{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3bd475248e70e332", "name": "Stray `console.log` in TS/JS \u2014 apps/kb-api/src/assets/uiV2/knowledge.js:1470", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/kb-api/src/assets/uiV2/knowledge.js:1470"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6a97456aef9aa00", "name": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/restore.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/restore.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd6f3764023b6f86", "name": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/reindex.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/reindex.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf93085384dfa562", "name": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/verify.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/verify.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89350f04341bfbc2", "name": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/backup.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/backup.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-745e44eb92620062", "name": "Stray `console.log` in TS/JS \u2014 apps/ingestion-worker/src/index.js:3", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/ingestion-worker/src/index.js:3"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b20c966d2f231a1d", "name": "Dockerfile runs as root: apps/kb-api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/kb-api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f803918a0401577a", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a69b88f13b38e1e4", "name": "Dockerfile runs as root: apps/reranker-service/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/reranker-service/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56ec2485f03c0faa", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aced60bcd6567558", "name": "Dockerfile runs as root: apps/ingestion-worker/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/ingestion-worker/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee972525f2c06d3b", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2dcbd5e27850adcc", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/settings.js:167", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/settings.js:167"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8395bb0e2d0ef1e0", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/knowledge.js:210", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/knowledge.js:210"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6113b8b72f9019f3", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/candidates.js:71", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/candidates.js:71"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-607bb00f013e9007", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/chat.js:102", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/chat.js:102"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64c65737b5a8e50a", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/graph.js:41", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/graph.js:41"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ddd06f69d4e82c5", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/routes/uiNodes.js:974", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/routes/uiNodes.js:974"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d59159aa894aa526", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/routes/ui.js:1463", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/routes/ui.js:1463"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89e2631106393383", "name": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/backupService.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/backupService.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5af9e8c7c787493", "name": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/visualAssetService.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/visualAssetService.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ba36cb7deeea8d2", "name": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/ocrService.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/ocrService.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5167195ad8bbb6b9", "name": "Very large file: apps/kb-api/src/assets/uiV2/settings.js (2546 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/assets/uiV2/settings.js (2546 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff5b950fa770be90", "name": "Very large file: apps/kb-api/src/assets/uiV2/knowledge.js (1867 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/assets/uiV2/knowledge.js (1867 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e82d1120653114e", "name": "Very large file: apps/kb-api/src/assets/uiV2/chat.js (1720 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/assets/uiV2/chat.js (1720 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e2ff7fcda6d6106", "name": "Very large file: apps/kb-api/src/assets/uiV2/graph.js (1465 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/assets/uiV2/graph.js (1465 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce283e431fc5e8d3", "name": "Very large file: apps/kb-api/src/providers/postgresProvider.js (5231 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/providers/postgresProvider.js (5231 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79436b38fe051c9b", "name": "Very large file: apps/kb-api/src/routes/documents.js (1723 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/routes/documents.js (1723 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0e217f45953608b", "name": "Very large file: apps/kb-api/src/routes/uiNodes.js (1865 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/routes/uiNodes.js (1865 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c1396ae4f3dc793", "name": "Very large file: apps/kb-api/src/routes/ui.js (7985 lines)", "shortDescription": {"text": "Very large file: apps/kb-api/src/routes/ui.js (7985 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "6 test file(s) for 89 source file(s) (ratio 0.07). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de1da640c75da98f", "name": "Node manifest has dependencies but no lockfile: apps/ingestion-worker/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/ingestion-worker/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 79 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ee0a89a16704e2e", "name": "Commented-code block (5 lines) in tests/route-schemas.test.mjs:17", "shortDescription": {"text": "Commented-code block (5 lines) in tests/route-schemas.test.mjs:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4a155d7a2d7cc5c", "name": "Commented-code block (6 lines) in tests/fixtures/generate-graph-fixtures.mjs:6", "shortDescription": {"text": "Commented-code block (6 lines) in tests/fixtures/generate-graph-fixtures.mjs:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc74775d2adeb49d", "name": "Commented-code block (5 lines) in apps/kb-api/src/config.js:136", "shortDescription": {"text": "Commented-code block (5 lines) in apps/kb-api/src/config.js:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f5af703d0969a4e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/settings.js:150", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/settings.js:150"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad35554a52b78bb1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/knowledge.js:135", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/knowledge.js:135"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16a3a68d6e042347", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/candidates.js:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/candidates.js:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d56027ef1302521", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/chat.js:158", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/chat.js:158"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97833d72b81a0a19", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/graph.js:71", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/graph.js:71"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbcf4044eb67efcd", "name": "Commented-code block (7 lines) in apps/kb-api/src/providers/gigachatEmbeddingProvider.js:5", "shortDescription": {"text": "Commented-code block (7 lines) in apps/kb-api/src/providers/gigachatEmbeddingProvider.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-887944ead2104403", "name": "Commented-code block (5 lines) in apps/kb-api/src/providers/postgresProvider.js:235", "shortDescription": {"text": "Commented-code block (5 lines) in apps/kb-api/src/providers/postgresProvider.js:235"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7227722999e7076", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/routes/ui.js:2521", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/routes/ui.js:2521"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5911c84fb55d6771", "name": "Commented-code block (8 lines) in apps/kb-api/src/routes/uiV2Graph.js:72", "shortDescription": {"text": "Commented-code block (8 lines) in apps/kb-api/src/routes/uiV2Graph.js:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbb4d337be163b16", "name": "Commented-code block (6 lines) in apps/kb-api/src/routes/chatSessions.js:141", "shortDescription": {"text": "Commented-code block (6 lines) in apps/kb-api/src/routes/chatSessions.js:141"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb8e47c017794f8a", "name": "Commented-code block (7 lines) in apps/kb-api/src/services/graphService.js:457", "shortDescription": {"text": "Commented-code block (7 lines) in apps/kb-api/src/services/graphService.js:457"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac6a1cdffd5bff1d", "name": "Commented-code block (5 lines) in apps/kb-api/src/services/pdfTextSpacing.js:28", "shortDescription": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/pdfTextSpacing.js:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2833e9914b1e274", "name": "Commented-code block (5 lines) in apps/kb-api/src/services/contextualEnrichmentService.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/contextualEnrichmentService.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-84652934aed3990e", "name": "Commented-code block (5 lines) in apps/kb-api/src/services/ingestionService.js:114", "shortDescription": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/ingestionService.js:114"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a403066e2a31c3f", "name": "Commented-code block (11 lines) in apps/kb-api/src/services/knowledgeExtractionService.js:8", "shortDescription": {"text": "Commented-code block (11 lines) in apps/kb-api/src/services/knowledgeExtractionService.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da8e3dc5d370e1b7", "name": "Commented-code block (5 lines) in apps/kb-api/src/services/systemPromptService.js:108", "shortDescription": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/systemPromptService.js:108"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cff4e1f27209b6ad", "name": "Commented-code block (7 lines) in apps/kb-api/src/services/chunkingService.js:27", "shortDescription": {"text": "Commented-code block (7 lines) in apps/kb-api/src/services/chunkingService.js:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ca4ea02f38f940c", "name": "Commented-code block (8 lines) in apps/kb-api/src/services/graphAnswerService.js:24", "shortDescription": {"text": "Commented-code block (8 lines) in apps/kb-api/src/services/graphAnswerService.js:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-38768b2805fea072", "name": "Commented-code block (6 lines) in apps/kb-api/src/services/graphParsers/xlsxParser.js:460", "shortDescription": {"text": "Commented-code block (6 lines) in apps/kb-api/src/services/graphParsers/xlsxParser.js:460"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-158c69a7290ef82c", "name": "Commented-code block (13 lines) in apps/kb-api/src/schemas/retrievalSchemas.js:3", "shortDescription": {"text": "Commented-code block (13 lines) in apps/kb-api/src/schemas/retrievalSchemas.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-077b9816d66dd511", "name": "Commented-code block (5 lines) in apps/ingestion-worker/src/chunkers/sentenceChunker.js:51", "shortDescription": {"text": "Commented-code block (5 lines) in apps/ingestion-worker/src/chunkers/sentenceChunker.js:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7250961b3045977b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/knowledge-nodes-smoke.mjs:436", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/knowledge-nodes-smoke.mjs:436"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cac7ce15e72817b", "name": "31 env vars used in code but missing from .env.example", "shortDescription": {"text": "31 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ASSET_ROOT`, `CONFIG_DIR`, `DATA_ROOT`, `DEVICE`, `EMBEDDING_BATCH_SIZE`, `EMBEDDING_MAX_INPUT_CHARS`, `GIGACHAT_AUTH_KEY`, `GIGACHAT_CA_BUNDLE` + 23 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b10d42f95350b178", "name": "FastAPI POST `rerank` without auth dependency \u2014 apps/reranker-service/app.py:159", "shortDescription": {"text": "FastAPI POST `rerank` without auth dependency \u2014 apps/reranker-service/app.py:159"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e80eefeff5f29a96", "name": "Unused endpoint: POST /rerank", "shortDescription": {"text": "Unused endpoint: POST /rerank"}, "fullDescription": {"text": "`apps/reranker-service/app.py` declares `POST /rerank` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-512ccb0fd0b230ba", "name": "Unused endpoint: GET /settings", "shortDescription": {"text": "Unused endpoint: GET /settings"}, "fullDescription": {"text": "`apps/kb-api/src/routes/settings.js` declares `GET /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86432a84b0ec1f88", "name": "Unused endpoint: GET /api/v2/backups", "shortDescription": {"text": "Unused endpoint: GET /api/v2/backups"}, "fullDescription": {"text": "`apps/kb-api/src/routes/backupApi.js` declares `GET /api/v2/backups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42acbec5b01e13af", "name": "Unused endpoint: POST /api/v2/backups", "shortDescription": {"text": "Unused endpoint: POST /api/v2/backups"}, "fullDescription": {"text": "`apps/kb-api/src/routes/backupApi.js` declares `POST /api/v2/backups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f464408281713ae2", "name": "Unused endpoint: GET /api/v2/backups/:filename/download", "shortDescription": {"text": "Unused endpoint: GET /api/v2/backups/:filename/download"}, "fullDescription": {"text": "`apps/kb-api/src/routes/backupApi.js` declares `GET /api/v2/backups/:filename/download` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cd45b30df7f04ae", "name": "Unused endpoint: DELETE /api/v2/backups/:filename", "shortDescription": {"text": "Unused endpoint: DELETE /api/v2/backups/:filename"}, "fullDescription": {"text": "`apps/kb-api/src/routes/backupApi.js` declares `DELETE /api/v2/backups/:filename` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-061ba649f74e4ee5", "name": "Unused endpoint: POST /api/v2/backups/:filename/restore", "shortDescription": {"text": "Unused endpoint: POST /api/v2/backups/:filename/restore"}, "fullDescription": {"text": "`apps/kb-api/src/routes/backupApi.js` declares `POST /api/v2/backups/:filename/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-938aa9b81b481a33", "name": "Unused endpoint: GET /documents/duplicates", "shortDescription": {"text": "Unused endpoint: GET /documents/duplicates"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/duplicates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64b99bc940423fb0", "name": "Unused endpoint: POST /documents/bulk-link", "shortDescription": {"text": "Unused endpoint: POST /documents/bulk-link"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/bulk-link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3ed4a313ea4c568", "name": "Unused endpoint: POST /documents/bulk-unlink", "shortDescription": {"text": "Unused endpoint: POST /documents/bulk-unlink"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/bulk-unlink` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e71e0c5045bb05b", "name": "Unused endpoint: PATCH /documents/:id", "shortDescription": {"text": "Unused endpoint: PATCH /documents/:id"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `PATCH /documents/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04c69b8b8c527336", "name": "Unused endpoint: DELETE /documents/:id", "shortDescription": {"text": "Unused endpoint: DELETE /documents/:id"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `DELETE /documents/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ed66d16af615399", "name": "Unused endpoint: GET /documents/:id/nodes", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/nodes"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/nodes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47d16070f3d8d57e", "name": "Unused endpoint: POST /documents/:id/nodes", "shortDescription": {"text": "Unused endpoint: POST /documents/:id/nodes"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/:id/nodes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4ab42cfae3fad4d", "name": "Unused endpoint: PATCH /documents/:id/nodes", "shortDescription": {"text": "Unused endpoint: PATCH /documents/:id/nodes"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `PATCH /documents/:id/nodes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c646403efefb2f9", "name": "Unused endpoint: DELETE /documents/:id/nodes/:nodeId", "shortDescription": {"text": "Unused endpoint: DELETE /documents/:id/nodes/:nodeId"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `DELETE /documents/:id/nodes/:nodeId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da434bcd05f8ebb2", "name": "Unused endpoint: POST /documents/:id/reindex", "shortDescription": {"text": "Unused endpoint: POST /documents/:id/reindex"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/:id/reindex` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c717909099948811", "name": "Unused endpoint: POST /documents/:id/reindex-payload", "shortDescription": {"text": "Unused endpoint: POST /documents/:id/reindex-payload"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/:id/reindex-payload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-728d7ed519af0847", "name": "Unused endpoint: POST /documents/deduplicate", "shortDescription": {"text": "Unused endpoint: POST /documents/deduplicate"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/deduplicate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f7fc1bd678f789e", "name": "Unused endpoint: GET /documents/:id/chunks", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/chunks"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/chunks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd5a20514a8c1329", "name": "Unused endpoint: GET /documents/:id/original", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/original"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/original` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3740a12a5a38d8e8", "name": "Unused endpoint: POST /documents/:id/open-local", "shortDescription": {"text": "Unused endpoint: POST /documents/:id/open-local"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/:id/open-local` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e40eae98cc45e809", "name": "Unused endpoint: GET /documents/:id/assets", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/assets"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/assets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b95bfb19b5530fc8", "name": "Unused endpoint: GET /documents/:id/assets/browse", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/assets/browse"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/assets/browse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4849d1bccfcaeea", "name": "Unused endpoint: POST /documents/:id/reclassify-assets", "shortDescription": {"text": "Unused endpoint: POST /documents/:id/reclassify-assets"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/:id/reclassify-assets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8065ddf9726bdac", "name": "Unused endpoint: POST /documents/:id/rebuild-visual-assets", "shortDescription": {"text": "Unused endpoint: POST /documents/:id/rebuild-visual-assets"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/:id/rebuild-visual-assets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2102b03a991c949b", "name": "Unused endpoint: GET /documents/:id/assets/:fileName", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/assets/:fileName"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/assets/:fileName` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b275333f47a43c34", "name": "Unused endpoint: GET /documents/:id/pages/:pageNumber/preview", "shortDescription": {"text": "Unused endpoint: GET /documents/:id/pages/:pageNumber/preview"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `GET /documents/:id/pages/:pageNumber/preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8888bc0605633a7c", "name": "Unused endpoint: POST /documents/ingest-file", "shortDescription": {"text": "Unused endpoint: POST /documents/ingest-file"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/ingest-file` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7f9f2b52b66ae8b", "name": "Unused endpoint: POST /documents/ingest-file-async", "shortDescription": {"text": "Unused endpoint: POST /documents/ingest-file-async"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/ingest-file-async` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e8aeb828b899d4b", "name": "Unused endpoint: POST /documents/ingest-folder", "shortDescription": {"text": "Unused endpoint: POST /documents/ingest-folder"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/ingest-folder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0f27737b797096f", "name": "Unused endpoint: POST /documents/ingest-folder-async", "shortDescription": {"text": "Unused endpoint: POST /documents/ingest-folder-async"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/ingest-folder-async` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc90077c5eb68088", "name": "Unused endpoint: POST /documents/ingest-text", "shortDescription": {"text": "Unused endpoint: POST /documents/ingest-text"}, "fullDescription": {"text": "`apps/kb-api/src/routes/documents.js` declares `POST /documents/ingest-text` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b73530d1a5786765", "name": "Unused endpoint: GET /api/v2/graph/tree/roots", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/tree/roots"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphTree.js` declares `GET /api/v2/graph/tree/roots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-079e6d5b4568c646", "name": "Unused endpoint: GET /api/v2/graph/tree/by-type/:type", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/tree/by-type/:type"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphTree.js` declares `GET /api/v2/graph/tree/by-type/:type` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-248fa3fd56c30aae", "name": "Unused endpoint: GET /api/v2/graph/tree/children/:id", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/tree/children/:id"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphTree.js` declares `GET /api/v2/graph/tree/children/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a4213afabeb6d56", "name": "Unused endpoint: GET /api/v2/graph/nodes/:id/full", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/nodes/:id/full"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphTree.js` declares `GET /api/v2/graph/nodes/:id/full` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21193470f4593ddc", "name": "Unused endpoint: GET /api/v2/graph/nodes/:id/neighbors", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/nodes/:id/neighbors"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphTree.js` declares `GET /api/v2/graph/nodes/:id/neighbors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c85754c4f0791ac", "name": "Unused endpoint: POST /api/v2/graph/nodes/:id/hard-delete", "shortDescription": {"text": "Unused endpoint: POST /api/v2/graph/nodes/:id/hard-delete"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphTree.js` declares `POST /api/v2/graph/nodes/:id/hard-delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5312aeb355cda84", "name": "Unused endpoint: GET /admin/knowledge-nodes-status", "shortDescription": {"text": "Unused endpoint: GET /admin/knowledge-nodes-status"}, "fullDescription": {"text": "`apps/kb-api/src/routes/admin.js` declares `GET /admin/knowledge-nodes-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df147c40875090d1", "name": "Unused endpoint: POST /admin/reconcile-nodes-sample", "shortDescription": {"text": "Unused endpoint: POST /admin/reconcile-nodes-sample"}, "fullDescription": {"text": "`apps/kb-api/src/routes/admin.js` declares `POST /admin/reconcile-nodes-sample` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a965272bf2b5476", "name": "Unused endpoint: POST /admin/reindex-nodes", "shortDescription": {"text": "Unused endpoint: POST /admin/reindex-nodes"}, "fullDescription": {"text": "`apps/kb-api/src/routes/admin.js` declares `POST /admin/reindex-nodes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-620b6804c7390dea", "name": "Unused endpoint: POST /admin/rebuild-qdrant", "shortDescription": {"text": "Unused endpoint: POST /admin/rebuild-qdrant"}, "fullDescription": {"text": "`apps/kb-api/src/routes/admin.js` declares `POST /admin/rebuild-qdrant` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4ef6a9d685bb479", "name": "Unused endpoint: POST /admin/reset-content", "shortDescription": {"text": "Unused endpoint: POST /admin/reset-content"}, "fullDescription": {"text": "`apps/kb-api/src/routes/admin.js` declares `POST /admin/reset-content` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26ed8c5a85972c2f", "name": "Unused endpoint: GET /api/v2/graph/node-types", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/node-types"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphNodeTypes.js` declares `GET /api/v2/graph/node-types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a618a71df22117f7", "name": "Unused endpoint: GET /api/v2/graph/node-types/:code", "shortDescription": {"text": "Unused endpoint: GET /api/v2/graph/node-types/:code"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphNodeTypes.js` declares `GET /api/v2/graph/node-types/:code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f63729339dc9f213", "name": "Unused endpoint: POST /api/v2/graph/node-types", "shortDescription": {"text": "Unused endpoint: POST /api/v2/graph/node-types"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphNodeTypes.js` declares `POST /api/v2/graph/node-types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21c0bf2f1c04a11a", "name": "Unused endpoint: PUT /api/v2/graph/node-types/:code", "shortDescription": {"text": "Unused endpoint: PUT /api/v2/graph/node-types/:code"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphNodeTypes.js` declares `PUT /api/v2/graph/node-types/:code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bca3ea8b14d2545", "name": "Unused endpoint: DELETE /api/v2/graph/node-types/:code", "shortDescription": {"text": "Unused endpoint: DELETE /api/v2/graph/node-types/:code"}, "fullDescription": {"text": "`apps/kb-api/src/routes/graphNodeTypes.js` declares `DELETE /api/v2/graph/node-types/:code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca956d176e87b172", "name": "Unused endpoint: GET /ui/consult", "shortDescription": {"text": "Unused endpoint: GET /ui/consult"}, "fullDescription": {"text": "`apps/kb-api/src/routes/ui.js` declares `GET /ui/consult` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19292"}, "properties": {"repository": "sergeyxmao/LOCAL-RAG-PLATFORM", "repoUrl": "https://github.com/sergeyxmao/LOCAL-RAG-PLATFORM", "branch": "main"}, "results": [{"ruleId": "scanner-3bd475248e70e332", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/kb-api/src/assets/uiV2/knowledge.js:1470"}, "properties": {"repobilityId": "c6b7454ca1499098", "scanner": "scanner-primary", "fingerprint": "3bd475248e70e332", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b6a97456aef9aa00", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/restore.js:1"}, "properties": {"repobilityId": "e62c10372ca9e991", "scanner": "scanner-primary", "fingerprint": "b6a97456aef9aa00", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cd6f3764023b6f86", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/reindex.js:1"}, "properties": {"repobilityId": "e93ee832f2466626", "scanner": "scanner-primary", "fingerprint": "cd6f3764023b6f86", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cf93085384dfa562", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/verify.js:1"}, "properties": {"repobilityId": "7334cff5e23855ad", "scanner": "scanner-primary", "fingerprint": "cf93085384dfa562", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-89350f04341bfbc2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/admin-tools/backup.js:1"}, "properties": {"repobilityId": "34efae06cf5bd7e7", "scanner": "scanner-primary", "fingerprint": "89350f04341bfbc2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-745e44eb92620062", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/ingestion-worker/src/index.js:3"}, "properties": {"repobilityId": "3bdf52ab5b300166", "scanner": "scanner-primary", "fingerprint": "745e44eb92620062", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b20c966d2f231a1d", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/kb-api/Dockerfile"}, "properties": {"repobilityId": "6de54fbe6c364385", "scanner": "scanner-primary", "fingerprint": "b20c966d2f231a1d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-f803918a0401577a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "8724ecba29900676", "scanner": "scanner-primary", "fingerprint": "f803918a0401577a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a69b88f13b38e1e4", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/reranker-service/Dockerfile"}, "properties": {"repobilityId": "c1b8254294108af2", "scanner": "scanner-primary", "fingerprint": "a69b88f13b38e1e4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-56ec2485f03c0faa", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "1b4ce8e66081b94d", "scanner": "scanner-primary", "fingerprint": "56ec2485f03c0faa", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/reranker-service/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aced60bcd6567558", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/ingestion-worker/Dockerfile"}, "properties": {"repobilityId": "56f5c9f3aa8a2cac", "scanner": "scanner-primary", "fingerprint": "aced60bcd6567558", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ee972525f2c06d3b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "86543df30efed456", "scanner": "scanner-primary", "fingerprint": "ee972525f2c06d3b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/ingestion-worker/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-2dcbd5e27850adcc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/settings.js:167"}, "properties": {"repobilityId": "0503411c93f84310", "scanner": "scanner-primary", "fingerprint": "2dcbd5e27850adcc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/assets/uiV2/settings.js"}, "region": {"startLine": 167}}}]}, {"ruleId": "scanner-8395bb0e2d0ef1e0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/knowledge.js:210"}, "properties": {"repobilityId": "19fdc7fad5d90f55", "scanner": "scanner-primary", "fingerprint": "8395bb0e2d0ef1e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/assets/uiV2/knowledge.js"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-6113b8b72f9019f3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/candidates.js:71"}, "properties": {"repobilityId": "e3cb59f1dfacdc87", "scanner": "scanner-primary", "fingerprint": "6113b8b72f9019f3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/assets/uiV2/candidates.js"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-607bb00f013e9007", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/chat.js:102"}, "properties": {"repobilityId": "7e2cdb54374e2dbc", "scanner": "scanner-primary", "fingerprint": "607bb00f013e9007", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/assets/uiV2/chat.js"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-64c65737b5a8e50a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/assets/uiV2/graph.js:41"}, "properties": {"repobilityId": "7a3b5436355ee4b9", "scanner": "scanner-primary", "fingerprint": "64c65737b5a8e50a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/assets/uiV2/graph.js"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-3ddd06f69d4e82c5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/routes/uiNodes.js:974"}, "properties": {"repobilityId": "0b18c90680691369", "scanner": "scanner-primary", "fingerprint": "3ddd06f69d4e82c5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/routes/uiNodes.js"}, "region": {"startLine": 974}}}]}, {"ruleId": "scanner-d59159aa894aa526", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/kb-api/src/routes/ui.js:1463"}, "properties": {"repobilityId": "7829504f5d2e0236", "scanner": "scanner-primary", "fingerprint": "d59159aa894aa526", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/routes/ui.js"}, "region": {"startLine": 1463}}}]}, {"ruleId": "scanner-89e2631106393383", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/backupService.js:4"}, "properties": {"repobilityId": "45c7c8a243303c3a", "scanner": "scanner-primary", "fingerprint": "89e2631106393383", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/services/backupService.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-a5af9e8c7c787493", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/visualAssetService.js:3"}, "properties": {"repobilityId": "37ba1455f687e841", "scanner": "scanner-primary", "fingerprint": "a5af9e8c7c787493", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/services/visualAssetService.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-1ba36cb7deeea8d2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/kb-api/src/services/ocrService.js:1"}, "properties": {"repobilityId": "a67324c899ba26c7", "scanner": "scanner-primary", "fingerprint": "1ba36cb7deeea8d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/kb-api/src/services/ocrService.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-5167195ad8bbb6b9", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/assets/uiV2/settings.js (2546 lines)"}, "properties": {"repobilityId": "79d990df9b10926e", "scanner": "scanner-primary", "fingerprint": "5167195ad8bbb6b9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ff5b950fa770be90", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/assets/uiV2/knowledge.js (1867 lines)"}, "properties": {"repobilityId": "4caea55e1b16e3c3", "scanner": "scanner-primary", "fingerprint": "ff5b950fa770be90", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9e82d1120653114e", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/assets/uiV2/chat.js (1720 lines)"}, "properties": {"repobilityId": "22434ec3e7e49fac", "scanner": "scanner-primary", "fingerprint": "9e82d1120653114e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9e2ff7fcda6d6106", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/assets/uiV2/graph.js (1465 lines)"}, "properties": {"repobilityId": "a74446003842b70d", "scanner": "scanner-primary", "fingerprint": "9e2ff7fcda6d6106", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ce283e431fc5e8d3", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/providers/postgresProvider.js (5231 lines)"}, "properties": {"repobilityId": "ac188d990b626cd0", "scanner": "scanner-primary", "fingerprint": "ce283e431fc5e8d3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79436b38fe051c9b", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/routes/documents.js (1723 lines)"}, "properties": {"repobilityId": "1f3bded6f13403c6", "scanner": "scanner-primary", "fingerprint": "79436b38fe051c9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b0e217f45953608b", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/routes/uiNodes.js (1865 lines)"}, "properties": {"repobilityId": "c24fe4c28dcd5852", "scanner": "scanner-primary", "fingerprint": "b0e217f45953608b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7c1396ae4f3dc793", "level": "note", "message": {"text": "Very large file: apps/kb-api/src/routes/ui.js (7985 lines)"}, "properties": {"repobilityId": "e3630d06f39eacad", "scanner": "scanner-primary", "fingerprint": "7c1396ae4f3dc793", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a88f26a4659aebfd", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-de1da640c75da98f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/ingestion-worker/package.json"}, "properties": {"repobilityId": "d7f08ea7e32c776c", "scanner": "scanner-primary", "fingerprint": "de1da640c75da98f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/ingestion-worker/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f4a9fcf1fe5437d0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "59e896041b51ec7d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4d8d0fa491bd3a68", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "84e610b9182e03a8", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "77f58d671eb03afb", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a52f40628f903512", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c6f3112a3aa1cd25", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7ee0a89a16704e2e", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/route-schemas.test.mjs:17"}, "properties": {"repobilityId": "dba520210b304f39", "scanner": "scanner-primary", "fingerprint": "7ee0a89a16704e2e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a4a155d7a2d7cc5c", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/fixtures/generate-graph-fixtures.mjs:6"}, "properties": {"repobilityId": "06bce63d42928b80", "scanner": "scanner-primary", "fingerprint": "a4a155d7a2d7cc5c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc74775d2adeb49d", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/kb-api/src/config.js:136"}, "properties": {"repobilityId": "df89de46b47aa5a4", "scanner": "scanner-primary", "fingerprint": "cc74775d2adeb49d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f5af703d0969a4e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/settings.js:150"}, "properties": {"repobilityId": "a3250386fd02a0d8", "scanner": "scanner-primary", "fingerprint": "9f5af703d0969a4e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ad35554a52b78bb1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/knowledge.js:135"}, "properties": {"repobilityId": "a835c16a391fb845", "scanner": "scanner-primary", "fingerprint": "ad35554a52b78bb1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-16a3a68d6e042347", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/candidates.js:41"}, "properties": {"repobilityId": "56c1a5c9da1c0ada", "scanner": "scanner-primary", "fingerprint": "16a3a68d6e042347", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2d56027ef1302521", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/chat.js:158"}, "properties": {"repobilityId": "04f824562b90aa55", "scanner": "scanner-primary", "fingerprint": "2d56027ef1302521", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-97833d72b81a0a19", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/assets/uiV2/graph.js:71"}, "properties": {"repobilityId": "d67a24e771111386", "scanner": "scanner-primary", "fingerprint": "97833d72b81a0a19", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bbcf4044eb67efcd", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/kb-api/src/providers/gigachatEmbeddingProvider.js:5"}, "properties": {"repobilityId": "3c75f041950742dc", "scanner": "scanner-primary", "fingerprint": "bbcf4044eb67efcd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-887944ead2104403", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/kb-api/src/providers/postgresProvider.js:235"}, "properties": {"repobilityId": "d8bda03a03447a0c", "scanner": "scanner-primary", "fingerprint": "887944ead2104403", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e7227722999e7076", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/kb-api/src/routes/ui.js:2521"}, "properties": {"repobilityId": "a04e4d1ae2427ccb", "scanner": "scanner-primary", "fingerprint": "e7227722999e7076", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5911c84fb55d6771", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/kb-api/src/routes/uiV2Graph.js:72"}, "properties": {"repobilityId": "4b38361cd44ddd12", "scanner": "scanner-primary", "fingerprint": "5911c84fb55d6771", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cbb4d337be163b16", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/kb-api/src/routes/chatSessions.js:141"}, "properties": {"repobilityId": "2524041abf307633", "scanner": "scanner-primary", "fingerprint": "cbb4d337be163b16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb8e47c017794f8a", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/kb-api/src/services/graphService.js:457"}, "properties": {"repobilityId": "46763757e6aa7b63", "scanner": "scanner-primary", "fingerprint": "cb8e47c017794f8a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac6a1cdffd5bff1d", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/pdfTextSpacing.js:28"}, "properties": {"repobilityId": "f73cd71db4d9d967", "scanner": "scanner-primary", "fingerprint": "ac6a1cdffd5bff1d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b2833e9914b1e274", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/contextualEnrichmentService.js:3"}, "properties": {"repobilityId": "d593d29158b2440c", "scanner": "scanner-primary", "fingerprint": "b2833e9914b1e274", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-84652934aed3990e", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/ingestionService.js:114"}, "properties": {"repobilityId": "051a9f4a2bb864ea", "scanner": "scanner-primary", "fingerprint": "84652934aed3990e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5a403066e2a31c3f", "level": "none", "message": {"text": "Commented-code block (11 lines) in apps/kb-api/src/services/knowledgeExtractionService.js:8"}, "properties": {"repobilityId": "337ed16a02210775", "scanner": "scanner-primary", "fingerprint": "5a403066e2a31c3f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da8e3dc5d370e1b7", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/kb-api/src/services/systemPromptService.js:108"}, "properties": {"repobilityId": "7b53a3577ffad077", "scanner": "scanner-primary", "fingerprint": "da8e3dc5d370e1b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cff4e1f27209b6ad", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/kb-api/src/services/chunkingService.js:27"}, "properties": {"repobilityId": "e13899f4985cf664", "scanner": "scanner-primary", "fingerprint": "cff4e1f27209b6ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ca4ea02f38f940c", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/kb-api/src/services/graphAnswerService.js:24"}, "properties": {"repobilityId": "a05f3e4d128ee45e", "scanner": "scanner-primary", "fingerprint": "7ca4ea02f38f940c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-38768b2805fea072", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/kb-api/src/services/graphParsers/xlsxParser.js:460"}, "properties": {"repobilityId": "f011951eb9d58773", "scanner": "scanner-primary", "fingerprint": "38768b2805fea072", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-158c69a7290ef82c", "level": "none", "message": {"text": "Commented-code block (13 lines) in apps/kb-api/src/schemas/retrievalSchemas.js:3"}, "properties": {"repobilityId": "943983aabaa6497c", "scanner": "scanner-primary", "fingerprint": "158c69a7290ef82c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-077b9816d66dd511", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/ingestion-worker/src/chunkers/sentenceChunker.js:51"}, "properties": {"repobilityId": "82df279ffd9c5669", "scanner": "scanner-primary", "fingerprint": "077b9816d66dd511", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7250961b3045977b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/knowledge-nodes-smoke.mjs:436"}, "properties": {"repobilityId": "8416cb82bdb2ef19", "scanner": "scanner-primary", "fingerprint": "7250961b3045977b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9cac7ce15e72817b", "level": "note", "message": {"text": "31 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1a52e2d4d46a6e40", "scanner": "scanner-primary", "fingerprint": "9cac7ce15e72817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-b10d42f95350b178", "level": "error", "message": {"text": "FastAPI POST `rerank` without auth dependency \u2014 apps/reranker-service/app.py:159"}, "properties": {"repobilityId": "a3b97adbf91b4946", "scanner": "scanner-primary", "fingerprint": "b10d42f95350b178", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/reranker-service/app.py"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-e80eefeff5f29a96", "level": "note", "message": {"text": "Unused endpoint: POST /rerank"}, "properties": {"repobilityId": "d5d6a025ee88da6e", "scanner": "scanner-primary", "fingerprint": "e80eefeff5f29a96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-512ccb0fd0b230ba", "level": "note", "message": {"text": "Unused endpoint: GET /settings"}, "properties": {"repobilityId": "b0c468e4b3be58f4", "scanner": "scanner-primary", "fingerprint": "512ccb0fd0b230ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86432a84b0ec1f88", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/backups"}, "properties": {"repobilityId": "d044a57f6e9225af", "scanner": "scanner-primary", "fingerprint": "86432a84b0ec1f88", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-42acbec5b01e13af", "level": "note", "message": {"text": "Unused endpoint: POST /api/v2/backups"}, "properties": {"repobilityId": "3c02c1838405e499", "scanner": "scanner-primary", "fingerprint": "42acbec5b01e13af", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f464408281713ae2", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/backups/:filename/download"}, "properties": {"repobilityId": "46e3539b19577477", "scanner": "scanner-primary", "fingerprint": "f464408281713ae2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1cd45b30df7f04ae", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/v2/backups/:filename"}, "properties": {"repobilityId": "a8792b477734ed82", "scanner": "scanner-primary", "fingerprint": "1cd45b30df7f04ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-061ba649f74e4ee5", "level": "note", "message": {"text": "Unused endpoint: POST /api/v2/backups/:filename/restore"}, "properties": {"repobilityId": "2091de1b19fee530", "scanner": "scanner-primary", "fingerprint": "061ba649f74e4ee5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-938aa9b81b481a33", "level": "note", "message": {"text": "Unused endpoint: GET /documents/duplicates"}, "properties": {"repobilityId": "2a1ad893ca2e89c3", "scanner": "scanner-primary", "fingerprint": "938aa9b81b481a33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64b99bc940423fb0", "level": "note", "message": {"text": "Unused endpoint: POST /documents/bulk-link"}, "properties": {"repobilityId": "c7e55075f2fe48f5", "scanner": "scanner-primary", "fingerprint": "64b99bc940423fb0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3ed4a313ea4c568", "level": "note", "message": {"text": "Unused endpoint: POST /documents/bulk-unlink"}, "properties": {"repobilityId": "080994e649183906", "scanner": "scanner-primary", "fingerprint": "c3ed4a313ea4c568", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e71e0c5045bb05b", "level": "note", "message": {"text": "Unused endpoint: PATCH /documents/:id"}, "properties": {"repobilityId": "ea3338a593eef3ca", "scanner": "scanner-primary", "fingerprint": "1e71e0c5045bb05b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-04c69b8b8c527336", "level": "note", "message": {"text": "Unused endpoint: DELETE /documents/:id"}, "properties": {"repobilityId": "9d462db308b9a31d", "scanner": "scanner-primary", "fingerprint": "04c69b8b8c527336", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ed66d16af615399", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/nodes"}, "properties": {"repobilityId": "3b8932f83ef336fd", "scanner": "scanner-primary", "fingerprint": "3ed66d16af615399", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47d16070f3d8d57e", "level": "note", "message": {"text": "Unused endpoint: POST /documents/:id/nodes"}, "properties": {"repobilityId": "384e22c46fd56938", "scanner": "scanner-primary", "fingerprint": "47d16070f3d8d57e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e4ab42cfae3fad4d", "level": "note", "message": {"text": "Unused endpoint: PATCH /documents/:id/nodes"}, "properties": {"repobilityId": "aaf41b7a6ee45022", "scanner": "scanner-primary", "fingerprint": "e4ab42cfae3fad4d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c646403efefb2f9", "level": "note", "message": {"text": "Unused endpoint: DELETE /documents/:id/nodes/:nodeId"}, "properties": {"repobilityId": "63c946b2b14824c3", "scanner": "scanner-primary", "fingerprint": "5c646403efefb2f9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da434bcd05f8ebb2", "level": "note", "message": {"text": "Unused endpoint: POST /documents/:id/reindex"}, "properties": {"repobilityId": "ecd0a222afbe82d0", "scanner": "scanner-primary", "fingerprint": "da434bcd05f8ebb2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c717909099948811", "level": "note", "message": {"text": "Unused endpoint: POST /documents/:id/reindex-payload"}, "properties": {"repobilityId": "7415e8f5b450dc0a", "scanner": "scanner-primary", "fingerprint": "c717909099948811", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-728d7ed519af0847", "level": "note", "message": {"text": "Unused endpoint: POST /documents/deduplicate"}, "properties": {"repobilityId": "c07f5e0e5561031d", "scanner": "scanner-primary", "fingerprint": "728d7ed519af0847", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f7fc1bd678f789e", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/chunks"}, "properties": {"repobilityId": "92b8d1186ef81ce9", "scanner": "scanner-primary", "fingerprint": "2f7fc1bd678f789e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd5a20514a8c1329", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/original"}, "properties": {"repobilityId": "86c5ae4770220832", "scanner": "scanner-primary", "fingerprint": "bd5a20514a8c1329", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3740a12a5a38d8e8", "level": "note", "message": {"text": "Unused endpoint: POST /documents/:id/open-local"}, "properties": {"repobilityId": "cbbdc90d8c49e0ae", "scanner": "scanner-primary", "fingerprint": "3740a12a5a38d8e8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e40eae98cc45e809", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/assets"}, "properties": {"repobilityId": "631c5b8bcfb61e43", "scanner": "scanner-primary", "fingerprint": "e40eae98cc45e809", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b95bfb19b5530fc8", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/assets/browse"}, "properties": {"repobilityId": "f7c749e485d476fd", "scanner": "scanner-primary", "fingerprint": "b95bfb19b5530fc8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d4849d1bccfcaeea", "level": "note", "message": {"text": "Unused endpoint: POST /documents/:id/reclassify-assets"}, "properties": {"repobilityId": "05c4315ab3546fc3", "scanner": "scanner-primary", "fingerprint": "d4849d1bccfcaeea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c8065ddf9726bdac", "level": "note", "message": {"text": "Unused endpoint: POST /documents/:id/rebuild-visual-assets"}, "properties": {"repobilityId": "eb12f0b602db7df5", "scanner": "scanner-primary", "fingerprint": "c8065ddf9726bdac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2102b03a991c949b", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/assets/:fileName"}, "properties": {"repobilityId": "35edaea61dee9f51", "scanner": "scanner-primary", "fingerprint": "2102b03a991c949b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b275333f47a43c34", "level": "note", "message": {"text": "Unused endpoint: GET /documents/:id/pages/:pageNumber/preview"}, "properties": {"repobilityId": "6d45da31e2768d86", "scanner": "scanner-primary", "fingerprint": "b275333f47a43c34", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8888bc0605633a7c", "level": "note", "message": {"text": "Unused endpoint: POST /documents/ingest-file"}, "properties": {"repobilityId": "cde0cc40526412e1", "scanner": "scanner-primary", "fingerprint": "8888bc0605633a7c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7f9f2b52b66ae8b", "level": "note", "message": {"text": "Unused endpoint: POST /documents/ingest-file-async"}, "properties": {"repobilityId": "8cbe72b0a24a2002", "scanner": "scanner-primary", "fingerprint": "f7f9f2b52b66ae8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e8aeb828b899d4b", "level": "note", "message": {"text": "Unused endpoint: POST /documents/ingest-folder"}, "properties": {"repobilityId": "badbbb6dddbd3499", "scanner": "scanner-primary", "fingerprint": "2e8aeb828b899d4b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0f27737b797096f", "level": "note", "message": {"text": "Unused endpoint: POST /documents/ingest-folder-async"}, "properties": {"repobilityId": "99f6915abf28b88a", "scanner": "scanner-primary", "fingerprint": "d0f27737b797096f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc90077c5eb68088", "level": "note", "message": {"text": "Unused endpoint: POST /documents/ingest-text"}, "properties": {"repobilityId": "1cf73071769fbc0c", "scanner": "scanner-primary", "fingerprint": "cc90077c5eb68088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b73530d1a5786765", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/tree/roots"}, "properties": {"repobilityId": "34b333da62d22970", "scanner": "scanner-primary", "fingerprint": "b73530d1a5786765", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-079e6d5b4568c646", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/tree/by-type/:type"}, "properties": {"repobilityId": "bbd23171a1fba016", "scanner": "scanner-primary", "fingerprint": "079e6d5b4568c646", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-248fa3fd56c30aae", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/tree/children/:id"}, "properties": {"repobilityId": "d82eecea5a3e5101", "scanner": "scanner-primary", "fingerprint": "248fa3fd56c30aae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a4213afabeb6d56", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/nodes/:id/full"}, "properties": {"repobilityId": "2e7e5106fcb86626", "scanner": "scanner-primary", "fingerprint": "6a4213afabeb6d56", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-21193470f4593ddc", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/nodes/:id/neighbors"}, "properties": {"repobilityId": "ded2703d523d5d6f", "scanner": "scanner-primary", "fingerprint": "21193470f4593ddc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c85754c4f0791ac", "level": "note", "message": {"text": "Unused endpoint: POST /api/v2/graph/nodes/:id/hard-delete"}, "properties": {"repobilityId": "0ce985d9a39de6e1", "scanner": "scanner-primary", "fingerprint": "9c85754c4f0791ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5312aeb355cda84", "level": "note", "message": {"text": "Unused endpoint: GET /admin/knowledge-nodes-status"}, "properties": {"repobilityId": "fdca31b15eee3d85", "scanner": "scanner-primary", "fingerprint": "b5312aeb355cda84", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-df147c40875090d1", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reconcile-nodes-sample"}, "properties": {"repobilityId": "85b486cd0b017b68", "scanner": "scanner-primary", "fingerprint": "df147c40875090d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a965272bf2b5476", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reindex-nodes"}, "properties": {"repobilityId": "54a003f700d7457b", "scanner": "scanner-primary", "fingerprint": "2a965272bf2b5476", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-620b6804c7390dea", "level": "note", "message": {"text": "Unused endpoint: POST /admin/rebuild-qdrant"}, "properties": {"repobilityId": "c0b69d0915f506a1", "scanner": "scanner-primary", "fingerprint": "620b6804c7390dea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4ef6a9d685bb479", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reset-content"}, "properties": {"repobilityId": "320b32913db1cc20", "scanner": "scanner-primary", "fingerprint": "b4ef6a9d685bb479", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-26ed8c5a85972c2f", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/node-types"}, "properties": {"repobilityId": "4c371db0cb2040ab", "scanner": "scanner-primary", "fingerprint": "26ed8c5a85972c2f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a618a71df22117f7", "level": "note", "message": {"text": "Unused endpoint: GET /api/v2/graph/node-types/:code"}, "properties": {"repobilityId": "d0f4db6573e8d50e", "scanner": "scanner-primary", "fingerprint": "a618a71df22117f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f63729339dc9f213", "level": "note", "message": {"text": "Unused endpoint: POST /api/v2/graph/node-types"}, "properties": {"repobilityId": "2cd4eb7c2e5272f7", "scanner": "scanner-primary", "fingerprint": "f63729339dc9f213", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-21c0bf2f1c04a11a", "level": "note", "message": {"text": "Unused endpoint: PUT /api/v2/graph/node-types/:code"}, "properties": {"repobilityId": "db2db986b8a450d6", "scanner": "scanner-primary", "fingerprint": "21c0bf2f1c04a11a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0bca3ea8b14d2545", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/v2/graph/node-types/:code"}, "properties": {"repobilityId": "eac977e3f32fd6f0", "scanner": "scanner-primary", "fingerprint": "0bca3ea8b14d2545", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca956d176e87b172", "level": "note", "message": {"text": "Unused endpoint: GET /ui/consult"}, "properties": {"repobilityId": "fe6d186fd3ccdfda", "scanner": "scanner-primary", "fingerprint": "ca956d176e87b172", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}