{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e28caf841a49d3fd", "name": "Possibly dead Python function: is_feature_enabled", "shortDescription": {"text": "Possibly dead Python function: is_feature_enabled"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9943b5be6447f75f", "name": "Possibly dead Python function: is_feature_teaser", "shortDescription": {"text": "Possibly dead Python function: is_feature_teaser"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62e0af762e24e04c", "name": "Possibly dead Python function: replay_receive", "shortDescription": {"text": "Possibly dead Python function: replay_receive"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3898280eab42e05a", "name": "Possibly dead Python function: capture_send", "shortDescription": {"text": "Possibly dead Python function: capture_send"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b32aa2e224c99ec2", "name": "Insecure pattern 'cors_wildcard' in app/main.py:266", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in app/main.py:266"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2698ffd66e0d6a1a", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/static/admin.html:570", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/static/admin.html:570"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28c4a04bd807da0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad6701f0a8405e22", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3d2bd25b460be76", "name": "Very large file: app/routers/webhooks.py (2818 lines)", "shortDescription": {"text": "Very large file: app/routers/webhooks.py (2818 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d72f0cb9f705e763", "name": "Very large file: app/routers/chat.py (1794 lines)", "shortDescription": {"text": "Very large file: app/routers/chat.py (1794 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 15 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d4ee19e34affbdd", "name": "Commented-code block (5 lines) in tests/test_reasoning_levels_per_model.py:18", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_reasoning_levels_per_model.py:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e62b0493c1b13f77", "name": "Commented-code block (5 lines) in tests/test_model_routing.py:269", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_model_routing.py:269"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8106af16ed62842a", "name": "Commented-code block (6 lines) in tests/test_search_caps.py:496", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_search_caps.py:496"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c6dcbf31b35b7a1", "name": "Commented-code block (5 lines) in app/database.py:123", "shortDescription": {"text": "Commented-code block (5 lines) in app/database.py:123"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1f553cb145506bb", "name": "Commented-code block (6 lines) in app/config.py:51", "shortDescription": {"text": "Commented-code block (6 lines) in app/config.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0369f66ae02b82c4", "name": "Commented-code block (7 lines) in app/secrets.py:73", "shortDescription": {"text": "Commented-code block (7 lines) in app/secrets.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc38db69c7f0a4bb", "name": "Commented-code block (5 lines) in app/main.py:87", "shortDescription": {"text": "Commented-code block (5 lines) in app/main.py:87"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-acf000972b85029f", "name": "Commented-code block (5 lines) in app/models/tier.py:21", "shortDescription": {"text": "Commented-code block (5 lines) in app/models/tier.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-21ec2c9129d37f34", "name": "Commented-code block (9 lines) in app/models/chat.py:17", "shortDescription": {"text": "Commented-code block (9 lines) in app/models/chat.py:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2464e9d46a823e8", "name": "Commented-code block (6 lines) in app/services/prompt_assembly.py:60", "shortDescription": {"text": "Commented-code block (6 lines) in app/services/prompt_assembly.py:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f15d86a6914b6b4f", "name": "Commented-code block (6 lines) in app/services/transcript_cleanup.py:46", "shortDescription": {"text": "Commented-code block (6 lines) in app/services/transcript_cleanup.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-24197af7a94b5ebd", "name": "Commented-code block (7 lines) in app/services/meeting_report.py:52", "shortDescription": {"text": "Commented-code block (7 lines) in app/services/meeting_report.py:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-005e10dc4ddcf2b1", "name": "Commented-code block (6 lines) in app/services/provider_health.py:180", "shortDescription": {"text": "Commented-code block (6 lines) in app/services/provider_health.py:180"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-330c956e97466eb0", "name": "Commented-code block (5 lines) in app/services/app_version.py:97", "shortDescription": {"text": "Commented-code block (5 lines) in app/services/app_version.py:97"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-11fa50c74760028b", "name": "Legacy-named symbol `model_copy` in app/services/anthropic_or_fallback.py:110", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/services/anthropic_or_fallback.py:110"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a5484dd3fb106c9", "name": "Commented-code block (5 lines) in app/services/usage_tracker.py:91", "shortDescription": {"text": "Commented-code block (5 lines) in app/services/usage_tracker.py:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3568763ae5673e79", "name": "Commented-code block (5 lines) in app/services/providers/anthropic.py:50", "shortDescription": {"text": "Commented-code block (5 lines) in app/services/providers/anthropic.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c050a188b6c665f", "name": "Legacy-named symbol `model_copy` in app/services/features/context_quilt_hook.py:90", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/services/features/context_quilt_hook.py:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ccf1a829b18ff91", "name": "Commented-code block (7 lines) in app/services/features/context_quilt_hook.py:66", "shortDescription": {"text": "Commented-code block (7 lines) in app/services/features/context_quilt_hook.py:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-036c08c0da7400fc", "name": "Commented-code block (7 lines) in app/routers/reports.py:118", "shortDescription": {"text": "Commented-code block (7 lines) in app/routers/reports.py:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d2ef879c67b35685", "name": "Legacy-named symbol `health_v1` in app/routers/health.py:42", "shortDescription": {"text": "Legacy-named symbol `health_v1` in app/routers/health.py:42"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9b8c2240e7faa7a", "name": "Commented-code block (5 lines) in app/routers/health.py:36", "shortDescription": {"text": "Commented-code block (5 lines) in app/routers/health.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ca1f1f02b2b9985", "name": "Commented-code block (5 lines) in app/routers/cq_proxy.py:193", "shortDescription": {"text": "Commented-code block (5 lines) in app/routers/cq_proxy.py:193"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5ea862e7eeee79e", "name": "Legacy-named symbol `pc_legacy` in app/routers/webhooks.py:793", "shortDescription": {"text": "Legacy-named symbol `pc_legacy` in app/routers/webhooks.py:793"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a49f1f5efe86d6c", "name": "Commented-code block (7 lines) in app/routers/webhooks.py:1874", "shortDescription": {"text": "Commented-code block (7 lines) in app/routers/webhooks.py:1874"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78815e84eddc3c75", "name": "Legacy-named symbol `model_copy` in app/routers/chat.py:976", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/routers/chat.py:976"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e529717a0ee99d27", "name": "Commented-code block (5 lines) in app/routers/chat.py:9", "shortDescription": {"text": "Commented-code block (5 lines) in app/routers/chat.py:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-920a0e47e85d42b8", "name": "Commented-code block (5 lines) in app/routers/unsubscribe.py:101", "shortDescription": {"text": "Commented-code block (5 lines) in app/routers/unsubscribe.py:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CZ_GCP_PROJECT`, `CZ_SECRET_CACHE_TTL_SECONDS`, `GIT_SHA`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp/models/chat.py:get_meta, app/routers/cq_proxy.py:get_meta\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp/routers/webhooks.py:dashboard, app/routers/webhooks.py:list_users, app/routers/webhooks.py:email_stats\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d048cfa2c233972", "name": "FastAPI POST `apple_auth` without auth dependency \u2014 app/routers/auth.py:46", "shortDescription": {"text": "FastAPI POST `apple_auth` without auth dependency \u2014 app/routers/auth.py:46"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1aa68f808365b86", "name": "FastAPI POST `refresh_token` without auth dependency \u2014 app/routers/auth.py:108", "shortDescription": {"text": "FastAPI POST `refresh_token` without auth dependency \u2014 app/routers/auth.py:108"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-793ac742de93ab90", "name": "FastAPI POST `receive_resend_webhook` without auth dependency \u2014 app/routers/resend_webhooks.py:102", "shortDescription": {"text": "FastAPI POST `receive_resend_webhook` without auth dependency \u2014 app/routers/resend_webhooks.py:102"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5407014a76a6b7d6", "name": "FastAPI POST `set_tier` without auth dependency \u2014 app/routers/webhooks.py:49", "shortDescription": {"text": "FastAPI POST `set_tier` without auth dependency \u2014 app/routers/webhooks.py:49"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8788a1c0a6faf463", "name": "FastAPI POST `simulate_tier` without auth dependency \u2014 app/routers/webhooks.py:119", "shortDescription": {"text": "FastAPI POST `simulate_tier` without auth dependency \u2014 app/routers/webhooks.py:119"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9de7e81b1a19fa43", "name": "FastAPI POST `update_feature_state` without auth dependency \u2014 app/routers/webhooks.py:187", "shortDescription": {"text": "FastAPI POST `update_feature_state` without auth dependency \u2014 app/routers/webhooks.py:187"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c95cd78f78b92bb", "name": "FastAPI POST `admin_capture_transcript` without auth dependency \u2014 app/routers/webhooks.py:240", "shortDescription": {"text": "FastAPI POST `admin_capture_transcript` without auth dependency \u2014 app/routers/webhooks.py:240"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-917a3060ae7c461d", "name": "FastAPI PUT `update_config` without auth dependency \u2014 app/routers/webhooks.py:392", "shortDescription": {"text": "FastAPI PUT `update_config` without auth dependency \u2014 app/routers/webhooks.py:392"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-025325f29b44ad09", "name": "FastAPI POST `sync_config_from_bundle` without auth dependency \u2014 app/routers/webhooks.py:522", "shortDescription": {"text": "FastAPI POST `sync_config_from_bundle` without auth dependency \u2014 app/routers/webhooks.py:522"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-041ca0ca02c8391d", "name": "FastAPI PUT `update_tier_tunable_field` without auth dependency \u2014 app/routers/webhooks.py:647", "shortDescription": {"text": "FastAPI PUT `update_tier_tunable_field` without auth dependency \u2014 app/routers/webhooks.py:647"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97766812526de795", "name": "FastAPI PUT `update_project_chat_cap` without auth dependency \u2014 app/routers/webhooks.py:712", "shortDescription": {"text": "FastAPI PUT `update_project_chat_cap` without auth dependency \u2014 app/routers/webhooks.py:712"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2ea9bd5f174223a6", "name": "FastAPI POST `update_key` without auth dependency \u2014 app/routers/webhooks.py:955", "shortDescription": {"text": "FastAPI POST `update_key` without auth dependency \u2014 app/routers/webhooks.py:955"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32cf5e0882c549e5", "name": "FastAPI POST `create_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2531", "shortDescription": {"text": "FastAPI POST `create_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2531"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3856de16954c1047", "name": "FastAPI PATCH `update_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2578", "shortDescription": {"text": "FastAPI PATCH `update_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2578"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca65152785b46bba", "name": "FastAPI DELETE `delete_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2640", "shortDescription": {"text": "FastAPI DELETE `delete_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2640"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9429d02ad88a7b63", "name": "FastAPI POST `test_send_alert` without auth dependency \u2014 app/routers/webhooks.py:2672", "shortDescription": {"text": "FastAPI POST `test_send_alert` without auth dependency \u2014 app/routers/webhooks.py:2672"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdec023ca676f8f6", "name": "FastAPI POST `admin_cert_pins_publish` without auth dependency \u2014 app/routers/webhooks.py:2793", "shortDescription": {"text": "FastAPI POST `admin_cert_pins_publish` without auth dependency \u2014 app/routers/webhooks.py:2793"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c0522777fcf86de7", "name": "FastAPI POST `apple_notifications` without auth dependency \u2014 app/routers/apple_webhooks.py:165", "shortDescription": {"text": "FastAPI POST `apple_notifications` without auth dependency \u2014 app/routers/apple_webhooks.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc45e912f78e4ea9", "name": "Unused endpoint: POST /v1/meetings/{meeting_id}/report", "shortDescription": {"text": "Unused endpoint: POST /v1/meetings/{meeting_id}/report"}, "fullDescription": {"text": "`app/routers/reports.py` declares `POST /v1/meetings/{meeting_id}/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74db1fc8575adda4", "name": "Unused endpoint: GET /v1/meetings/{meeting_id}/report", "shortDescription": {"text": "Unused endpoint: GET /v1/meetings/{meeting_id}/report"}, "fullDescription": {"text": "`app/routers/reports.py` declares `GET /v1/meetings/{meeting_id}/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa00d48c21916836", "name": "Unused endpoint: POST /v1/reports/render", "shortDescription": {"text": "Unused endpoint: POST /v1/reports/render"}, "fullDescription": {"text": "`app/routers/reports.py` declares `POST /v1/reports/render` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2b93272c0cdd105", "name": "Unused endpoint: GET /v1/health", "shortDescription": {"text": "Unused endpoint: GET /v1/health"}, "fullDescription": {"text": "`app/routers/health.py` declares `GET /v1/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953ec1a0ee6df50d", "name": "Unused endpoint: GET /admin", "shortDescription": {"text": "Unused endpoint: GET /admin"}, "fullDescription": {"text": "`app/routers/health.py` declares `GET /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df25963ad47b2ec1", "name": "Unused endpoint: GET /v1/model-pricing", "shortDescription": {"text": "Unused endpoint: GET /v1/model-pricing"}, "fullDescription": {"text": "`app/routers/health.py` declares `GET /v1/model-pricing` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85f7aa084970e502", "name": "Unused endpoint: GET /v1/config/cert-pins", "shortDescription": {"text": "Unused endpoint: GET /v1/config/cert-pins"}, "fullDescription": {"text": "`app/routers/cert_pins.py` declares `GET /v1/config/cert-pins` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b92e389696862af3", "name": "Unused endpoint: GET /v1/config/{name}", "shortDescription": {"text": "Unused endpoint: GET /v1/config/{name}"}, "fullDescription": {"text": "`app/routers/config.py` declares `GET /v1/config/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a05bcd347c31b110", "name": "Unused endpoint: POST /auth/apple", "shortDescription": {"text": "Unused endpoint: POST /auth/apple"}, "fullDescription": {"text": "`app/routers/auth.py` declares `POST /auth/apple` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b36892106ecdc9aa", "name": "Unused endpoint: POST /auth/refresh", "shortDescription": {"text": "Unused endpoint: POST /auth/refresh"}, "fullDescription": {"text": "`app/routers/auth.py` declares `POST /auth/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85258d174dd43b8c", "name": "Unused endpoint: POST /webhooks/resend", "shortDescription": {"text": "Unused endpoint: POST /webhooks/resend"}, "fullDescription": {"text": "`app/routers/resend_webhooks.py` declares `POST /webhooks/resend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-221e163b0a8895d4", "name": "Unused endpoint: POST /v1/capture-transcript", "shortDescription": {"text": "Unused endpoint: POST /v1/capture-transcript"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/capture-transcript` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7e2830390e2654a", "name": "Unused endpoint: GET /v1/quilt/{user_id}", "shortDescription": {"text": "Unused endpoint: GET /v1/quilt/{user_id}"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `GET /v1/quilt/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9592f2a562a09a1b", "name": "Unused endpoint: POST /v1/quilt/{user_id}/patches", "shortDescription": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/patches"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/quilt/{user_id}/patches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3483220caa4f921e", "name": "Unused endpoint: PATCH /v1/quilt/{user_id}/patches/{patch_id}", "shortDescription": {"text": "Unused endpoint: PATCH /v1/quilt/{user_id}/patches/{patch_id}"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `PATCH /v1/quilt/{user_id}/patches/{patch_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-057460aea215adde", "name": "Unused endpoint: DELETE /v1/quilt/{user_id}/patches/{patch_id}", "shortDescription": {"text": "Unused endpoint: DELETE /v1/quilt/{user_id}/patches/{patch_id}"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `DELETE /v1/quilt/{user_id}/patches/{patch_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c273e9ba8bada49a", "name": "Unused endpoint: POST /v1/quilt/{user_id}/patches/{patch_id}/complete", "shortDescription": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/patches/{patch_id}/complete"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/quilt/{user_id}/patches/{patch_id}/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df774ddd874db66b", "name": "Unused endpoint: POST /v1/quilt/{user_id}/connections", "shortDescription": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/connections"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/quilt/{user_id}/connections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db3bf8bd679ac390", "name": "Unused endpoint: DELETE /v1/quilt/{user_id}/connections", "shortDescription": {"text": "Unused endpoint: DELETE /v1/quilt/{user_id}/connections"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `DELETE /v1/quilt/{user_id}/connections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15bba83c8cdc1141", "name": "Unused endpoint: POST /v1/origins/{user_id}/{origin_type}/{origin_id}/assign-project", "shortDescription": {"text": "Unused endpoint: POST /v1/origins/{user_id}/{origin_type}/{origin_id}/assign-project"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/origins/{user_id}/{origin_type}/{origin_id}/assign-project` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cea02a7d26a3d301", "name": "Unused endpoint: POST /v1/meetings/{user_id}/{meeting_id}/assign-project", "shortDescription": {"text": "Unused endpoint: POST /v1/meetings/{user_id}/{meeting_id}/assign-project"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/meetings/{user_id}/{meeting_id}/assign-project` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48842a8b0cba21c9", "name": "Unused endpoint: GET /v1/schema", "shortDescription": {"text": "Unused endpoint: GET /v1/schema"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `GET /v1/schema` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6259aad39cc9fbde", "name": "Unused endpoint: POST /v1/quilt/{user_id}/rename-speaker", "shortDescription": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/rename-speaker"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/quilt/{user_id}/rename-speaker` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86782712d4feac11", "name": "Unused endpoint: POST /v1/quilt/{user_id}/reassign-speaker", "shortDescription": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/reassign-speaker"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/quilt/{user_id}/reassign-speaker` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eee2dc768436d19", "name": "Unused endpoint: POST /v1/quilt/{user_id}/prewarm", "shortDescription": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/prewarm"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `POST /v1/quilt/{user_id}/prewarm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3c8fa9ccc354c18", "name": "Unused endpoint: GET /v1/quilt/{user_id}/graph", "shortDescription": {"text": "Unused endpoint: GET /v1/quilt/{user_id}/graph"}, "fullDescription": {"text": "`app/routers/cq_proxy.py` declares `GET /v1/quilt/{user_id}/graph` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74b109ada0943b63", "name": "Unused endpoint: POST /v1/events/ping", "shortDescription": {"text": "Unused endpoint: POST /v1/events/ping"}, "fullDescription": {"text": "`app/routers/telemetry.py` declares `POST /v1/events/ping` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b21c5ee6cfd6ec0", "name": "Unused endpoint: POST /webhooks/admin/set-tier", "shortDescription": {"text": "Unused endpoint: POST /webhooks/admin/set-tier"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `POST /webhooks/admin/set-tier` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-532a0708489ac4c4", "name": "Unused endpoint: POST /webhooks/admin/simulate-tier", "shortDescription": {"text": "Unused endpoint: POST /webhooks/admin/simulate-tier"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `POST /webhooks/admin/simulate-tier` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2dddc1c9cbfe8ac7", "name": "Unused endpoint: POST /webhooks/admin/update-feature-state", "shortDescription": {"text": "Unused endpoint: POST /webhooks/admin/update-feature-state"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `POST /webhooks/admin/update-feature-state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c51aa1e71a114ce", "name": "Unused endpoint: POST /webhooks/admin/capture-transcript", "shortDescription": {"text": "Unused endpoint: POST /webhooks/admin/capture-transcript"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `POST /webhooks/admin/capture-transcript` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd74f07ab5e49461", "name": "Unused endpoint: GET /webhooks/admin/live-log", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/live-log"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/live-log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37c30b919864d5e4", "name": "Unused endpoint: GET /webhooks/admin/live-log/{request_id}", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/live-log/{request_id}"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/live-log/{request_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-815ee9659d165e66", "name": "Unused endpoint: GET /webhooks/admin/configs", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/configs"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/configs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-914a2a7dcbb78adc", "name": "Unused endpoint: GET /webhooks/admin/config/{slug}", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/config/{slug}"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/config/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-744874b81c07ecd2", "name": "Unused endpoint: PUT /webhooks/admin/config/{slug}", "shortDescription": {"text": "Unused endpoint: PUT /webhooks/admin/config/{slug}"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `PUT /webhooks/admin/config/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3181c61f7f84ad45", "name": "Unused endpoint: GET /webhooks/admin/config/{slug}/bundle", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/config/{slug}/bundle"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/config/{slug}/bundle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-710d405c4521c59a", "name": "Unused endpoint: POST /webhooks/admin/config/{slug}/sync-from-bundle", "shortDescription": {"text": "Unused endpoint: POST /webhooks/admin/config/{slug}/sync-from-bundle"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `POST /webhooks/admin/config/{slug}/sync-from-bundle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-858e2d845ccf6dc3", "name": "Unused endpoint: PUT /webhooks/admin/tunable/tier-field", "shortDescription": {"text": "Unused endpoint: PUT /webhooks/admin/tunable/tier-field"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `PUT /webhooks/admin/tunable/tier-field` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0cc65962f5461d0", "name": "Unused endpoint: PUT /webhooks/admin/tunable/project-chat-cap", "shortDescription": {"text": "Unused endpoint: PUT /webhooks/admin/tunable/project-chat-cap"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `PUT /webhooks/admin/tunable/project-chat-cap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43d5c19482190740", "name": "Unused endpoint: GET /webhooks/admin/provider-status", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/provider-status"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/provider-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ab92eaaf8323626", "name": "Unused endpoint: POST /webhooks/admin/update-key", "shortDescription": {"text": "Unused endpoint: POST /webhooks/admin/update-key"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `POST /webhooks/admin/update-key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-caf7f7b0e968dd20", "name": "Unused endpoint: GET /webhooks/admin/dashboard", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/dashboard"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0cf070681de9d4f", "name": "Unused endpoint: GET /webhooks/admin/errors", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/errors"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/errors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5423934ac620d60", "name": "Unused endpoint: GET /webhooks/admin/tiers", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/tiers"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/tiers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aac0b4eb590f7d0d", "name": "Unused endpoint: GET /webhooks/admin/user/{user_id}", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/user/{user_id}"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/user/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1308d1788a972e37", "name": "Unused endpoint: GET /webhooks/admin/user/{user_id}/search-usage", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/user/{user_id}/search-usage"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/user/{user_id}/search-usage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-350782745b233436", "name": "Unused endpoint: GET /webhooks/admin/user/{user_id}/queries", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/user/{user_id}/queries"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/user/{user_id}/queries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf508f031cc036e3", "name": "Unused endpoint: GET /webhooks/admin/users", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/users"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-360e4b464a7c2994", "name": "Unused endpoint: GET /webhooks/admin/telemetry/summary", "shortDescription": {"text": "Unused endpoint: GET /webhooks/admin/telemetry/summary"}, "fullDescription": {"text": "`app/routers/webhooks.py` declares `GET /webhooks/admin/telemetry/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19096"}, "properties": {"repository": "scottxxxxx/ghostpour", "repoUrl": "https://github.com/scottxxxxx/ghostpour", "branch": "main"}, "results": [{"ruleId": "scanner-e28caf841a49d3fd", "level": "note", "message": {"text": "Possibly dead Python function: is_feature_enabled"}, "properties": {"repobilityId": "3cbf71746d6263e2", "scanner": "scanner-primary", "fingerprint": "e28caf841a49d3fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/models/tier.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9943b5be6447f75f", "level": "note", "message": {"text": "Possibly dead Python function: is_feature_teaser"}, "properties": {"repobilityId": "a122f3df09ccc246", "scanner": "scanner-primary", "fingerprint": "9943b5be6447f75f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/models/tier.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62e0af762e24e04c", "level": "note", "message": {"text": "Possibly dead Python function: replay_receive"}, "properties": {"repobilityId": "655c9a4af57fec2b", "scanner": "scanner-primary", "fingerprint": "62e0af762e24e04c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/middleware/request_logging.py:105"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3898280eab42e05a", "level": "note", "message": {"text": "Possibly dead Python function: capture_send"}, "properties": {"repobilityId": "00fb7f1591dce866", "scanner": "scanner-primary", "fingerprint": "3898280eab42e05a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/middleware/request_logging.py:117"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "1de0ecd007803dbd", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b32aa2e224c99ec2", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in app/main.py:266"}, "properties": {"repobilityId": "6e34239fa74e6e6b", "scanner": "scanner-primary", "fingerprint": "b32aa2e224c99ec2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/main.py"}, "region": {"startLine": 266}}}]}, {"ruleId": "scanner-2698ffd66e0d6a1a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/static/admin.html:570"}, "properties": {"repobilityId": "50ab5ebafe9d4ff0", "scanner": "scanner-primary", "fingerprint": "2698ffd66e0d6a1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/static/admin.html"}, "region": {"startLine": 570}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "23cd42a74de7bf62", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5ff68ae3a5989fc", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6181b8f8979a30e5", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0bc463708914950e", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-ad6701f0a8405e22", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8384c23520d55657", "scanner": "scanner-primary", "fingerprint": "ad6701f0a8405e22", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3d2bd25b460be76", "level": "note", "message": {"text": "Very large file: app/routers/webhooks.py (2818 lines)"}, "properties": {"repobilityId": "02e8f2a84a2b4902", "scanner": "scanner-primary", "fingerprint": "c3d2bd25b460be76", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d72f0cb9f705e763", "level": "note", "message": {"text": "Very large file: app/routers/chat.py (1794 lines)"}, "properties": {"repobilityId": "4ea80ec11b43cd4d", "scanner": "scanner-primary", "fingerprint": "d72f0cb9f705e763", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6ae800ef53317e94", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "faca745b26f743d9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7e6769ed67ceeab3", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "93cdb6efef5267a5", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d4ee19e34affbdd", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_reasoning_levels_per_model.py:18"}, "properties": {"repobilityId": "0953f92295927e11", "scanner": "scanner-primary", "fingerprint": "9d4ee19e34affbdd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e62b0493c1b13f77", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_model_routing.py:269"}, "properties": {"repobilityId": "4aa6c4431fceae7a", "scanner": "scanner-primary", "fingerprint": "e62b0493c1b13f77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8106af16ed62842a", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_search_caps.py:496"}, "properties": {"repobilityId": "c7403f6464431bef", "scanner": "scanner-primary", "fingerprint": "8106af16ed62842a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c6dcbf31b35b7a1", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/database.py:123"}, "properties": {"repobilityId": "0aa6dc85a22b1418", "scanner": "scanner-primary", "fingerprint": "3c6dcbf31b35b7a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f1f553cb145506bb", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/config.py:51"}, "properties": {"repobilityId": "70eabf60b1868c33", "scanner": "scanner-primary", "fingerprint": "f1f553cb145506bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0369f66ae02b82c4", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/secrets.py:73"}, "properties": {"repobilityId": "e7cc12ec6c7423fa", "scanner": "scanner-primary", "fingerprint": "0369f66ae02b82c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc38db69c7f0a4bb", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/main.py:87"}, "properties": {"repobilityId": "2eba88f9179168cf", "scanner": "scanner-primary", "fingerprint": "cc38db69c7f0a4bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-acf000972b85029f", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/models/tier.py:21"}, "properties": {"repobilityId": "38883387333cb466", "scanner": "scanner-primary", "fingerprint": "acf000972b85029f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-21ec2c9129d37f34", "level": "none", "message": {"text": "Commented-code block (9 lines) in app/models/chat.py:17"}, "properties": {"repobilityId": "830738749d93cf2a", "scanner": "scanner-primary", "fingerprint": "21ec2c9129d37f34", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b2464e9d46a823e8", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/services/prompt_assembly.py:60"}, "properties": {"repobilityId": "d1ccb175ef956987", "scanner": "scanner-primary", "fingerprint": "b2464e9d46a823e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f15d86a6914b6b4f", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/services/transcript_cleanup.py:46"}, "properties": {"repobilityId": "c5b11a189d586223", "scanner": "scanner-primary", "fingerprint": "f15d86a6914b6b4f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-24197af7a94b5ebd", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/services/meeting_report.py:52"}, "properties": {"repobilityId": "a8661b766f25cf31", "scanner": "scanner-primary", "fingerprint": "24197af7a94b5ebd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-005e10dc4ddcf2b1", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/services/provider_health.py:180"}, "properties": {"repobilityId": "68c32ae639cdad33", "scanner": "scanner-primary", "fingerprint": "005e10dc4ddcf2b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-330c956e97466eb0", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/services/app_version.py:97"}, "properties": {"repobilityId": "5777adcd8240171f", "scanner": "scanner-primary", "fingerprint": "330c956e97466eb0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-11fa50c74760028b", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/services/anthropic_or_fallback.py:110"}, "properties": {"repobilityId": "a26710236ac83bc2", "scanner": "scanner-primary", "fingerprint": "11fa50c74760028b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a5484dd3fb106c9", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/services/usage_tracker.py:91"}, "properties": {"repobilityId": "bab6c446c53427ec", "scanner": "scanner-primary", "fingerprint": "7a5484dd3fb106c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3568763ae5673e79", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/services/providers/anthropic.py:50"}, "properties": {"repobilityId": "8de3ea42e7524ba1", "scanner": "scanner-primary", "fingerprint": "3568763ae5673e79", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c050a188b6c665f", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/services/features/context_quilt_hook.py:90"}, "properties": {"repobilityId": "c414a202806368f0", "scanner": "scanner-primary", "fingerprint": "2c050a188b6c665f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2ccf1a829b18ff91", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/services/features/context_quilt_hook.py:66"}, "properties": {"repobilityId": "a3ccb4b8cd042d94", "scanner": "scanner-primary", "fingerprint": "2ccf1a829b18ff91", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-036c08c0da7400fc", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/routers/reports.py:118"}, "properties": {"repobilityId": "73a76f7e12141e26", "scanner": "scanner-primary", "fingerprint": "036c08c0da7400fc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d2ef879c67b35685", "level": "note", "message": {"text": "Legacy-named symbol `health_v1` in app/routers/health.py:42"}, "properties": {"repobilityId": "d326f9d7b4639df3", "scanner": "scanner-primary", "fingerprint": "d2ef879c67b35685", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a9b8c2240e7faa7a", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/routers/health.py:36"}, "properties": {"repobilityId": "8ed6ec8a40049579", "scanner": "scanner-primary", "fingerprint": "a9b8c2240e7faa7a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5ca1f1f02b2b9985", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/routers/cq_proxy.py:193"}, "properties": {"repobilityId": "d28ef3b342a455bf", "scanner": "scanner-primary", "fingerprint": "5ca1f1f02b2b9985", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5ea862e7eeee79e", "level": "note", "message": {"text": "Legacy-named symbol `pc_legacy` in app/routers/webhooks.py:793"}, "properties": {"repobilityId": "3f0ed1fb168da6da", "scanner": "scanner-primary", "fingerprint": "a5ea862e7eeee79e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1a49f1f5efe86d6c", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/routers/webhooks.py:1874"}, "properties": {"repobilityId": "cfb30e35a4f91642", "scanner": "scanner-primary", "fingerprint": "1a49f1f5efe86d6c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78815e84eddc3c75", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/routers/chat.py:976"}, "properties": {"repobilityId": "b030f017df89821a", "scanner": "scanner-primary", "fingerprint": "78815e84eddc3c75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e529717a0ee99d27", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/routers/chat.py:9"}, "properties": {"repobilityId": "ff18b9ba8ed93e5c", "scanner": "scanner-primary", "fingerprint": "e529717a0ee99d27", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-920a0e47e85d42b8", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/routers/unsubscribe.py:101"}, "properties": {"repobilityId": "688cdb08d01782e3", "scanner": "scanner-primary", "fingerprint": "920a0e47e85d42b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a5a25d8a933d87ab", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "76109e6bedf76c15", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "43278bbab23104a0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4f5bc9a4f8f14f15", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "01008ca89b86af05", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "417766df46973b93", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c6e92c08b736e38f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2d048cfa2c233972", "level": "error", "message": {"text": "FastAPI POST `apple_auth` without auth dependency \u2014 app/routers/auth.py:46"}, "properties": {"repobilityId": "f6853812052387e8", "scanner": "scanner-primary", "fingerprint": "2d048cfa2c233972", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/auth.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-d1aa68f808365b86", "level": "error", "message": {"text": "FastAPI POST `refresh_token` without auth dependency \u2014 app/routers/auth.py:108"}, "properties": {"repobilityId": "9b9507826432a226", "scanner": "scanner-primary", "fingerprint": "d1aa68f808365b86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/auth.py"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-793ac742de93ab90", "level": "error", "message": {"text": "FastAPI POST `receive_resend_webhook` without auth dependency \u2014 app/routers/resend_webhooks.py:102"}, "properties": {"repobilityId": "f9746ffbf75c300f", "scanner": "scanner-primary", "fingerprint": "793ac742de93ab90", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/resend_webhooks.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-5407014a76a6b7d6", "level": "error", "message": {"text": "FastAPI POST `set_tier` without auth dependency \u2014 app/routers/webhooks.py:49"}, "properties": {"repobilityId": "88fbd3c77289a54e", "scanner": "scanner-primary", "fingerprint": "5407014a76a6b7d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-8788a1c0a6faf463", "level": "error", "message": {"text": "FastAPI POST `simulate_tier` without auth dependency \u2014 app/routers/webhooks.py:119"}, "properties": {"repobilityId": "919ba5acbc27446b", "scanner": "scanner-primary", "fingerprint": "8788a1c0a6faf463", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-9de7e81b1a19fa43", "level": "error", "message": {"text": "FastAPI POST `update_feature_state` without auth dependency \u2014 app/routers/webhooks.py:187"}, "properties": {"repobilityId": "d0a7b338b61d0cf5", "scanner": "scanner-primary", "fingerprint": "9de7e81b1a19fa43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-6c95cd78f78b92bb", "level": "error", "message": {"text": "FastAPI POST `admin_capture_transcript` without auth dependency \u2014 app/routers/webhooks.py:240"}, "properties": {"repobilityId": "b1c51077bc4e9490", "scanner": "scanner-primary", "fingerprint": "6c95cd78f78b92bb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-917a3060ae7c461d", "level": "error", "message": {"text": "FastAPI PUT `update_config` without auth dependency \u2014 app/routers/webhooks.py:392"}, "properties": {"repobilityId": "112620069b4eade7", "scanner": "scanner-primary", "fingerprint": "917a3060ae7c461d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 392}}}]}, {"ruleId": "scanner-025325f29b44ad09", "level": "error", "message": {"text": "FastAPI POST `sync_config_from_bundle` without auth dependency \u2014 app/routers/webhooks.py:522"}, "properties": {"repobilityId": "d6ccabfe6bae82a6", "scanner": "scanner-primary", "fingerprint": "025325f29b44ad09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 522}}}]}, {"ruleId": "scanner-041ca0ca02c8391d", "level": "error", "message": {"text": "FastAPI PUT `update_tier_tunable_field` without auth dependency \u2014 app/routers/webhooks.py:647"}, "properties": {"repobilityId": "9622f2f680ecb719", "scanner": "scanner-primary", "fingerprint": "041ca0ca02c8391d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 647}}}]}, {"ruleId": "scanner-97766812526de795", "level": "error", "message": {"text": "FastAPI PUT `update_project_chat_cap` without auth dependency \u2014 app/routers/webhooks.py:712"}, "properties": {"repobilityId": "55f39171090f2621", "scanner": "scanner-primary", "fingerprint": "97766812526de795", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 712}}}]}, {"ruleId": "scanner-2ea9bd5f174223a6", "level": "error", "message": {"text": "FastAPI POST `update_key` without auth dependency \u2014 app/routers/webhooks.py:955"}, "properties": {"repobilityId": "49ea05494d20426f", "scanner": "scanner-primary", "fingerprint": "2ea9bd5f174223a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 955}}}]}, {"ruleId": "scanner-32cf5e0882c549e5", "level": "error", "message": {"text": "FastAPI POST `create_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2531"}, "properties": {"repobilityId": "f8d205727aaabcb3", "scanner": "scanner-primary", "fingerprint": "32cf5e0882c549e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 2531}}}]}, {"ruleId": "scanner-3856de16954c1047", "level": "error", "message": {"text": "FastAPI PATCH `update_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2578"}, "properties": {"repobilityId": "d109576c1e7c1f3d", "scanner": "scanner-primary", "fingerprint": "3856de16954c1047", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 2578}}}]}, {"ruleId": "scanner-ca65152785b46bba", "level": "error", "message": {"text": "FastAPI DELETE `delete_alert_recipient` without auth dependency \u2014 app/routers/webhooks.py:2640"}, "properties": {"repobilityId": "82717fb2631646c4", "scanner": "scanner-primary", "fingerprint": "ca65152785b46bba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 2640}}}]}, {"ruleId": "scanner-9429d02ad88a7b63", "level": "error", "message": {"text": "FastAPI POST `test_send_alert` without auth dependency \u2014 app/routers/webhooks.py:2672"}, "properties": {"repobilityId": "06fd7ffe2f5d243e", "scanner": "scanner-primary", "fingerprint": "9429d02ad88a7b63", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 2672}}}]}, {"ruleId": "scanner-cdec023ca676f8f6", "level": "error", "message": {"text": "FastAPI POST `admin_cert_pins_publish` without auth dependency \u2014 app/routers/webhooks.py:2793"}, "properties": {"repobilityId": "ffdb5b96bd0e515d", "scanner": "scanner-primary", "fingerprint": "cdec023ca676f8f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/webhooks.py"}, "region": {"startLine": 2793}}}]}, {"ruleId": "scanner-c0522777fcf86de7", "level": "error", "message": {"text": "FastAPI POST `apple_notifications` without auth dependency \u2014 app/routers/apple_webhooks.py:165"}, "properties": {"repobilityId": "d82dd1c461fa8b8e", "scanner": "scanner-primary", "fingerprint": "c0522777fcf86de7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/routers/apple_webhooks.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-bc45e912f78e4ea9", "level": "note", "message": {"text": "Unused endpoint: POST /v1/meetings/{meeting_id}/report"}, "properties": {"repobilityId": "21f7fa903164a28c", "scanner": "scanner-primary", "fingerprint": "bc45e912f78e4ea9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74db1fc8575adda4", "level": "note", "message": {"text": "Unused endpoint: GET /v1/meetings/{meeting_id}/report"}, "properties": {"repobilityId": "39b48ed745714aeb", "scanner": "scanner-primary", "fingerprint": "74db1fc8575adda4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aa00d48c21916836", "level": "note", "message": {"text": "Unused endpoint: POST /v1/reports/render"}, "properties": {"repobilityId": "a5b252f0eca52c56", "scanner": "scanner-primary", "fingerprint": "aa00d48c21916836", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f2b93272c0cdd105", "level": "note", "message": {"text": "Unused endpoint: GET /v1/health"}, "properties": {"repobilityId": "ee0b4e665ac9337e", "scanner": "scanner-primary", "fingerprint": "f2b93272c0cdd105", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-953ec1a0ee6df50d", "level": "note", "message": {"text": "Unused endpoint: GET /admin"}, "properties": {"repobilityId": "037e18e48ebf98c1", "scanner": "scanner-primary", "fingerprint": "953ec1a0ee6df50d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-df25963ad47b2ec1", "level": "note", "message": {"text": "Unused endpoint: GET /v1/model-pricing"}, "properties": {"repobilityId": "a5e3210b4dca6458", "scanner": "scanner-primary", "fingerprint": "df25963ad47b2ec1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85f7aa084970e502", "level": "note", "message": {"text": "Unused endpoint: GET /v1/config/cert-pins"}, "properties": {"repobilityId": "c2ca89208d30b6d6", "scanner": "scanner-primary", "fingerprint": "85f7aa084970e502", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b92e389696862af3", "level": "note", "message": {"text": "Unused endpoint: GET /v1/config/{name}"}, "properties": {"repobilityId": "a58fee428b14c081", "scanner": "scanner-primary", "fingerprint": "b92e389696862af3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a05bcd347c31b110", "level": "note", "message": {"text": "Unused endpoint: POST /auth/apple"}, "properties": {"repobilityId": "02b271d27ad25378", "scanner": "scanner-primary", "fingerprint": "a05bcd347c31b110", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b36892106ecdc9aa", "level": "note", "message": {"text": "Unused endpoint: POST /auth/refresh"}, "properties": {"repobilityId": "8f2b5f724f56ccfd", "scanner": "scanner-primary", "fingerprint": "b36892106ecdc9aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85258d174dd43b8c", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/resend"}, "properties": {"repobilityId": "c0faa6dad0be209a", "scanner": "scanner-primary", "fingerprint": "85258d174dd43b8c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-221e163b0a8895d4", "level": "note", "message": {"text": "Unused endpoint: POST /v1/capture-transcript"}, "properties": {"repobilityId": "dc50d3c48f4b44c4", "scanner": "scanner-primary", "fingerprint": "221e163b0a8895d4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7e2830390e2654a", "level": "note", "message": {"text": "Unused endpoint: GET /v1/quilt/{user_id}"}, "properties": {"repobilityId": "949c81c4733649e0", "scanner": "scanner-primary", "fingerprint": "d7e2830390e2654a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9592f2a562a09a1b", "level": "note", "message": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/patches"}, "properties": {"repobilityId": "553498558a76a032", "scanner": "scanner-primary", "fingerprint": "9592f2a562a09a1b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3483220caa4f921e", "level": "note", "message": {"text": "Unused endpoint: PATCH /v1/quilt/{user_id}/patches/{patch_id}"}, "properties": {"repobilityId": "81e7c2dbb691409b", "scanner": "scanner-primary", "fingerprint": "3483220caa4f921e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-057460aea215adde", "level": "note", "message": {"text": "Unused endpoint: DELETE /v1/quilt/{user_id}/patches/{patch_id}"}, "properties": {"repobilityId": "114e2ea77507edf9", "scanner": "scanner-primary", "fingerprint": "057460aea215adde", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c273e9ba8bada49a", "level": "note", "message": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/patches/{patch_id}/complete"}, "properties": {"repobilityId": "df1b41286b17eda0", "scanner": "scanner-primary", "fingerprint": "c273e9ba8bada49a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-df774ddd874db66b", "level": "note", "message": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/connections"}, "properties": {"repobilityId": "6d39e1e1cca1a056", "scanner": "scanner-primary", "fingerprint": "df774ddd874db66b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db3bf8bd679ac390", "level": "note", "message": {"text": "Unused endpoint: DELETE /v1/quilt/{user_id}/connections"}, "properties": {"repobilityId": "1570bf65aa78fb0c", "scanner": "scanner-primary", "fingerprint": "db3bf8bd679ac390", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-15bba83c8cdc1141", "level": "note", "message": {"text": "Unused endpoint: POST /v1/origins/{user_id}/{origin_type}/{origin_id}/assign-project"}, "properties": {"repobilityId": "7c267704d6ded9ed", "scanner": "scanner-primary", "fingerprint": "15bba83c8cdc1141", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cea02a7d26a3d301", "level": "note", "message": {"text": "Unused endpoint: POST /v1/meetings/{user_id}/{meeting_id}/assign-project"}, "properties": {"repobilityId": "077876ab399e7ac2", "scanner": "scanner-primary", "fingerprint": "cea02a7d26a3d301", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-48842a8b0cba21c9", "level": "note", "message": {"text": "Unused endpoint: GET /v1/schema"}, "properties": {"repobilityId": "9f4e409979bffab2", "scanner": "scanner-primary", "fingerprint": "48842a8b0cba21c9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6259aad39cc9fbde", "level": "note", "message": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/rename-speaker"}, "properties": {"repobilityId": "56754b36392a5057", "scanner": "scanner-primary", "fingerprint": "6259aad39cc9fbde", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86782712d4feac11", "level": "note", "message": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/reassign-speaker"}, "properties": {"repobilityId": "bef621ec68d46fea", "scanner": "scanner-primary", "fingerprint": "86782712d4feac11", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eee2dc768436d19", "level": "note", "message": {"text": "Unused endpoint: POST /v1/quilt/{user_id}/prewarm"}, "properties": {"repobilityId": "99dee30496a0da70", "scanner": "scanner-primary", "fingerprint": "6eee2dc768436d19", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e3c8fa9ccc354c18", "level": "note", "message": {"text": "Unused endpoint: GET /v1/quilt/{user_id}/graph"}, "properties": {"repobilityId": "0ff5f43a723ad5a8", "scanner": "scanner-primary", "fingerprint": "e3c8fa9ccc354c18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74b109ada0943b63", "level": "note", "message": {"text": "Unused endpoint: POST /v1/events/ping"}, "properties": {"repobilityId": "4d4423768bd93c08", "scanner": "scanner-primary", "fingerprint": "74b109ada0943b63", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b21c5ee6cfd6ec0", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/admin/set-tier"}, "properties": {"repobilityId": "6ea305e912a93bf6", "scanner": "scanner-primary", "fingerprint": "5b21c5ee6cfd6ec0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-532a0708489ac4c4", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/admin/simulate-tier"}, "properties": {"repobilityId": "074816d648d3b75e", "scanner": "scanner-primary", "fingerprint": "532a0708489ac4c4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2dddc1c9cbfe8ac7", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/admin/update-feature-state"}, "properties": {"repobilityId": "8ebd54bd404f5343", "scanner": "scanner-primary", "fingerprint": "2dddc1c9cbfe8ac7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c51aa1e71a114ce", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/admin/capture-transcript"}, "properties": {"repobilityId": "31c0cd25cd11eb50", "scanner": "scanner-primary", "fingerprint": "9c51aa1e71a114ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd74f07ab5e49461", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/live-log"}, "properties": {"repobilityId": "253d9dfad21aeb9f", "scanner": "scanner-primary", "fingerprint": "bd74f07ab5e49461", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-37c30b919864d5e4", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/live-log/{request_id}"}, "properties": {"repobilityId": "1bb98f0a5db49bd3", "scanner": "scanner-primary", "fingerprint": "37c30b919864d5e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-815ee9659d165e66", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/configs"}, "properties": {"repobilityId": "d129351b32efab02", "scanner": "scanner-primary", "fingerprint": "815ee9659d165e66", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-914a2a7dcbb78adc", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/config/{slug}"}, "properties": {"repobilityId": "4418fdefbb790e52", "scanner": "scanner-primary", "fingerprint": "914a2a7dcbb78adc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-744874b81c07ecd2", "level": "note", "message": {"text": "Unused endpoint: PUT /webhooks/admin/config/{slug}"}, "properties": {"repobilityId": "4679e0497e3fecd8", "scanner": "scanner-primary", "fingerprint": "744874b81c07ecd2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3181c61f7f84ad45", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/config/{slug}/bundle"}, "properties": {"repobilityId": "b313bba5a9637d03", "scanner": "scanner-primary", "fingerprint": "3181c61f7f84ad45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-710d405c4521c59a", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/admin/config/{slug}/sync-from-bundle"}, "properties": {"repobilityId": "6d72dd9cb1506e6f", "scanner": "scanner-primary", "fingerprint": "710d405c4521c59a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-858e2d845ccf6dc3", "level": "note", "message": {"text": "Unused endpoint: PUT /webhooks/admin/tunable/tier-field"}, "properties": {"repobilityId": "41d24df5c817211b", "scanner": "scanner-primary", "fingerprint": "858e2d845ccf6dc3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b0cc65962f5461d0", "level": "note", "message": {"text": "Unused endpoint: PUT /webhooks/admin/tunable/project-chat-cap"}, "properties": {"repobilityId": "01dd450e28ca42e5", "scanner": "scanner-primary", "fingerprint": "b0cc65962f5461d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43d5c19482190740", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/provider-status"}, "properties": {"repobilityId": "59d2d2096e409127", "scanner": "scanner-primary", "fingerprint": "43d5c19482190740", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ab92eaaf8323626", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/admin/update-key"}, "properties": {"repobilityId": "6e24e69aa80f72cf", "scanner": "scanner-primary", "fingerprint": "8ab92eaaf8323626", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-caf7f7b0e968dd20", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/dashboard"}, "properties": {"repobilityId": "86fd14f04bbc71fc", "scanner": "scanner-primary", "fingerprint": "caf7f7b0e968dd20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f0cf070681de9d4f", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/errors"}, "properties": {"repobilityId": "86b3e40145c4786d", "scanner": "scanner-primary", "fingerprint": "f0cf070681de9d4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5423934ac620d60", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/tiers"}, "properties": {"repobilityId": "9cdb1266c4247eac", "scanner": "scanner-primary", "fingerprint": "b5423934ac620d60", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aac0b4eb590f7d0d", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/user/{user_id}"}, "properties": {"repobilityId": "24686d5f6e20bce4", "scanner": "scanner-primary", "fingerprint": "aac0b4eb590f7d0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1308d1788a972e37", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/user/{user_id}/search-usage"}, "properties": {"repobilityId": "ea5d4dfc190dff48", "scanner": "scanner-primary", "fingerprint": "1308d1788a972e37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-350782745b233436", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/user/{user_id}/queries"}, "properties": {"repobilityId": "0804b5a90bde95a0", "scanner": "scanner-primary", "fingerprint": "350782745b233436", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf508f031cc036e3", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/users"}, "properties": {"repobilityId": "b62ca87eeca80b8d", "scanner": "scanner-primary", "fingerprint": "cf508f031cc036e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-360e4b464a7c2994", "level": "note", "message": {"text": "Unused endpoint: GET /webhooks/admin/telemetry/summary"}, "properties": {"repobilityId": "f668ecc8486f3473", "scanner": "scanner-primary", "fingerprint": "360e4b464a7c2994", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}