{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-36baca191449f991", "name": "Possibly dead Python function: suggest_glossary", "shortDescription": {"text": "Possibly dead Python function: suggest_glossary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-166dff3c3df6a10e", "name": "ORM models found but no DB engine detected", "shortDescription": {"text": "ORM models found but no DB engine detected"}, "fullDescription": {"text": "The repo defines tables/models but no DB connection string was found. Likely lives in env vars or a config file the scanner didn't read."}, "properties": {"scanner": "scanner-primary", "layer": "data", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 5 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DB_PATH`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/main.py:login_page, backend/main.py:login\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e14a38a3ac07931", "name": "FastAPI POST `save_settings_post` without auth dependency \u2014 backend/main.py:107", "shortDescription": {"text": "FastAPI POST `save_settings_post` without auth dependency \u2014 backend/main.py:107"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b86a57835e016b6d", "name": "FastAPI POST `submit` without auth dependency \u2014 backend/main.py:207", "shortDescription": {"text": "FastAPI POST `submit` without auth dependency \u2014 backend/main.py:207"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84d4433e40e88771", "name": "FastAPI POST `jobs_delete` without auth dependency \u2014 backend/main.py:231", "shortDescription": {"text": "FastAPI POST `jobs_delete` without auth dependency \u2014 backend/main.py:231"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12d850298f2cbed4", "name": "FastAPI POST `drafts_delete` without auth dependency \u2014 backend/main.py:243", "shortDescription": {"text": "FastAPI POST `drafts_delete` without auth dependency \u2014 backend/main.py:243"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-978db0fe6d3a2ba0", "name": "FastAPI POST `organize_scan` without auth dependency \u2014 backend/main.py:323", "shortDescription": {"text": "FastAPI POST `organize_scan` without auth dependency \u2014 backend/main.py:323"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f557e7f4737ee5b3", "name": "FastAPI POST `organize_stop` without auth dependency \u2014 backend/main.py:357", "shortDescription": {"text": "FastAPI POST `organize_stop` without auth dependency \u2014 backend/main.py:357"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21d0b27cc675445e", "name": "FastAPI POST `organize_apply` without auth dependency \u2014 backend/main.py:376", "shortDescription": {"text": "FastAPI POST `organize_apply` without auth dependency \u2014 backend/main.py:376"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e733dce9fcdc6223", "name": "FastAPI POST `organize_skip` without auth dependency \u2014 backend/main.py:445", "shortDescription": {"text": "FastAPI POST `organize_skip` without auth dependency \u2014 backend/main.py:445"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-40b9b0a8985e1219", "name": "FastAPI POST `models` without auth dependency \u2014 backend/main.py:452", "shortDescription": {"text": "FastAPI POST `models` without auth dependency \u2014 backend/main.py:452"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a4dfcad3eb1618a", "name": "Unused endpoint: GET /login", "shortDescription": {"text": "Unused endpoint: GET /login"}, "fullDescription": {"text": "`backend/main.py` declares `GET /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`backend/main.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-512ccb0fd0b230ba", "name": "Unused endpoint: GET /settings", "shortDescription": {"text": "Unused endpoint: GET /settings"}, "fullDescription": {"text": "`backend/main.py` declares `GET /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9fbbfd361e91f1e", "name": "Unused endpoint: POST /settings", "shortDescription": {"text": "Unused endpoint: POST /settings"}, "fullDescription": {"text": "`backend/main.py` declares `POST /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963710f42a2c8219", "name": "Unused endpoint: GET /api/status", "shortDescription": {"text": "Unused endpoint: GET /api/status"}, "fullDescription": {"text": "`backend/main.py` declares `GET /api/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acc108ad5ad67749", "name": "Unused endpoint: POST /api/submit", "shortDescription": {"text": "Unused endpoint: POST /api/submit"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31fb330b2ba4ab69", "name": "Unused endpoint: GET /api/jobs", "shortDescription": {"text": "Unused endpoint: GET /api/jobs"}, "fullDescription": {"text": "`backend/main.py` declares `GET /api/jobs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-369dd4bcbd0ca78d", "name": "Unused endpoint: POST /api/jobs/delete", "shortDescription": {"text": "Unused endpoint: POST /api/jobs/delete"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/jobs/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e968eeaf3ebc286", "name": "Unused endpoint: GET /api/drafts", "shortDescription": {"text": "Unused endpoint: GET /api/drafts"}, "fullDescription": {"text": "`backend/main.py` declares `GET /api/drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71e229edd086d4db", "name": "Unused endpoint: POST /api/drafts/delete", "shortDescription": {"text": "Unused endpoint: POST /api/drafts/delete"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/drafts/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5838a1cb0711dafb", "name": "Unused endpoint: GET /organize", "shortDescription": {"text": "Unused endpoint: GET /organize"}, "fullDescription": {"text": "`backend/main.py` declares `GET /organize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2f6fd423eb62fb5", "name": "Unused endpoint: POST /api/organize/scan", "shortDescription": {"text": "Unused endpoint: POST /api/organize/scan"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/organize/scan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db9a9f50b40787be", "name": "Unused endpoint: POST /api/organize/stop", "shortDescription": {"text": "Unused endpoint: POST /api/organize/stop"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/organize/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e031c010289ef535", "name": "Unused endpoint: GET /api/organize/list", "shortDescription": {"text": "Unused endpoint: GET /api/organize/list"}, "fullDescription": {"text": "`backend/main.py` declares `GET /api/organize/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcd67f767d5fb666", "name": "Unused endpoint: POST /api/organize/apply", "shortDescription": {"text": "Unused endpoint: POST /api/organize/apply"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/organize/apply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38fca3bcd86cf753", "name": "Unused endpoint: POST /api/organize/skip", "shortDescription": {"text": "Unused endpoint: POST /api/organize/skip"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/organize/skip` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7966de64258707cf", "name": "Unused endpoint: POST /api/models", "shortDescription": {"text": "Unused endpoint: POST /api/models"}, "fullDescription": {"text": "`backend/main.py` declares `POST /api/models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22062"}, "properties": {"repository": "VaneEcho/murmur", "repoUrl": "https://github.com/VaneEcho/murmur", "branch": "main"}, "results": [{"ruleId": "scanner-36baca191449f991", "level": "note", "message": {"text": "Possibly dead Python function: suggest_glossary"}, "properties": {"repobilityId": "bf33c0e2efc8d19d", "scanner": "scanner-primary", "fingerprint": "36baca191449f991", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/llm.py:221"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-166dff3c3df6a10e", "level": "warning", "message": {"text": "ORM models found but no DB engine detected"}, "properties": {"repobilityId": "cda36de65e114635", "scanner": "scanner-primary", "fingerprint": "166dff3c3df6a10e", "layer": "data", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "1de0ecd007803dbd", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ab26482e417e1782", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "210f2cc9788c6693", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b7ef3b09c1346a42", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b303380f06fa6de4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-9e14a38a3ac07931", "level": "error", "message": {"text": "FastAPI POST `save_settings_post` without auth dependency \u2014 backend/main.py:107"}, "properties": {"repobilityId": "0a8b79be9321378c", "scanner": "scanner-primary", "fingerprint": "9e14a38a3ac07931", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-b86a57835e016b6d", "level": "error", "message": {"text": "FastAPI POST `submit` without auth dependency \u2014 backend/main.py:207"}, "properties": {"repobilityId": "99db446db6827da2", "scanner": "scanner-primary", "fingerprint": "b86a57835e016b6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-84d4433e40e88771", "level": "error", "message": {"text": "FastAPI POST `jobs_delete` without auth dependency \u2014 backend/main.py:231"}, "properties": {"repobilityId": "ec59b699070e38da", "scanner": "scanner-primary", "fingerprint": "84d4433e40e88771", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-12d850298f2cbed4", "level": "error", "message": {"text": "FastAPI POST `drafts_delete` without auth dependency \u2014 backend/main.py:243"}, "properties": {"repobilityId": "9643270d9507d462", "scanner": "scanner-primary", "fingerprint": "12d850298f2cbed4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-978db0fe6d3a2ba0", "level": "error", "message": {"text": "FastAPI POST `organize_scan` without auth dependency \u2014 backend/main.py:323"}, "properties": {"repobilityId": "911a7ad3f7d17ba8", "scanner": "scanner-primary", "fingerprint": "978db0fe6d3a2ba0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 323}}}]}, {"ruleId": "scanner-f557e7f4737ee5b3", "level": "error", "message": {"text": "FastAPI POST `organize_stop` without auth dependency \u2014 backend/main.py:357"}, "properties": {"repobilityId": "84ac21f923d9bfc5", "scanner": "scanner-primary", "fingerprint": "f557e7f4737ee5b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-21d0b27cc675445e", "level": "error", "message": {"text": "FastAPI POST `organize_apply` without auth dependency \u2014 backend/main.py:376"}, "properties": {"repobilityId": "a41d7603bf172d4c", "scanner": "scanner-primary", "fingerprint": "21d0b27cc675445e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-e733dce9fcdc6223", "level": "error", "message": {"text": "FastAPI POST `organize_skip` without auth dependency \u2014 backend/main.py:445"}, "properties": {"repobilityId": "4fc76d1bcbcc946c", "scanner": "scanner-primary", "fingerprint": "e733dce9fcdc6223", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 445}}}]}, {"ruleId": "scanner-40b9b0a8985e1219", "level": "error", "message": {"text": "FastAPI POST `models` without auth dependency \u2014 backend/main.py:452"}, "properties": {"repobilityId": "dd31b097f7e4c261", "scanner": "scanner-primary", "fingerprint": "40b9b0a8985e1219", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/main.py"}, "region": {"startLine": 452}}}]}, {"ruleId": "scanner-6a4dfcad3eb1618a", "level": "note", "message": {"text": "Unused endpoint: GET /login"}, "properties": {"repobilityId": "7472b92f3c7fd7fb", "scanner": "scanner-primary", "fingerprint": "6a4dfcad3eb1618a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "fc879ac9569e1ca1", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9266ee3970fba636", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-512ccb0fd0b230ba", "level": "note", "message": {"text": "Unused endpoint: GET /settings"}, "properties": {"repobilityId": "f94cb572634d3ea1", "scanner": "scanner-primary", "fingerprint": "512ccb0fd0b230ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d9fbbfd361e91f1e", "level": "note", "message": {"text": "Unused endpoint: POST /settings"}, "properties": {"repobilityId": "ec8008906a914301", "scanner": "scanner-primary", "fingerprint": "d9fbbfd361e91f1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-963710f42a2c8219", "level": "note", "message": {"text": "Unused endpoint: GET /api/status"}, "properties": {"repobilityId": "01931f6a9721e0b9", "scanner": "scanner-primary", "fingerprint": "963710f42a2c8219", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-acc108ad5ad67749", "level": "note", "message": {"text": "Unused endpoint: POST /api/submit"}, "properties": {"repobilityId": "384480648ddaa82f", "scanner": "scanner-primary", "fingerprint": "acc108ad5ad67749", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-31fb330b2ba4ab69", "level": "note", "message": {"text": "Unused endpoint: GET /api/jobs"}, "properties": {"repobilityId": "d7c671ce41949733", "scanner": "scanner-primary", "fingerprint": "31fb330b2ba4ab69", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-369dd4bcbd0ca78d", "level": "note", "message": {"text": "Unused endpoint: POST /api/jobs/delete"}, "properties": {"repobilityId": "e4b0a673d2fc6708", "scanner": "scanner-primary", "fingerprint": "369dd4bcbd0ca78d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e968eeaf3ebc286", "level": "note", "message": {"text": "Unused endpoint: GET /api/drafts"}, "properties": {"repobilityId": "763cc3abc5762218", "scanner": "scanner-primary", "fingerprint": "5e968eeaf3ebc286", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71e229edd086d4db", "level": "note", "message": {"text": "Unused endpoint: POST /api/drafts/delete"}, "properties": {"repobilityId": "1d948cdafece4a86", "scanner": "scanner-primary", "fingerprint": "71e229edd086d4db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5838a1cb0711dafb", "level": "note", "message": {"text": "Unused endpoint: GET /organize"}, "properties": {"repobilityId": "67dfc04079bb365f", "scanner": "scanner-primary", "fingerprint": "5838a1cb0711dafb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a2f6fd423eb62fb5", "level": "note", "message": {"text": "Unused endpoint: POST /api/organize/scan"}, "properties": {"repobilityId": "8c8f9f0940b30338", "scanner": "scanner-primary", "fingerprint": "a2f6fd423eb62fb5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db9a9f50b40787be", "level": "note", "message": {"text": "Unused endpoint: POST /api/organize/stop"}, "properties": {"repobilityId": "d7a1b9881a4e7385", "scanner": "scanner-primary", "fingerprint": "db9a9f50b40787be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e031c010289ef535", "level": "note", "message": {"text": "Unused endpoint: GET /api/organize/list"}, "properties": {"repobilityId": "5f9b5084f3744693", "scanner": "scanner-primary", "fingerprint": "e031c010289ef535", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fcd67f767d5fb666", "level": "note", "message": {"text": "Unused endpoint: POST /api/organize/apply"}, "properties": {"repobilityId": "19670ea9abd8ac0a", "scanner": "scanner-primary", "fingerprint": "fcd67f767d5fb666", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-38fca3bcd86cf753", "level": "note", "message": {"text": "Unused endpoint: POST /api/organize/skip"}, "properties": {"repobilityId": "64c4e74f30d4be9a", "scanner": "scanner-primary", "fingerprint": "38fca3bcd86cf753", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7966de64258707cf", "level": "note", "message": {"text": "Unused endpoint: POST /api/models"}, "properties": {"repobilityId": "610aceeebd5b20f7", "scanner": "scanner-primary", "fingerprint": "7966de64258707cf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}