e0", "scanner": "scanner-primary", "fingerprint": "6ae75c865b1fc590", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api.py"}, "region": {"startLine": 594}}}]}, {"ruleId": "scanner-233b6376a03f12a6", "level": "error", "message": {"text": "FastAPI POST `toggle_favorite` without auth dependency \u2014 backend/api.py:617"}, "properties": {"repobilityId": "52ffaee40baf99f7", "scanner": "scanner-primary", "fingerprint": "233b6376a03f12a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api.py"}, "region": {"startLine": 617}}}]}, {"ruleId": "scanner-3412c2570df50b78", "level": "error", "message": {"text": "FastAPI POST `refresh_brief` without auth dependency \u2014 backend/api.py:1037"}, "properties": {"repobilityId": "34f80240b7999da5", "scanner": "scanner-primary", "fingerprint": "3412c2570df50b78", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api.py"}, "region": {"startLine": 1037}}}]}, {"ruleId": "scanner-54547dcba0b1e4b9", "level": "error", "message": {"text": "FastAPI POST `refresh_decision` without auth dependency \u2014 backend/api.py:1081"}, "properties": {"repobilityId": "e33cbbff90068d3c", "scanner": "scanner-primary", "fingerprint": "54547dcba0b1e4b9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api.py"}, "region": {"startLine": 1081}}}]}, {"ruleId": "scanner-34e1c005c837f757", "level": "note", "message": {"text": "Unused endpoint: GET /mining/stream"}, "properties": {"repobilityId": "067229bcea906fc3", "scanner": "scanner-primary", "fingerprint": "34e1c005c837f757", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e1da848e800b57c", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reset"}, "properties": {"repobilityId": "accd86274886d134", "scanner": "scanner-primary", "fingerprint": "8e1da848e800b57c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-add6dcb6007baef6", "level": "note", "message": {"text": "Unused endpoint: GET /leaderboard"}, "properties": {"repobilityId": "03bbb8181616f6a4", "scanner": "scanner-primary", "fingerprint": "add6dcb6007baef6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c35b4026f424e5d", "level": "note", "message": {"text": "Unused endpoint: POST /factors/{factor_id}/favorite"}, "properties": {"repobilityId": "3844d37986d1d3f5", "scanner": "scanner-primary", "fingerprint": "9c35b4026f424e5d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b474318b6e84699b", "level": "note", "message": {"text": "Unused endpoint: GET /factors/{factor_id}/code"}, "properties": {"repobilityId": "b986157004da174e", "scanner": "scanner-primary", "fingerprint": "b474318b6e84699b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-437f1116a4da8316", "level": "note", "message": {"text": "Unused endpoint: GET /factors/{factor_id}/chart"}, "properties": {"repobilityId": "34e11387a3d8706a", "scanner": "scanner-primary", "fingerprint": "437f1116a4da8316", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74e48d6e93739e19", "level": "note", "message": {"text": "Unused endpoint: GET /today/signals"}, "properties": {"repobilityId": "070e92ed0be3f5c9", "scanner": "scanner-primary", "fingerprint": "74e48d6e93739e19", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61f54b0d47081390", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard/snapshot"}, "properties": {"repobilityId": "1cabd841ece0000a", "scanner": "scanner-primary", "fingerprint": "61f54b0d47081390", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d36aa28c667f282d", "level": "note", "message": {"text": "Unused endpoint: POST /dashboard/brief/refresh"}, "properties": {"repobilityId": "2ac6be40c4e5d9cd", "scanner": "scanner-primary", "fingerprint": "d36aa28c667f282d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b3ba57cac4146654", "level": "note", "message": {"text": "Unused endpoint: GET /quote/live"}, "properties": {"repobilityId": "c350ab4582107891", "scanner": "scanner-primary", "fingerprint": "b3ba57cac4146654", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f519760104895a5b", "level": "note", "message": {"text": "Unused endpoint: POST /dashboard/decision/refresh"}, "properties": {"repobilityId": "01ebc2629fd9897d", "scanner": "scanner-primary", "fingerprint": "f519760104895a5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-79e631b6ba959b78", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard/calibration"}, "properties": {"repobilityId": "1bc6e5cff3a22e96", "scanner": "scanner-primary", "fingerprint": "79e631b6ba959b78", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eaf43defca5bd267", "level": "note", "message": {"text": "Unused endpoint: GET /trading/status"}, "properties": {"repobilityId": "c61f52a7d1187baf", "scanner": "scanner-primary", "fingerprint": "eaf43defca5bd267", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f307088e70b2c1fb", "level": "note", "message": {"text": "Unused endpoint: GET /trading/execute"}, "properties": {"repobilityId": "ffe73c39b0c9f150", "scanner": "scanner-primary", "fingerprint": "f307088e70b2c1fb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}