Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

sathwik-y/zanzo

https://github.com/sathwik-y/zanzo · scanned 2026-06-16 00:03 UTC (2 months, 3 weeks ago)

72 raw signals (0 security + 72 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 3 weeks ago · v1 · 51 actionable findings from 1 signal source. 21 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
85.4
/100
Security checks
85
0 findings
System graph
85
100.0% cov · 51 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 0 Medium 2 Low 47 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 51 Crowd 0 Layer: Software 5 Hardware 1 Frontend 1 Cicd 1 Quality 13 Api 30
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 85.4/100 with 100.0% coverage. It contains 574 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 72 findings — concentrated in api (30), quality (26), software (13). Risk profile is low: 0 critical, 0 high, 2 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 49 of 51 actionable findings. 72 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
low System graph quality Production readiness conf 1.00 Composite production-readiness gap
Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.
Repo hardeningGenerated repo pattern
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 49 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 6 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: backend/recall/ai/gemini.py:classify, backend/recall/ai/gemini.py:classify This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
6 occurrences
repo-level (6 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 9 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: backend/recall/storage.py:put_file, backend/recall/storage.py:put_file, backend/recall/storage.py:put_file This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why …
9 occurrences
repo-level (9 hits)
duplicatesduplication
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `direct_v2` in backend/recall/instagram/dms.py:51
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `direct_v2` in backend/recall/services/engagement.py:56
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `direct_v2` in scripts/spike_dm_raw.py:14
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `direct_v2` in scripts/spike_generic_xma.py:15
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_relink_moves_identity_and_keeps_single_copy` in backend/tests/test_dedupe.py:69
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: cta
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/recall/pipeline/cta.py:131
low System graph software Dead code conf 1.00 5 occurrences Possibly dead Python function: downgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
5 files, 5 locations
backend/alembic/versions/29b258f63239_initial_schema.py:101
backend/alembic/versions/56bbf504f257_v2_transcript_provider_resources_.py:50
backend/alembic/versions/7a1c9d4e2f01_users_and_multitenancy.py:56
backend/alembic/versions/8b2d0e5f3a12_bot_accounts.py:43
backend/alembic/versions/9c3e1f6a4b23_item_dm_sender.py:27
low System graph software Dead code conf 1.00 Possibly dead Python function: extract_then_cta
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/recall/services/worker.py:54
low System graph software Dead code conf 1.00 Possibly dead Python function: fetch_dm_shares
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/recall/instagram/dms.py:166
low System graph software Dead code conf 1.00 5 occurrences Possibly dead Python function: upgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
5 files, 5 locations
backend/alembic/versions/29b258f63239_initial_schema.py:22
backend/alembic/versions/56bbf504f257_v2_transcript_provider_resources_.py:21
backend/alembic/versions/7a1c9d4e2f01_users_and_multitenancy.py:20
backend/alembic/versions/8b2d0e5f3a12_bot_accounts.py:20
backend/alembic/versions/9c3e1f6a4b23_item_dm_sender.py:20
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /admin/bots/{bot_id}
`backend/recall/api/routes_admin.py` declares `DELETE /admin/bots/{bot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /instagram/link
`backend/recall/api/routes_auth.py` declares `DELETE /instagram/link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /{item_id}
`backend/recall/api/routes_items.py` declares `DELETE /{item_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`backend/recall/api/routes_items.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/bots
`backend/recall/api/routes_admin.py` declares `GET /admin/bots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/stats
`backend/recall/api/routes_admin.py` declares `GET /admin/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/users
`backend/recall/api/routes_admin.py` declares `GET /admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /engagement
`backend/recall/api/routes_admin.py` declares `GET /engagement` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /engagement/config
`backend/recall/api/routes_admin.py` declares `GET /engagement/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /instagram/link
`backend/recall/api/routes_auth.py` declares `GET /instagram/link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /me
`backend/recall/api/routes_auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /poller/next
`backend/recall/api/routes_admin.py` declares `GET /poller/next` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /poller/status
`backend/recall/api/routes_admin.py` declares `GET /poller/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /resources
`backend/recall/api/routes_admin.py` declares `GET /resources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /stats
`backend/recall/api/routes_admin.py` declares `GET /stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{item_id}
`backend/recall/api/routes_items.py` declares `GET /{item_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{item_id}/media
`backend/recall/api/routes_items.py` declares `GET /{item_id}/media` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /admin/bots/{bot_id}
`backend/recall/api/routes_admin.py` declares `PATCH /admin/bots/{bot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{item_id}
`backend/recall/api/routes_items.py` declares `PATCH /{item_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/bots
`backend/recall/api/routes_admin.py` declares `POST /admin/bots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /event/{item_id}/add-to-calendar
`backend/recall/api/routes_actions.py` declares `POST /event/{item_id}/add-to-calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who con…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /instagram/link
`backend/recall/api/routes_auth.py` declares `POST /instagram/link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /instagram/verify-now
`backend/recall/api/routes_auth.py` declares `POST /instagram/verify-now` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /login
`backend/recall/api/routes_auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /poller/resume
`backend/recall/api/routes_admin.py` declares `POST /poller/resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /refresh
`backend/recall/api/routes_auth.py` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /signup
`backend/recall/api/routes_auth.py` declares `POST /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{item_id}/recategorize
`backend/recall/api/routes_items.py` declares `POST /{item_id}/recategorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{item_id}/retry
`backend/recall/api/routes_items.py` declares `POST /{item_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /engagement/config
`backend/recall/api/routes_admin.py` declares `PUT /engagement/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/6f3a38a5-ee8b-4ce9-971f-abc8364347de/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/6f3a38a5-ee8b-4ce9-971f-abc8364347de/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.