{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7faa9b6d1c6275f4", "name": "Stray `console.log` in TS/JS \u2014 test-founding.js:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test-founding.js:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c17c1a424c714ede", "name": "Stray `console.log` in TS/JS \u2014 server.js:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0cb8d6ed2cd2247", "name": "Very large file: server.js (3807 lines)", "shortDescription": {"text": "Very large file: server.js (3807 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 43 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5367147942da32e7", "name": "Commented-code block (6 lines) in server.js:320", "shortDescription": {"text": "Commented-code block (6 lines) in server.js:320"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e289900e9596927d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:2190", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:2190"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fdf81b8ac863d25", "name": "Dangling fetch: POST https://oauth2.googleapis.com/token (server.js:2181)", "shortDescription": {"text": "Dangling fetch: POST https://oauth2.googleapis.com/token (server.js:2181)"}, "fullDescription": {"text": "`server.js:2181` calls `POST https://oauth2.googleapis.com/token` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/oauth2.googleapis.com/token`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d8eed05cfbc469f", "name": "Dangling fetch: GET https://www.googleapis.com/oauth2/v3/userinfo (server.js:2190)", "shortDescription": {"text": "Dangling fetch: GET https://www.googleapis.com/oauth2/v3/userinfo (server.js:2190)"}, "fullDescription": {"text": "`server.js:2190` calls `GET https://www.googleapis.com/oauth2/v3/userinfo` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/www.googleapis.com/oauth2/v3/userinfo`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bea83c8d2c126bda", "name": "Dangling fetch: POST https://www.linkedin.com/oauth/v2/accessToken (server.js:2236)", "shortDescription": {"text": "Dangling fetch: POST https://www.linkedin.com/oauth/v2/accessToken (server.js:2236)"}, "fullDescription": {"text": "`server.js:2236` calls `POST https://www.linkedin.com/oauth/v2/accessToken` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/www.linkedin.com/oauth/v2/accesstoken`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9add61a5162cceb4", "name": "Dangling fetch: GET https://api.linkedin.com/v2/userinfo (server.js:2246)", "shortDescription": {"text": "Dangling fetch: GET https://api.linkedin.com/v2/userinfo (server.js:2246)"}, "fullDescription": {"text": "`server.js:2246` calls `GET https://api.linkedin.com/v2/userinfo` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.linkedin.com/v2/userinfo`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f63c27f7ffbe2e84", "name": "Unused endpoint: USE /generate-template", "shortDescription": {"text": "Unused endpoint: USE /generate-template"}, "fullDescription": {"text": "`server.js` declares `USE /generate-template` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34e5f4b7ea7ae840", "name": "Unused endpoint: USE /extract-resume", "shortDescription": {"text": "Unused endpoint: USE /extract-resume"}, "fullDescription": {"text": "`server.js` declares `USE /extract-resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-665530d25106d60d", "name": "Unused endpoint: USE /review-resume", "shortDescription": {"text": "Unused endpoint: USE /review-resume"}, "fullDescription": {"text": "`server.js` declares `USE /review-resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bda4216bd040ba37", "name": "Unused endpoint: USE /improve-summary", "shortDescription": {"text": "Unused endpoint: USE /improve-summary"}, "fullDescription": {"text": "`server.js` declares `USE /improve-summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7dac6b182f06493", "name": "Unused endpoint: USE /generate-pdf", "shortDescription": {"text": "Unused endpoint: USE /generate-pdf"}, "fullDescription": {"text": "`server.js` declares `USE /generate-pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e57499748be8b06b", "name": "Unused endpoint: USE /analyze-job-match", "shortDescription": {"text": "Unused endpoint: USE /analyze-job-match"}, "fullDescription": {"text": "`server.js` declares `USE /analyze-job-match` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c92341d33158b267", "name": "Unused endpoint: USE /optimize-for-job", "shortDescription": {"text": "Unused endpoint: USE /optimize-for-job"}, "fullDescription": {"text": "`server.js` declares `USE /optimize-for-job` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a693f4173426467f", "name": "Unused endpoint: USE /analyze-food", "shortDescription": {"text": "Unused endpoint: USE /analyze-food"}, "fullDescription": {"text": "`server.js` declares `USE /analyze-food` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fb2ff022d840371", "name": "Unused endpoint: USE /create-order", "shortDescription": {"text": "Unused endpoint: USE /create-order"}, "fullDescription": {"text": "`server.js` declares `USE /create-order` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7244378d72c0e702", "name": "Unused endpoint: USE /verify-payment", "shortDescription": {"text": "Unused endpoint: USE /verify-payment"}, "fullDescription": {"text": "`server.js` declares `USE /verify-payment` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a650cdbd752e6825", "name": "Unused endpoint: USE /auth/magic-link/request", "shortDescription": {"text": "Unused endpoint: USE /auth/magic-link/request"}, "fullDescription": {"text": "`server.js` declares `USE /auth/magic-link/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9a6d1e64145b843", "name": "Unused endpoint: USE /auth/poll", "shortDescription": {"text": "Unused endpoint: USE /auth/poll"}, "fullDescription": {"text": "`server.js` declares `USE /auth/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f325676e7fd20a9c", "name": "Unused endpoint: USE /auth/init-poll", "shortDescription": {"text": "Unused endpoint: USE /auth/init-poll"}, "fullDescription": {"text": "`server.js` declares `USE /auth/init-poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ba8d60a36af71bf", "name": "Unused endpoint: POST /generate-pdf", "shortDescription": {"text": "Unused endpoint: POST /generate-pdf"}, "fullDescription": {"text": "`server.js` declares `POST /generate-pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bb42204ff9271dd", "name": "Unused endpoint: POST /extract-resume", "shortDescription": {"text": "Unused endpoint: POST /extract-resume"}, "fullDescription": {"text": "`server.js` declares `POST /extract-resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1afe0c01979bac18", "name": "Unused endpoint: POST /generate-template", "shortDescription": {"text": "Unused endpoint: POST /generate-template"}, "fullDescription": {"text": "`server.js` declares `POST /generate-template` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-242ae993e874baa6", "name": "Unused endpoint: POST /improve-summary", "shortDescription": {"text": "Unused endpoint: POST /improve-summary"}, "fullDescription": {"text": "`server.js` declares `POST /improve-summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1237273ffa4c38a2", "name": "Unused endpoint: POST /review-resume", "shortDescription": {"text": "Unused endpoint: POST /review-resume"}, "fullDescription": {"text": "`server.js` declares `POST /review-resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aee13233591f8262", "name": "Unused endpoint: POST /analyze-job-match", "shortDescription": {"text": "Unused endpoint: POST /analyze-job-match"}, "fullDescription": {"text": "`server.js` declares `POST /analyze-job-match` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e8b53c10ec0a6b2", "name": "Unused endpoint: POST /optimize-for-job", "shortDescription": {"text": "Unused endpoint: POST /optimize-for-job"}, "fullDescription": {"text": "`server.js` declares `POST /optimize-for-job` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9f0c712241895d", "name": "Unused endpoint: GET /auth/google", "shortDescription": {"text": "Unused endpoint: GET /auth/google"}, "fullDescription": {"text": "`server.js` declares `GET /auth/google` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-392dcbd9c0e4ed85", "name": "Unused endpoint: GET /auth/google/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/google/callback"}, "fullDescription": {"text": "`server.js` declares `GET /auth/google/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e02d45b58d0e155", "name": "Unused endpoint: GET /auth/linkedin", "shortDescription": {"text": "Unused endpoint: GET /auth/linkedin"}, "fullDescription": {"text": "`server.js` declares `GET /auth/linkedin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fa0c591df2d3f95", "name": "Unused endpoint: GET /auth/linkedin/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/linkedin/callback"}, "fullDescription": {"text": "`server.js` declares `GET /auth/linkedin/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e02f8c59b8ded7ec", "name": "Unused endpoint: POST /auth/magic-link/request", "shortDescription": {"text": "Unused endpoint: POST /auth/magic-link/request"}, "fullDescription": {"text": "`server.js` declares `POST /auth/magic-link/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-013b32ea624b6689", "name": "Unused endpoint: GET /auth/magic-link/verify", "shortDescription": {"text": "Unused endpoint: GET /auth/magic-link/verify"}, "fullDescription": {"text": "`server.js` declares `GET /auth/magic-link/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac42422b23e45104", "name": "Unused endpoint: GET /auth/me", "shortDescription": {"text": "Unused endpoint: GET /auth/me"}, "fullDescription": {"text": "`server.js` declares `GET /auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49917f5f5a40be51", "name": "Unused endpoint: POST /auth/init-poll", "shortDescription": {"text": "Unused endpoint: POST /auth/init-poll"}, "fullDescription": {"text": "`server.js` declares `POST /auth/init-poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34e72b1bd933fd8a", "name": "Unused endpoint: GET /auth/poll", "shortDescription": {"text": "Unused endpoint: GET /auth/poll"}, "fullDescription": {"text": "`server.js` declares `GET /auth/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`server.js` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3abea5b28826e2fd", "name": "Unused endpoint: POST /auth/save-resume", "shortDescription": {"text": "Unused endpoint: POST /auth/save-resume"}, "fullDescription": {"text": "`server.js` declares `POST /auth/save-resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5926b94779b44102", "name": "Unused endpoint: GET /auth/resumes", "shortDescription": {"text": "Unused endpoint: GET /auth/resumes"}, "fullDescription": {"text": "`server.js` declares `GET /auth/resumes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db856d8527540533", "name": "Unused endpoint: POST /auth/save-ats-report", "shortDescription": {"text": "Unused endpoint: POST /auth/save-ats-report"}, "fullDescription": {"text": "`server.js` declares `POST /auth/save-ats-report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf4bbf11a3f91894", "name": "Unused endpoint: POST /analyze-food", "shortDescription": {"text": "Unused endpoint: POST /analyze-food"}, "fullDescription": {"text": "`server.js` declares `POST /analyze-food` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-122a7e272073cbaa", "name": "Unused endpoint: POST /create-order", "shortDescription": {"text": "Unused endpoint: POST /create-order"}, "fullDescription": {"text": "`server.js` declares `POST /create-order` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4b6f08896455d5b", "name": "Unused endpoint: POST /verify-payment", "shortDescription": {"text": "Unused endpoint: POST /verify-payment"}, "fullDescription": {"text": "`server.js` declares `POST /verify-payment` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4ac0c3b14259f4f", "name": "Unused endpoint: USE /coach", "shortDescription": {"text": "Unused endpoint: USE /coach"}, "fullDescription": {"text": "`server.js` declares `USE /coach` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e16d5c870c289f6", "name": "Unused endpoint: GET /coach/me", "shortDescription": {"text": "Unused endpoint: GET /coach/me"}, "fullDescription": {"text": "`server.js` declares `GET /coach/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb8ff2b149f8bcef", "name": "Unused endpoint: POST /coach/sessions", "shortDescription": {"text": "Unused endpoint: POST /coach/sessions"}, "fullDescription": {"text": "`server.js` declares `POST /coach/sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6784cb0dae97c6f4", "name": "Unused endpoint: GET /coach/sessions", "shortDescription": {"text": "Unused endpoint: GET /coach/sessions"}, "fullDescription": {"text": "`server.js` declares `GET /coach/sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cb889b2e1a3b73c", "name": "Unused endpoint: GET /coach/sessions/:id", "shortDescription": {"text": "Unused endpoint: GET /coach/sessions/:id"}, "fullDescription": {"text": "`server.js` declares `GET /coach/sessions/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fc17cd1a276ffe6", "name": "Unused endpoint: POST /coach/sessions/:id/answers", "shortDescription": {"text": "Unused endpoint: POST /coach/sessions/:id/answers"}, "fullDescription": {"text": "`server.js` declares `POST /coach/sessions/:id/answers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-844c879de0c9ef42", "name": "Unused endpoint: POST /coach/sessions/:id/score", "shortDescription": {"text": "Unused endpoint: POST /coach/sessions/:id/score"}, "fullDescription": {"text": "`server.js` declares `POST /coach/sessions/:id/score` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ea01922fc41fd14", "name": "Unused endpoint: POST /coach/sessions/:id/question-audio", "shortDescription": {"text": "Unused endpoint: POST /coach/sessions/:id/question-audio"}, "fullDescription": {"text": "`server.js` declares `POST /coach/sessions/:id/question-audio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b23dc3258dfbec5", "name": "Unused endpoint: POST /coach/sessions/:id/transcribe", "shortDescription": {"text": "Unused endpoint: POST /coach/sessions/:id/transcribe"}, "fullDescription": {"text": "`server.js` declares `POST /coach/sessions/:id/transcribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2841cbed88e0d01", "name": "Unused endpoint: USE /referral", "shortDescription": {"text": "Unused endpoint: USE /referral"}, "fullDescription": {"text": "`server.js` declares `USE /referral` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e0daeb62309cb21", "name": "Unused endpoint: POST /referral/claim", "shortDescription": {"text": "Unused endpoint: POST /referral/claim"}, "fullDescription": {"text": "`server.js` declares `POST /referral/claim` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2968e1d28fe9e856", "name": "Unused endpoint: GET /founding/status", "shortDescription": {"text": "Unused endpoint: GET /founding/status"}, "fullDescription": {"text": "`server.js` declares `GET /founding/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-967d0b4dcdb43a2e", "name": "Unused endpoint: USE /founding/redeem", "shortDescription": {"text": "Unused endpoint: USE /founding/redeem"}, "fullDescription": {"text": "`server.js` declares `USE /founding/redeem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe689ee09972c158", "name": "Unused endpoint: POST /founding/redeem", "shortDescription": {"text": "Unused endpoint: POST /founding/redeem"}, "fullDescription": {"text": "`server.js` declares `POST /founding/redeem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/28892"}, "properties": {"repository": "rakshitsegwal/salesforce-resume-pdf-server", "repoUrl": "https://github.com/rakshitsegwal/salesforce-resume-pdf-server", "branch": "main"}, "results": [{"ruleId": "scanner-7faa9b6d1c6275f4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test-founding.js:18"}, "properties": {"repobilityId": "91ad9ac12adb46ba", "scanner": "scanner-primary", "fingerprint": "7faa9b6d1c6275f4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c17c1a424c714ede", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:53"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "c17c1a424c714ede", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d0cb8d6ed2cd2247", "level": "note", "message": {"text": "Very large file: server.js (3807 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "d0cb8d6ed2cd2247", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6501eb22fea61310", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "07fc7b480fce181e", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "3b8c84742cf37b6e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "15d1c88ffedda283", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "d6d68d3fa9b09095", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-5367147942da32e7", "level": "none", "message": {"text": "Commented-code block (6 lines) in server.js:320"}, "properties": {"repobilityId": "846f0b3ab3f3793d", "scanner": "scanner-primary", "fingerprint": "5367147942da32e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e289900e9596927d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:2190"}, "properties": {"repobilityId": "a8a5b3ddd974c08f", "scanner": "scanner-primary", "fingerprint": "e289900e9596927d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1fdf81b8ac863d25", "level": "error", "message": {"text": "Dangling fetch: POST https://oauth2.googleapis.com/token (server.js:2181)"}, "properties": {"repobilityId": "d5a025cac8ab5fc5", "scanner": "scanner-primary", "fingerprint": "1fdf81b8ac863d25", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8d8eed05cfbc469f", "level": "error", "message": {"text": "Dangling fetch: GET https://www.googleapis.com/oauth2/v3/userinfo (server.js:2190)"}, "properties": {"repobilityId": "0534cc2ba72670cf", "scanner": "scanner-primary", "fingerprint": "8d8eed05cfbc469f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-bea83c8d2c126bda", "level": "error", "message": {"text": "Dangling fetch: POST https://www.linkedin.com/oauth/v2/accessToken (server.js:2236)"}, "properties": {"repobilityId": "c48f3328d7320b36", "scanner": "scanner-primary", "fingerprint": "bea83c8d2c126bda", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9add61a5162cceb4", "level": "error", "message": {"text": "Dangling fetch: GET https://api.linkedin.com/v2/userinfo (server.js:2246)"}, "properties": {"repobilityId": "4d2601653a0e6748", "scanner": "scanner-primary", "fingerprint": "9add61a5162cceb4", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-f63c27f7ffbe2e84", "level": "note", "message": {"text": "Unused endpoint: USE /generate-template"}, "properties": {"repobilityId": "359fc6dcf0fd777e", "scanner": "scanner-primary", "fingerprint": "f63c27f7ffbe2e84", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34e5f4b7ea7ae840", "level": "note", "message": {"text": "Unused endpoint: USE /extract-resume"}, "properties": {"repobilityId": "c1ceef918379ed14", "scanner": "scanner-primary", "fingerprint": "34e5f4b7ea7ae840", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-665530d25106d60d", "level": "note", "message": {"text": "Unused endpoint: USE /review-resume"}, "properties": {"repobilityId": "47d5f1707d45d2be", "scanner": "scanner-primary", "fingerprint": "665530d25106d60d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bda4216bd040ba37", "level": "note", "message": {"text": "Unused endpoint: USE /improve-summary"}, "properties": {"repobilityId": "3a0c15dea8cd7466", "scanner": "scanner-primary", "fingerprint": "bda4216bd040ba37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7dac6b182f06493", "level": "note", "message": {"text": "Unused endpoint: USE /generate-pdf"}, "properties": {"repobilityId": "c8ec86bacc8c3568", "scanner": "scanner-primary", "fingerprint": "f7dac6b182f06493", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e57499748be8b06b", "level": "note", "message": {"text": "Unused endpoint: USE /analyze-job-match"}, "properties": {"repobilityId": "f67a6a7d9c1074fc", "scanner": "scanner-primary", "fingerprint": "e57499748be8b06b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c92341d33158b267", "level": "note", "message": {"text": "Unused endpoint: USE /optimize-for-job"}, "properties": {"repobilityId": "8acc498546008a41", "scanner": "scanner-primary", "fingerprint": "c92341d33158b267", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a693f4173426467f", "level": "note", "message": {"text": "Unused endpoint: USE /analyze-food"}, "properties": {"repobilityId": "b54d10b92208aa7c", "scanner": "scanner-primary", "fingerprint": "a693f4173426467f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fb2ff022d840371", "level": "note", "message": {"text": "Unused endpoint: USE /create-order"}, "properties": {"repobilityId": "0ff306fdcf4fd8ce", "scanner": "scanner-primary", "fingerprint": "4fb2ff022d840371", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7244378d72c0e702", "level": "note", "message": {"text": "Unused endpoint: USE /verify-payment"}, "properties": {"repobilityId": "106d4fcec0e3326a", "scanner": "scanner-primary", "fingerprint": "7244378d72c0e702", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a650cdbd752e6825", "level": "note", "message": {"text": "Unused endpoint: USE /auth/magic-link/request"}, "properties": {"repobilityId": "a57e6bd9ef991433", "scanner": "scanner-primary", "fingerprint": "a650cdbd752e6825", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9a6d1e64145b843", "level": "note", "message": {"text": "Unused endpoint: USE /auth/poll"}, "properties": {"repobilityId": "46a8e4186a02be9f", "scanner": "scanner-primary", "fingerprint": "f9a6d1e64145b843", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f325676e7fd20a9c", "level": "note", "message": {"text": "Unused endpoint: USE /auth/init-poll"}, "properties": {"repobilityId": "e566f30aadee3658", "scanner": "scanner-primary", "fingerprint": "f325676e7fd20a9c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ba8d60a36af71bf", "level": "note", "message": {"text": "Unused endpoint: POST /generate-pdf"}, "properties": {"repobilityId": "4e6fddcbfbb30512", "scanner": "scanner-primary", "fingerprint": "5ba8d60a36af71bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8bb42204ff9271dd", "level": "note", "message": {"text": "Unused endpoint: POST /extract-resume"}, "properties": {"repobilityId": "62d64b4ebf3bb83a", "scanner": "scanner-primary", "fingerprint": "8bb42204ff9271dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1afe0c01979bac18", "level": "note", "message": {"text": "Unused endpoint: POST /generate-template"}, "properties": {"repobilityId": "34804644b51365f8", "scanner": "scanner-primary", "fingerprint": "1afe0c01979bac18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-242ae993e874baa6", "level": "note", "message": {"text": "Unused endpoint: POST /improve-summary"}, "properties": {"repobilityId": "3b15c50e33ce559f", "scanner": "scanner-primary", "fingerprint": "242ae993e874baa6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1237273ffa4c38a2", "level": "note", "message": {"text": "Unused endpoint: POST /review-resume"}, "properties": {"repobilityId": "a2ecc4824e080fc4", "scanner": "scanner-primary", "fingerprint": "1237273ffa4c38a2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aee13233591f8262", "level": "note", "message": {"text": "Unused endpoint: POST /analyze-job-match"}, "properties": {"repobilityId": "20aa66b17a543b98", "scanner": "scanner-primary", "fingerprint": "aee13233591f8262", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e8b53c10ec0a6b2", "level": "note", "message": {"text": "Unused endpoint: POST /optimize-for-job"}, "properties": {"repobilityId": "4e1aaff88927d039", "scanner": "scanner-primary", "fingerprint": "0e8b53c10ec0a6b2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e9f0c712241895d", "level": "note", "message": {"text": "Unused endpoint: GET /auth/google"}, "properties": {"repobilityId": "b1d68179f12a8117", "scanner": "scanner-primary", "fingerprint": "2e9f0c712241895d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-392dcbd9c0e4ed85", "level": "note", "message": {"text": "Unused endpoint: GET /auth/google/callback"}, "properties": {"repobilityId": "80b850cd20022d10", "scanner": "scanner-primary", "fingerprint": "392dcbd9c0e4ed85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e02d45b58d0e155", "level": "note", "message": {"text": "Unused endpoint: GET /auth/linkedin"}, "properties": {"repobilityId": "f688ca38abf28e00", "scanner": "scanner-primary", "fingerprint": "8e02d45b58d0e155", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6fa0c591df2d3f95", "level": "note", "message": {"text": "Unused endpoint: GET /auth/linkedin/callback"}, "properties": {"repobilityId": "ffa4992a13fc8465", "scanner": "scanner-primary", "fingerprint": "6fa0c591df2d3f95", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e02f8c59b8ded7ec", "level": "note", "message": {"text": "Unused endpoint: POST /auth/magic-link/request"}, "properties": {"repobilityId": "625d9964dff821c1", "scanner": "scanner-primary", "fingerprint": "e02f8c59b8ded7ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-013b32ea624b6689", "level": "note", "message": {"text": "Unused endpoint: GET /auth/magic-link/verify"}, "properties": {"repobilityId": "8060be2c4e66f02a", "scanner": "scanner-primary", "fingerprint": "013b32ea624b6689", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac42422b23e45104", "level": "note", "message": {"text": "Unused endpoint: GET /auth/me"}, "properties": {"repobilityId": "ad479acce3563a1e", "scanner": "scanner-primary", "fingerprint": "ac42422b23e45104", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49917f5f5a40be51", "level": "note", "message": {"text": "Unused endpoint: POST /auth/init-poll"}, "properties": {"repobilityId": "d33a485e2ef2c921", "scanner": "scanner-primary", "fingerprint": "49917f5f5a40be51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34e72b1bd933fd8a", "level": "note", "message": {"text": "Unused endpoint: GET /auth/poll"}, "properties": {"repobilityId": "89bfb99d728a377b", "scanner": "scanner-primary", "fingerprint": "34e72b1bd933fd8a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "b10c8daad0c2922a", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3abea5b28826e2fd", "level": "note", "message": {"text": "Unused endpoint: POST /auth/save-resume"}, "properties": {"repobilityId": "0c0dd1d5a0a77be6", "scanner": "scanner-primary", "fingerprint": "3abea5b28826e2fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5926b94779b44102", "level": "note", "message": {"text": "Unused endpoint: GET /auth/resumes"}, "properties": {"repobilityId": "d63b4b1111ac09ff", "scanner": "scanner-primary", "fingerprint": "5926b94779b44102", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db856d8527540533", "level": "note", "message": {"text": "Unused endpoint: POST /auth/save-ats-report"}, "properties": {"repobilityId": "bcda096464677dbb", "scanner": "scanner-primary", "fingerprint": "db856d8527540533", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf4bbf11a3f91894", "level": "note", "message": {"text": "Unused endpoint: POST /analyze-food"}, "properties": {"repobilityId": "7542a97e760d8c6b", "scanner": "scanner-primary", "fingerprint": "bf4bbf11a3f91894", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-122a7e272073cbaa", "level": "note", "message": {"text": "Unused endpoint: POST /create-order"}, "properties": {"repobilityId": "4e7e356b9ab65628", "scanner": "scanner-primary", "fingerprint": "122a7e272073cbaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4b6f08896455d5b", "level": "note", "message": {"text": "Unused endpoint: POST /verify-payment"}, "properties": {"repobilityId": "d2924c54d12f064e", "scanner": "scanner-primary", "fingerprint": "b4b6f08896455d5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4ac0c3b14259f4f", "level": "note", "message": {"text": "Unused endpoint: USE /coach"}, "properties": {"repobilityId": "038edec4cb9c410a", "scanner": "scanner-primary", "fingerprint": "a4ac0c3b14259f4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e16d5c870c289f6", "level": "note", "message": {"text": "Unused endpoint: GET /coach/me"}, "properties": {"repobilityId": "31813baddd345fd9", "scanner": "scanner-primary", "fingerprint": "6e16d5c870c289f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb8ff2b149f8bcef", "level": "note", "message": {"text": "Unused endpoint: POST /coach/sessions"}, "properties": {"repobilityId": "d12d01369a594caa", "scanner": "scanner-primary", "fingerprint": "eb8ff2b149f8bcef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6784cb0dae97c6f4", "level": "note", "message": {"text": "Unused endpoint: GET /coach/sessions"}, "properties": {"repobilityId": "6f92ae348b6da692", "scanner": "scanner-primary", "fingerprint": "6784cb0dae97c6f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6cb889b2e1a3b73c", "level": "note", "message": {"text": "Unused endpoint: GET /coach/sessions/:id"}, "properties": {"repobilityId": "8b261f568c7eb585", "scanner": "scanner-primary", "fingerprint": "6cb889b2e1a3b73c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0fc17cd1a276ffe6", "level": "note", "message": {"text": "Unused endpoint: POST /coach/sessions/:id/answers"}, "properties": {"repobilityId": "e7c059caf019697d", "scanner": "scanner-primary", "fingerprint": "0fc17cd1a276ffe6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-844c879de0c9ef42", "level": "note", "message": {"text": "Unused endpoint: POST /coach/sessions/:id/score"}, "properties": {"repobilityId": "cdfbf465e4eb82ea", "scanner": "scanner-primary", "fingerprint": "844c879de0c9ef42", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ea01922fc41fd14", "level": "note", "message": {"text": "Unused endpoint: POST /coach/sessions/:id/question-audio"}, "properties": {"repobilityId": "022b6ffbfdeac483", "scanner": "scanner-primary", "fingerprint": "2ea01922fc41fd14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6b23dc3258dfbec5", "level": "note", "message": {"text": "Unused endpoint: POST /coach/sessions/:id/transcribe"}, "properties": {"repobilityId": "a84f18b15f7347fd", "scanner": "scanner-primary", "fingerprint": "6b23dc3258dfbec5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c2841cbed88e0d01", "level": "note", "message": {"text": "Unused endpoint: USE /referral"}, "properties": {"repobilityId": "d95bdf1d6ee33853", "scanner": "scanner-primary", "fingerprint": "c2841cbed88e0d01", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7e0daeb62309cb21", "level": "note", "message": {"text": "Unused endpoint: POST /referral/claim"}, "properties": {"repobilityId": "79372d8ca85c724d", "scanner": "scanner-primary", "fingerprint": "7e0daeb62309cb21", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2968e1d28fe9e856", "level": "note", "message": {"text": "Unused endpoint: GET /founding/status"}, "properties": {"repobilityId": "d33a6d8528d1e882", "scanner": "scanner-primary", "fingerprint": "2968e1d28fe9e856", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-967d0b4dcdb43a2e", "level": "note", "message": {"text": "Unused endpoint: USE /founding/redeem"}, "properties": {"repobilityId": "f94541799db1862f", "scanner": "scanner-primary", "fingerprint": "967d0b4dcdb43a2e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fe689ee09972c158", "level": "note", "message": {"text": "Unused endpoint: POST /founding/redeem"}, "properties": {"repobilityId": "03ca0561c6ce015e", "scanner": "scanner-primary", "fingerprint": "fe689ee09972c158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}