{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-722be70574a65af8", "name": "Stray `console.log` in TS/JS \u2014 client/src/App.jsx:160", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/App.jsx:160"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98acb1a35c5c4d6f", "name": "Icon-only button without accessible name \u2014 client/src/components/FriendsPanel.jsx:132", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/FriendsPanel.jsx:132"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14e2f1446741339e", "name": "Icon-only button without accessible name \u2014 client/src/components/ClanSettingsModal.jsx:97", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/ClanSettingsModal.jsx:97"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-373c14aced577f4c", "name": "Icon-only button without accessible name \u2014 client/src/components/QuestionParser.jsx:258", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/QuestionParser.jsx:258"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-829619fa2ba14a22", "name": "Icon-only button without accessible name \u2014 client/src/components/AdminApp.jsx:363", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/AdminApp.jsx:363"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2db6c479384ccf40", "name": "Stray `console.log` in TS/JS \u2014 client/src/components/AdminApp.jsx:869", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/AdminApp.jsx:869"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c86673d85644def8", "name": "Icon-only button without accessible name \u2014 client/src/components/BrowseClansModal.jsx:48", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/BrowseClansModal.jsx:48"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75a8e849e0689ca8", "name": "Stray `console.log` in TS/JS \u2014 client/src/components/SoloGame.jsx:117", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/SoloGame.jsx:117"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a77892d73a09c0b", "name": "Icon-only button without accessible name \u2014 client/src/components/Calculator.jsx:195", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/Calculator.jsx:195"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d50d6a781ec3e176", "name": "Icon-only button without accessible name \u2014 client/src/components/CreateClanModal.jsx:40", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/CreateClanModal.jsx:40"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9c647ccf9f47c2", "name": "Icon-only button without accessible name \u2014 client/src/components/Dashboard.jsx:188", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/Dashboard.jsx:188"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5a892c8ec7e2404", "name": "TODO/FIXME marker in shipping code \u2014 client/src/components/Dashboard.jsx:573", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 client/src/components/Dashboard.jsx:573"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ee679f3be0fdc5b", "name": "Stray `console.log` in TS/JS \u2014 client/src/components/Dashboard.jsx:1173", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/Dashboard.jsx:1173"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-575782996c30be4e", "name": "Icon-only button without accessible name \u2014 client/src/components/SettingsDropdown.jsx:46", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/SettingsDropdown.jsx:46"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aaf746d43697ff17", "name": "Stray `console.log` in TS/JS \u2014 client/src/components/PlayPage.jsx:482", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/PlayPage.jsx:482"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1432071345f2273b", "name": "Icon-only button without accessible name \u2014 client/src/components/NotificationsDropdown.jsx:46", "shortDescription": {"text": "Icon-only button without accessible name \u2014 client/src/components/NotificationsDropdown.jsx:46"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78ffed99323f7d5d", "name": "Stray `console.log` in TS/JS \u2014 client/src/components/admin/PlayPageAdmin.jsx:418", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/admin/PlayPageAdmin.jsx:418"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9afcaf0526212a5f", "name": "Stray `console.log` in TS/JS \u2014 client/src/contexts/GameSettingsContext.jsx:34", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/contexts/GameSettingsContext.jsx:34"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6e2521e1eb70322", "name": "Stray `console.log` in TS/JS \u2014 server/migrate-questions.js:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/migrate-questions.js:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28324099343dcc3b", "name": "TODO/FIXME marker in shipping code \u2014 server/index.js:2745", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 server/index.js:2745"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4bf3340ad189a5b9", "name": "Stray `console.log` in TS/JS \u2014 server/index.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7cbd213407e801e", "name": "Possible secret in server/index.js", "shortDescription": {"text": "Possible secret in server/index.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5f1bfd6dd6031619", "name": "Insecure pattern 'cors_wildcard' in server/index.js:65", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in server/index.js:65"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5376785175dda2f8", "name": "Very large file: client/src/components/AdminApp.jsx (7270 lines)", "shortDescription": {"text": "Very large file: client/src/components/AdminApp.jsx (7270 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cab9e255c4cc2465", "name": "Very large file: client/src/components/Dashboard.jsx (1501 lines)", "shortDescription": {"text": "Very large file: client/src/components/Dashboard.jsx (1501 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-764d421d19d6ff67", "name": "Very large file: server/index.js (7332 lines)", "shortDescription": {"text": "Very large file: server/index.js (7332 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 61 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ed68815bca2f8c", "name": "Node manifest has dependencies but no lockfile: package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 157 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 95 placeholder/mock markers across 20 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cab9a804e89ab561", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/App.jsx:157", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/App.jsx:157"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3779b7b8f59c351e", "name": "Commented-code block (5 lines) in client/src/journeySubjects.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/journeySubjects.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae48b22cc370056d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/auth.js:35", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/auth.js:35"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa22a992486edf62", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/ClanSettingsModal.jsx:70", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/ClanSettingsModal.jsx:70"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcfacadd5bc27970", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/JourneyMode.jsx:120", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/JourneyMode.jsx:120"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e893a6f7af5e09e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/QuestionParser.jsx:219", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/QuestionParser.jsx:219"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-693c5dc3546952d0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/AdminApp.jsx:88", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/AdminApp.jsx:88"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-834bdd8de8dd5602", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/SoloGame.jsx:110", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/SoloGame.jsx:110"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38211c77a8c0c0c3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/AnKingMode.jsx:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/AnKingMode.jsx:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b83dfa889ac769cd", "name": "Legacy-named symbol `mrb_welcome_v1` in client/src/components/Dashboard.jsx:77", "shortDescription": {"text": "Legacy-named symbol `mrb_welcome_v1` in client/src/components/Dashboard.jsx:77"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1c74393b3451665", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/Dashboard.jsx:388", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/Dashboard.jsx:388"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5dc9a9534b31aacc", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/admin/PlayPageAdmin.jsx:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/admin/PlayPageAdmin.jsx:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c92c2acf30d88c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/admin/AnKingAdmin.jsx:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/admin/AnKingAdmin.jsx:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eeef576d821a7402", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/contexts/GameSettingsContext.jsx:35", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/contexts/GameSettingsContext.jsx:35"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e52fa60cf58f16f", "name": "Commented-code block (6 lines) in server/index.js:6143", "shortDescription": {"text": "Commented-code block (6 lines) in server/index.js:6143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e1f78e6547a511b", "name": "Frontend route `/admin/*` has no Link/navigate to it \u2014 client/src/main.jsx", "shortDescription": {"text": "Frontend route `/admin/*` has no Link/navigate to it \u2014 client/src/main.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56f8a5ea651ff6df", "name": "Frontend route `/auth/callback` has no Link/navigate to it \u2014 client/src/main.jsx", "shortDescription": {"text": "Frontend route `/auth/callback` has no Link/navigate to it \u2014 client/src/main.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e60eeeb1acada7ce", "name": "Frontend route `/stats` has no Link/navigate to it \u2014 client/src/main.jsx", "shortDescription": {"text": "Frontend route `/stats` has no Link/navigate to it \u2014 client/src/main.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cd2810551d325f1", "name": "Frontend route `/*` has no Link/navigate to it \u2014 client/src/main.jsx", "shortDescription": {"text": "Frontend route `/*` has no Link/navigate to it \u2014 client/src/main.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f1b48a4adbde1a7", "name": "Dangling fetch: GET https://usmle-battle-royale-production.up.railway.app/api/game-settings (client/src/App.jsx:157)", "shortDescription": {"text": "Dangling fetch: GET https://usmle-battle-royale-production.up.railway.app/api/game-settings (client/src/App.jsx:157)"}, "fullDescription": {"text": "`client/src/App.jsx:157` calls `GET https://usmle-battle-royale-production.up.railway.app/api/game-settings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/usmle-battle-royale-production.up.railway.app/api/game-settings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b9470fe01bc8073a", "name": "Dangling fetch: DELETE /admin/landing-images/journey_bg (client/src/components/AdminApp.jsx:3635)", "shortDescription": {"text": "Dangling fetch: DELETE /admin/landing-images/journey_bg (client/src/components/AdminApp.jsx:3635)"}, "fullDescription": {"text": "`client/src/components/AdminApp.jsx:3635` calls `DELETE /admin/landing-images/journey_bg` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:apiCall\nNormalized path used for matching: `/admin/landing-images/journey_bg`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a94e72d5264d582c", "name": "Unused endpoint: GET /api/questions/counts", "shortDescription": {"text": "Unused endpoint: GET /api/questions/counts"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/questions/counts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbbd1702e014928c", "name": "Unused endpoint: GET /api/questions", "shortDescription": {"text": "Unused endpoint: GET /api/questions"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/questions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-674b87efe73a14de", "name": "Unused endpoint: GET /api/questions/anking", "shortDescription": {"text": "Unused endpoint: GET /api/questions/anking"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/questions/anking` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9f0c712241895d", "name": "Unused endpoint: GET /auth/google", "shortDescription": {"text": "Unused endpoint: GET /auth/google"}, "fullDescription": {"text": "`server/index.js` declares `GET /auth/google` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-392dcbd9c0e4ed85", "name": "Unused endpoint: GET /auth/google/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/google/callback"}, "fullDescription": {"text": "`server/index.js` declares `GET /auth/google/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac42422b23e45104", "name": "Unused endpoint: GET /auth/me", "shortDescription": {"text": "Unused endpoint: GET /auth/me"}, "fullDescription": {"text": "`server/index.js` declares `GET /auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`server/index.js` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c83bd2cd15bd5b61", "name": "Unused endpoint: PUT /auth/username", "shortDescription": {"text": "Unused endpoint: PUT /auth/username"}, "fullDescription": {"text": "`server/index.js` declares `PUT /auth/username` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71604d8bfb41db87", "name": "Unused endpoint: PUT /auth/preferences", "shortDescription": {"text": "Unused endpoint: PUT /auth/preferences"}, "fullDescription": {"text": "`server/index.js` declares `PUT /auth/preferences` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953d9b44e5c01a62", "name": "Unused endpoint: POST /api/clans", "shortDescription": {"text": "Unused endpoint: POST /api/clans"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8016cafdd1f2cc3", "name": "Unused endpoint: GET /api/clans/search", "shortDescription": {"text": "Unused endpoint: GET /api/clans/search"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be62889bfe7c8197", "name": "Unused endpoint: GET /api/clans/leaderboard", "shortDescription": {"text": "Unused endpoint: GET /api/clans/leaderboard"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/leaderboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78b9a6e770bde6be", "name": "Unused endpoint: POST /api/clans/:id/join", "shortDescription": {"text": "Unused endpoint: POST /api/clans/:id/join"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/:id/join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b77746c16d302645", "name": "Unused endpoint: POST /api/clans/leave", "shortDescription": {"text": "Unused endpoint: POST /api/clans/leave"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/leave` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5dcdbc227daa3c51", "name": "Unused endpoint: GET /api/clans/user/:userId", "shortDescription": {"text": "Unused endpoint: GET /api/clans/user/:userId"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/user/:userId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93b98e055f377bf1", "name": "Unused endpoint: GET /api/clans/:clanId", "shortDescription": {"text": "Unused endpoint: GET /api/clans/:clanId"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/:clanId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99181778ebe25984", "name": "Unused endpoint: GET /api/clans/:clanId/chat", "shortDescription": {"text": "Unused endpoint: GET /api/clans/:clanId/chat"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/:clanId/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18302a224579c7e1", "name": "Unused endpoint: POST /api/clans/:clanId/chat", "shortDescription": {"text": "Unused endpoint: POST /api/clans/:clanId/chat"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/:clanId/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b7ae445df381f6d", "name": "Unused endpoint: POST /api/clans/:clanId/request", "shortDescription": {"text": "Unused endpoint: POST /api/clans/:clanId/request"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/:clanId/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8f296cc7bb42303", "name": "Unused endpoint: GET /api/clans/:clanId/requests", "shortDescription": {"text": "Unused endpoint: GET /api/clans/:clanId/requests"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/:clanId/requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-783758a8f1ef63a1", "name": "Unused endpoint: POST /api/clans/:clanId/requests/:requestId/:action", "shortDescription": {"text": "Unused endpoint: POST /api/clans/:clanId/requests/:requestId/:action"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/:clanId/requests/:requestId/:action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f2c8305e35f7222", "name": "Unused endpoint: DELETE /api/clans/:clanId/members/:userId", "shortDescription": {"text": "Unused endpoint: DELETE /api/clans/:clanId/members/:userId"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/clans/:clanId/members/:userId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9df591b05862b39c", "name": "Unused endpoint: PUT /api/clans/:clanId/members/:userId/role", "shortDescription": {"text": "Unused endpoint: PUT /api/clans/:clanId/members/:userId/role"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/clans/:clanId/members/:userId/role` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3bebd88f8da6134", "name": "Unused endpoint: PUT /api/clans/:clanId", "shortDescription": {"text": "Unused endpoint: PUT /api/clans/:clanId"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/clans/:clanId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8bcec616ba53174", "name": "Unused endpoint: GET /api/clans", "shortDescription": {"text": "Unused endpoint: GET /api/clans"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-daec8ca39b59287c", "name": "Unused endpoint: POST /api/users/online-status", "shortDescription": {"text": "Unused endpoint: POST /api/users/online-status"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/users/online-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9729816f8e37ae91", "name": "Unused endpoint: GET /api/clans/:clanId/quests", "shortDescription": {"text": "Unused endpoint: GET /api/clans/:clanId/quests"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/:clanId/quests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9ea051acc882f7b", "name": "Unused endpoint: POST /api/clans/:clanId/quests", "shortDescription": {"text": "Unused endpoint: POST /api/clans/:clanId/quests"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/:clanId/quests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a9e7f60b46e96e0", "name": "Unused endpoint: PUT /api/clans/:clanId/quests/:questId/progress", "shortDescription": {"text": "Unused endpoint: PUT /api/clans/:clanId/quests/:questId/progress"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/clans/:clanId/quests/:questId/progress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f078d1726a2e0f16", "name": "Unused endpoint: DELETE /api/clans/:clanId/quests/:questId", "shortDescription": {"text": "Unused endpoint: DELETE /api/clans/:clanId/quests/:questId"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/clans/:clanId/quests/:questId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9864a1fe3ef302a1", "name": "Unused endpoint: GET /api/clans/rankings", "shortDescription": {"text": "Unused endpoint: GET /api/clans/rankings"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/clans/rankings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-669551a39b083ca1", "name": "Unused endpoint: POST /api/clans/:clanId/score", "shortDescription": {"text": "Unused endpoint: POST /api/clans/:clanId/score"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/clans/:clanId/score` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83eeb9941dce5068", "name": "Unused endpoint: GET /api/username/check", "shortDescription": {"text": "Unused endpoint: GET /api/username/check"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/username/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b148a50a90d3352c", "name": "Unused endpoint: GET /api/leaderboard/players", "shortDescription": {"text": "Unused endpoint: GET /api/leaderboard/players"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/leaderboard/players` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5dace5cb10bdba2", "name": "Unused endpoint: GET /api/leaderboard/clans", "shortDescription": {"text": "Unused endpoint: GET /api/leaderboard/clans"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/leaderboard/clans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c7075fd68d75173", "name": "Unused endpoint: GET /api/users/search", "shortDescription": {"text": "Unused endpoint: GET /api/users/search"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/users/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e19b0f4df12c38b6", "name": "Unused endpoint: GET /api/friends/:userId", "shortDescription": {"text": "Unused endpoint: GET /api/friends/:userId"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/friends/:userId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a61806e7e9816f5a", "name": "Unused endpoint: GET /api/friends/requests/:userId", "shortDescription": {"text": "Unused endpoint: GET /api/friends/requests/:userId"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/friends/requests/:userId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1204f06bc1860ec6", "name": "Unused endpoint: POST /api/friends/request", "shortDescription": {"text": "Unused endpoint: POST /api/friends/request"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/friends/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c77ecf98d87f5ab3", "name": "Unused endpoint: POST /api/friends/accept", "shortDescription": {"text": "Unused endpoint: POST /api/friends/accept"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/friends/accept` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d561b5e541cdd013", "name": "Unused endpoint: DELETE /api/friends/:friendshipId", "shortDescription": {"text": "Unused endpoint: DELETE /api/friends/:friendshipId"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/friends/:friendshipId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8ed8aa0acb39126", "name": "Unused endpoint: POST /api/lobby/invite", "shortDescription": {"text": "Unused endpoint: POST /api/lobby/invite"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/lobby/invite` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0722dd9aa5afa5a0", "name": "Unused endpoint: POST /admin/reset-leaderboards", "shortDescription": {"text": "Unused endpoint: POST /admin/reset-leaderboards"}, "fullDescription": {"text": "`server/index.js` declares `POST /admin/reset-leaderboards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7485384adf485475", "name": "Unused endpoint: POST /admin/reset-tower-progress", "shortDescription": {"text": "Unused endpoint: POST /admin/reset-tower-progress"}, "fullDescription": {"text": "`server/index.js` declares `POST /admin/reset-tower-progress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af87dcd9b6e548c9", "name": "Unused endpoint: GET /api/landing-images", "shortDescription": {"text": "Unused endpoint: GET /api/landing-images"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/landing-images` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78c776f67c631749", "name": "Unused endpoint: GET /api/landing-settings", "shortDescription": {"text": "Unused endpoint: GET /api/landing-settings"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/landing-settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a8705fbec7c149d", "name": "Unused endpoint: GET /api/home-images", "shortDescription": {"text": "Unused endpoint: GET /api/home-images"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/home-images` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e4e68f3083b35e4", "name": "Unused endpoint: POST /api/admin/preview-anki", "shortDescription": {"text": "Unused endpoint: POST /api/admin/preview-anki"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/admin/preview-anki` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9501c33a0728a6b", "name": "Unused endpoint: POST /api/admin/import-anki", "shortDescription": {"text": "Unused endpoint: POST /api/admin/import-anki"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/admin/import-anki` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcbe82324943cb9e", "name": "Unused endpoint: GET /admin/topic-groups", "shortDescription": {"text": "Unused endpoint: GET /admin/topic-groups"}, "fullDescription": {"text": "`server/index.js` declares `GET /admin/topic-groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21997"}, "properties": {"repository": "uthmanfizzy/usmle-battle-royale", "repoUrl": "https://github.com/uthmanfizzy/usmle-battle-royale", "branch": "main"}, "results": [{"ruleId": "scanner-722be70574a65af8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/App.jsx:160"}, "properties": {"repobilityId": "d5833873736093f0", "scanner": "scanner-primary", "fingerprint": "722be70574a65af8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-98acb1a35c5c4d6f", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/FriendsPanel.jsx:132"}, "properties": {"repobilityId": "72aae23f1c0a91b0", "scanner": "scanner-primary", "fingerprint": "98acb1a35c5c4d6f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-14e2f1446741339e", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/ClanSettingsModal.jsx:97"}, "properties": {"repobilityId": "40d5ae392c3c214b", "scanner": "scanner-primary", "fingerprint": "14e2f1446741339e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-373c14aced577f4c", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/QuestionParser.jsx:258"}, "properties": {"repobilityId": "9f623f77aea6e521", "scanner": "scanner-primary", "fingerprint": "373c14aced577f4c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-829619fa2ba14a22", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/AdminApp.jsx:363"}, "properties": {"repobilityId": "9c98147da19449c4", "scanner": "scanner-primary", "fingerprint": "829619fa2ba14a22", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-2db6c479384ccf40", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/AdminApp.jsx:869"}, "properties": {"repobilityId": "030fffe1696b89b0", "scanner": "scanner-primary", "fingerprint": "2db6c479384ccf40", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c86673d85644def8", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/BrowseClansModal.jsx:48"}, "properties": {"repobilityId": "91c9d81959e43f7d", "scanner": "scanner-primary", "fingerprint": "c86673d85644def8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-75a8e849e0689ca8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/SoloGame.jsx:117"}, "properties": {"repobilityId": "66f3fcedfe9eaba6", "scanner": "scanner-primary", "fingerprint": "75a8e849e0689ca8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5a77892d73a09c0b", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/Calculator.jsx:195"}, "properties": {"repobilityId": "1129e64eaed56df1", "scanner": "scanner-primary", "fingerprint": "5a77892d73a09c0b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-d50d6a781ec3e176", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/CreateClanModal.jsx:40"}, "properties": {"repobilityId": "014eee1717a05962", "scanner": "scanner-primary", "fingerprint": "d50d6a781ec3e176", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-2e9c647ccf9f47c2", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/Dashboard.jsx:188"}, "properties": {"repobilityId": "1a78e914ceed6a23", "scanner": "scanner-primary", "fingerprint": "2e9c647ccf9f47c2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-b5a892c8ec7e2404", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 client/src/components/Dashboard.jsx:573"}, "properties": {"repobilityId": "0392d221f437c23d", "scanner": "scanner-primary", "fingerprint": "b5a892c8ec7e2404", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-1ee679f3be0fdc5b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/Dashboard.jsx:1173"}, "properties": {"repobilityId": "79a6133f83c0e950", "scanner": "scanner-primary", "fingerprint": "1ee679f3be0fdc5b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-575782996c30be4e", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/SettingsDropdown.jsx:46"}, "properties": {"repobilityId": "472499824f179e90", "scanner": "scanner-primary", "fingerprint": "575782996c30be4e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-aaf746d43697ff17", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/PlayPage.jsx:482"}, "properties": {"repobilityId": "9c380e1b3e05d891", "scanner": "scanner-primary", "fingerprint": "aaf746d43697ff17", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1432071345f2273b", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 client/src/components/NotificationsDropdown.jsx:46"}, "properties": {"repobilityId": "d8ce509102c0cb27", "scanner": "scanner-primary", "fingerprint": "1432071345f2273b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-78ffed99323f7d5d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/components/admin/PlayPageAdmin.jsx:418"}, "properties": {"repobilityId": "0a220c856f1c6a3f", "scanner": "scanner-primary", "fingerprint": "78ffed99323f7d5d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9afcaf0526212a5f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/contexts/GameSettingsContext.jsx:34"}, "properties": {"repobilityId": "aaf8959009dae9fc", "scanner": "scanner-primary", "fingerprint": "9afcaf0526212a5f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d6e2521e1eb70322", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/migrate-questions.js:27"}, "properties": {"repobilityId": "109b23db99f75f4b", "scanner": "scanner-primary", "fingerprint": "d6e2521e1eb70322", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-28324099343dcc3b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 server/index.js:2745"}, "properties": {"repobilityId": "cececb9462220798", "scanner": "scanner-primary", "fingerprint": "28324099343dcc3b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-4bf3340ad189a5b9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:1"}, "properties": {"repobilityId": "21e6b3de2b3dd856", "scanner": "scanner-primary", "fingerprint": "4bf3340ad189a5b9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a7cbd213407e801e", "level": "error", "message": {"text": "Possible secret in server/index.js"}, "properties": {"repobilityId": "c82fa6903fbf43ce", "scanner": "scanner-primary", "fingerprint": "a7cbd213407e801e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/index.js"}, "region": {"startLine": 426}}}]}, {"ruleId": "scanner-5f1bfd6dd6031619", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in server/index.js:65"}, "properties": {"repobilityId": "d9e2487a3e052e8b", "scanner": "scanner-primary", "fingerprint": "5f1bfd6dd6031619", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/index.js"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-5376785175dda2f8", "level": "note", "message": {"text": "Very large file: client/src/components/AdminApp.jsx (7270 lines)"}, "properties": {"repobilityId": "4c7926aef06c6cfe", "scanner": "scanner-primary", "fingerprint": "5376785175dda2f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cab9e255c4cc2465", "level": "note", "message": {"text": "Very large file: client/src/components/Dashboard.jsx (1501 lines)"}, "properties": {"repobilityId": "94ef5cfce37e324b", "scanner": "scanner-primary", "fingerprint": "cab9e255c4cc2465", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-764d421d19d6ff67", "level": "note", "message": {"text": "Very large file: server/index.js (7332 lines)"}, "properties": {"repobilityId": "4d84f5062adc96c0", "scanner": "scanner-primary", "fingerprint": "764d421d19d6ff67", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "0c191f879aeb993e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b3ed68815bca2f8c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "properties": {"repobilityId": "7edae0550c126386", "scanner": "scanner-primary", "fingerprint": "b3ed68815bca2f8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8e51fdab2ef11172", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "9a8ad2d97dfa261e", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "d381e67e9e40e434", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "686a26c1ddc0a1ec", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ff5dde1bed2337f5", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bcaa872f9541f3e0", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a987808e5a7e1975", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "77ea0e95150cdb6f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cab9a804e89ab561", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/App.jsx:157"}, "properties": {"repobilityId": "465725973933399d", "scanner": "scanner-primary", "fingerprint": "cab9a804e89ab561", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3779b7b8f59c351e", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/journeySubjects.js:1"}, "properties": {"repobilityId": "cbc0840a9a5e4eb9", "scanner": "scanner-primary", "fingerprint": "3779b7b8f59c351e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ae48b22cc370056d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/auth.js:35"}, "properties": {"repobilityId": "45ff632f4c1a9645", "scanner": "scanner-primary", "fingerprint": "ae48b22cc370056d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-aa22a992486edf62", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/ClanSettingsModal.jsx:70"}, "properties": {"repobilityId": "41ea3da25ab2fd8b", "scanner": "scanner-primary", "fingerprint": "aa22a992486edf62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dcfacadd5bc27970", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/JourneyMode.jsx:120"}, "properties": {"repobilityId": "417ed18fe7d359af", "scanner": "scanner-primary", "fingerprint": "dcfacadd5bc27970", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3e893a6f7af5e09e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/QuestionParser.jsx:219"}, "properties": {"repobilityId": "68996f41b800bddc", "scanner": "scanner-primary", "fingerprint": "3e893a6f7af5e09e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-693c5dc3546952d0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/AdminApp.jsx:88"}, "properties": {"repobilityId": "b893188a0914fdc3", "scanner": "scanner-primary", "fingerprint": "693c5dc3546952d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-834bdd8de8dd5602", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/SoloGame.jsx:110"}, "properties": {"repobilityId": "3391ef9dff69d3bd", "scanner": "scanner-primary", "fingerprint": "834bdd8de8dd5602", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-38211c77a8c0c0c3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/AnKingMode.jsx:29"}, "properties": {"repobilityId": "ace4523c5c8f3c21", "scanner": "scanner-primary", "fingerprint": "38211c77a8c0c0c3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b83dfa889ac769cd", "level": "note", "message": {"text": "Legacy-named symbol `mrb_welcome_v1` in client/src/components/Dashboard.jsx:77"}, "properties": {"repobilityId": "2b6633e91408ba0f", "scanner": "scanner-primary", "fingerprint": "b83dfa889ac769cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a1c74393b3451665", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/Dashboard.jsx:388"}, "properties": {"repobilityId": "09cadf68a202f2f2", "scanner": "scanner-primary", "fingerprint": "a1c74393b3451665", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5dc9a9534b31aacc", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/admin/PlayPageAdmin.jsx:8"}, "properties": {"repobilityId": "85510b5d5cdf890d", "scanner": "scanner-primary", "fingerprint": "5dc9a9534b31aacc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0c92c2acf30d88c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/admin/AnKingAdmin.jsx:8"}, "properties": {"repobilityId": "0354567b056402a5", "scanner": "scanner-primary", "fingerprint": "0c92c2acf30d88c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eeef576d821a7402", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/contexts/GameSettingsContext.jsx:35"}, "properties": {"repobilityId": "03bfd3d81f83f177", "scanner": "scanner-primary", "fingerprint": "eeef576d821a7402", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6e52fa60cf58f16f", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/index.js:6143"}, "properties": {"repobilityId": "bc84c94f366d874c", "scanner": "scanner-primary", "fingerprint": "6e52fa60cf58f16f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e1f78e6547a511b", "level": "warning", "message": {"text": "Frontend route `/admin/*` has no Link/navigate to it \u2014 client/src/main.jsx"}, "properties": {"repobilityId": "5856768d2dc9daaf", "scanner": "scanner-primary", "fingerprint": "9e1f78e6547a511b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-56f8a5ea651ff6df", "level": "warning", "message": {"text": "Frontend route `/auth/callback` has no Link/navigate to it \u2014 client/src/main.jsx"}, "properties": {"repobilityId": "bb2bf1b4868aa9d8", "scanner": "scanner-primary", "fingerprint": "56f8a5ea651ff6df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e60eeeb1acada7ce", "level": "warning", "message": {"text": "Frontend route `/stats` has no Link/navigate to it \u2014 client/src/main.jsx"}, "properties": {"repobilityId": "8f86640e6829cf2a", "scanner": "scanner-primary", "fingerprint": "e60eeeb1acada7ce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-2cd2810551d325f1", "level": "warning", "message": {"text": "Frontend route `/*` has no Link/navigate to it \u2014 client/src/main.jsx"}, "properties": {"repobilityId": "15b301507a8e9b14", "scanner": "scanner-primary", "fingerprint": "2cd2810551d325f1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-3f1b48a4adbde1a7", "level": "error", "message": {"text": "Dangling fetch: GET https://usmle-battle-royale-production.up.railway.app/api/game-settings (client/src/App.jsx:157)"}, "properties": {"repobilityId": "b5ae87291f175a8b", "scanner": "scanner-primary", "fingerprint": "3f1b48a4adbde1a7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b9470fe01bc8073a", "level": "error", "message": {"text": "Dangling fetch: DELETE /admin/landing-images/journey_bg (client/src/components/AdminApp.jsx:3635)"}, "properties": {"repobilityId": "022f390cf858731d", "scanner": "scanner-primary", "fingerprint": "b9470fe01bc8073a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:apiCall"]}}, {"ruleId": "scanner-a94e72d5264d582c", "level": "note", "message": {"text": "Unused endpoint: GET /api/questions/counts"}, "properties": {"repobilityId": "20ac8c84e1ba84e5", "scanner": "scanner-primary", "fingerprint": "a94e72d5264d582c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cbbd1702e014928c", "level": "note", "message": {"text": "Unused endpoint: GET /api/questions"}, "properties": {"repobilityId": "aa16d25f262ded2a", "scanner": "scanner-primary", "fingerprint": "cbbd1702e014928c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-674b87efe73a14de", "level": "note", "message": {"text": "Unused endpoint: GET /api/questions/anking"}, "properties": {"repobilityId": "8e978b463415bf0b", "scanner": "scanner-primary", "fingerprint": "674b87efe73a14de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e9f0c712241895d", "level": "note", "message": {"text": "Unused endpoint: GET /auth/google"}, "properties": {"repobilityId": "a5ae5a67f5f51454", "scanner": "scanner-primary", "fingerprint": "2e9f0c712241895d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-392dcbd9c0e4ed85", "level": "note", "message": {"text": "Unused endpoint: GET /auth/google/callback"}, "properties": {"repobilityId": "c8a58e14eaa2b83d", "scanner": "scanner-primary", "fingerprint": "392dcbd9c0e4ed85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac42422b23e45104", "level": "note", "message": {"text": "Unused endpoint: GET /auth/me"}, "properties": {"repobilityId": "620641ad33394022", "scanner": "scanner-primary", "fingerprint": "ac42422b23e45104", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "1aea4afe65f8bbe9", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c83bd2cd15bd5b61", "level": "note", "message": {"text": "Unused endpoint: PUT /auth/username"}, "properties": {"repobilityId": "ea8af3fa5d167822", "scanner": "scanner-primary", "fingerprint": "c83bd2cd15bd5b61", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71604d8bfb41db87", "level": "note", "message": {"text": "Unused endpoint: PUT /auth/preferences"}, "properties": {"repobilityId": "b1cfcc93771863bf", "scanner": "scanner-primary", "fingerprint": "71604d8bfb41db87", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-953d9b44e5c01a62", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans"}, "properties": {"repobilityId": "0c2f9045225565a7", "scanner": "scanner-primary", "fingerprint": "953d9b44e5c01a62", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a8016cafdd1f2cc3", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/search"}, "properties": {"repobilityId": "0fe96daedac07928", "scanner": "scanner-primary", "fingerprint": "a8016cafdd1f2cc3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be62889bfe7c8197", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/leaderboard"}, "properties": {"repobilityId": "539e6bf2426e4705", "scanner": "scanner-primary", "fingerprint": "be62889bfe7c8197", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-78b9a6e770bde6be", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/:id/join"}, "properties": {"repobilityId": "bbe6f93195bdf207", "scanner": "scanner-primary", "fingerprint": "78b9a6e770bde6be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b77746c16d302645", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/leave"}, "properties": {"repobilityId": "bf61090ce113e24e", "scanner": "scanner-primary", "fingerprint": "b77746c16d302645", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5dcdbc227daa3c51", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/user/:userId"}, "properties": {"repobilityId": "3883f297ca8187fd", "scanner": "scanner-primary", "fingerprint": "5dcdbc227daa3c51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93b98e055f377bf1", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/:clanId"}, "properties": {"repobilityId": "676426371d502584", "scanner": "scanner-primary", "fingerprint": "93b98e055f377bf1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99181778ebe25984", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/:clanId/chat"}, "properties": {"repobilityId": "0231ff6fb17fa0de", "scanner": "scanner-primary", "fingerprint": "99181778ebe25984", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18302a224579c7e1", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/:clanId/chat"}, "properties": {"repobilityId": "9236ef5ea3c7a563", "scanner": "scanner-primary", "fingerprint": "18302a224579c7e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b7ae445df381f6d", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/:clanId/request"}, "properties": {"repobilityId": "1d5c82f9855e35fe", "scanner": "scanner-primary", "fingerprint": "7b7ae445df381f6d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d8f296cc7bb42303", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/:clanId/requests"}, "properties": {"repobilityId": "e35ea5b7497391cd", "scanner": "scanner-primary", "fingerprint": "d8f296cc7bb42303", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-783758a8f1ef63a1", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/:clanId/requests/:requestId/:action"}, "properties": {"repobilityId": "3a8181f97b68c751", "scanner": "scanner-primary", "fingerprint": "783758a8f1ef63a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f2c8305e35f7222", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/clans/:clanId/members/:userId"}, "properties": {"repobilityId": "8a0015fb68cbd0ff", "scanner": "scanner-primary", "fingerprint": "2f2c8305e35f7222", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9df591b05862b39c", "level": "note", "message": {"text": "Unused endpoint: PUT /api/clans/:clanId/members/:userId/role"}, "properties": {"repobilityId": "c6cb6513488b2786", "scanner": "scanner-primary", "fingerprint": "9df591b05862b39c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3bebd88f8da6134", "level": "note", "message": {"text": "Unused endpoint: PUT /api/clans/:clanId"}, "properties": {"repobilityId": "e24a238d50400ec9", "scanner": "scanner-primary", "fingerprint": "a3bebd88f8da6134", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d8bcec616ba53174", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans"}, "properties": {"repobilityId": "b70efe23aa94d4c2", "scanner": "scanner-primary", "fingerprint": "d8bcec616ba53174", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-daec8ca39b59287c", "level": "note", "message": {"text": "Unused endpoint: POST /api/users/online-status"}, "properties": {"repobilityId": "a05031615fd6209b", "scanner": "scanner-primary", "fingerprint": "daec8ca39b59287c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9729816f8e37ae91", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/:clanId/quests"}, "properties": {"repobilityId": "cc8859d23dd2df77", "scanner": "scanner-primary", "fingerprint": "9729816f8e37ae91", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b9ea051acc882f7b", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/:clanId/quests"}, "properties": {"repobilityId": "743f5cb07540f677", "scanner": "scanner-primary", "fingerprint": "b9ea051acc882f7b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a9e7f60b46e96e0", "level": "note", "message": {"text": "Unused endpoint: PUT /api/clans/:clanId/quests/:questId/progress"}, "properties": {"repobilityId": "1993bef2d6f24bc6", "scanner": "scanner-primary", "fingerprint": "1a9e7f60b46e96e0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f078d1726a2e0f16", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/clans/:clanId/quests/:questId"}, "properties": {"repobilityId": "14c9fac2599da7bb", "scanner": "scanner-primary", "fingerprint": "f078d1726a2e0f16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9864a1fe3ef302a1", "level": "note", "message": {"text": "Unused endpoint: GET /api/clans/rankings"}, "properties": {"repobilityId": "a189188b2a5868a7", "scanner": "scanner-primary", "fingerprint": "9864a1fe3ef302a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-669551a39b083ca1", "level": "note", "message": {"text": "Unused endpoint: POST /api/clans/:clanId/score"}, "properties": {"repobilityId": "89a2ee1ec6b20393", "scanner": "scanner-primary", "fingerprint": "669551a39b083ca1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83eeb9941dce5068", "level": "note", "message": {"text": "Unused endpoint: GET /api/username/check"}, "properties": {"repobilityId": "48521084d5d152df", "scanner": "scanner-primary", "fingerprint": "83eeb9941dce5068", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b148a50a90d3352c", "level": "note", "message": {"text": "Unused endpoint: GET /api/leaderboard/players"}, "properties": {"repobilityId": "21f6c7ec600c7c99", "scanner": "scanner-primary", "fingerprint": "b148a50a90d3352c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5dace5cb10bdba2", "level": "note", "message": {"text": "Unused endpoint: GET /api/leaderboard/clans"}, "properties": {"repobilityId": "4990699bf7ef065c", "scanner": "scanner-primary", "fingerprint": "a5dace5cb10bdba2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c7075fd68d75173", "level": "note", "message": {"text": "Unused endpoint: GET /api/users/search"}, "properties": {"repobilityId": "3f7a47b2f178da7c", "scanner": "scanner-primary", "fingerprint": "0c7075fd68d75173", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e19b0f4df12c38b6", "level": "note", "message": {"text": "Unused endpoint: GET /api/friends/:userId"}, "properties": {"repobilityId": "4517e01cc961581e", "scanner": "scanner-primary", "fingerprint": "e19b0f4df12c38b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a61806e7e9816f5a", "level": "note", "message": {"text": "Unused endpoint: GET /api/friends/requests/:userId"}, "properties": {"repobilityId": "bcb01e4da4fdcafe", "scanner": "scanner-primary", "fingerprint": "a61806e7e9816f5a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1204f06bc1860ec6", "level": "note", "message": {"text": "Unused endpoint: POST /api/friends/request"}, "properties": {"repobilityId": "49cac2716864c384", "scanner": "scanner-primary", "fingerprint": "1204f06bc1860ec6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c77ecf98d87f5ab3", "level": "note", "message": {"text": "Unused endpoint: POST /api/friends/accept"}, "properties": {"repobilityId": "8eabfea95d0e2cbc", "scanner": "scanner-primary", "fingerprint": "c77ecf98d87f5ab3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d561b5e541cdd013", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/friends/:friendshipId"}, "properties": {"repobilityId": "3aab058a41bb0f71", "scanner": "scanner-primary", "fingerprint": "d561b5e541cdd013", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c8ed8aa0acb39126", "level": "note", "message": {"text": "Unused endpoint: POST /api/lobby/invite"}, "properties": {"repobilityId": "d17fec2eaf58b69d", "scanner": "scanner-primary", "fingerprint": "c8ed8aa0acb39126", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0722dd9aa5afa5a0", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reset-leaderboards"}, "properties": {"repobilityId": "be632aeb14fcc9b8", "scanner": "scanner-primary", "fingerprint": "0722dd9aa5afa5a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7485384adf485475", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reset-tower-progress"}, "properties": {"repobilityId": "de0e214aa51f0c3f", "scanner": "scanner-primary", "fingerprint": "7485384adf485475", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af87dcd9b6e548c9", "level": "note", "message": {"text": "Unused endpoint: GET /api/landing-images"}, "properties": {"repobilityId": "bcba813ec102bccb", "scanner": "scanner-primary", "fingerprint": "af87dcd9b6e548c9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-78c776f67c631749", "level": "note", "message": {"text": "Unused endpoint: GET /api/landing-settings"}, "properties": {"repobilityId": "b5ecac35b09be76a", "scanner": "scanner-primary", "fingerprint": "78c776f67c631749", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a8705fbec7c149d", "level": "note", "message": {"text": "Unused endpoint: GET /api/home-images"}, "properties": {"repobilityId": "5cbd20be5dfffe02", "scanner": "scanner-primary", "fingerprint": "2a8705fbec7c149d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9e4e68f3083b35e4", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/preview-anki"}, "properties": {"repobilityId": "2309a2c2008eefc6", "scanner": "scanner-primary", "fingerprint": "9e4e68f3083b35e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9501c33a0728a6b", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/import-anki"}, "properties": {"repobilityId": "96bd4a3a711c6e24", "scanner": "scanner-primary", "fingerprint": "f9501c33a0728a6b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fcbe82324943cb9e", "level": "note", "message": {"text": "Unused endpoint: GET /admin/topic-groups"}, "properties": {"repobilityId": "27a8a115e8908c90", "scanner": "scanner-primary", "fingerprint": "fcbe82324943cb9e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}