{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7f2bfe2040b0ef73", "name": "Stray `console.log` in TS/JS \u2014 packages/api/src/seed.ts:257", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/api/src/seed.ts:257"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30cb1a31de9d1386", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/index.ts:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/index.ts:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2bca1e86e314295", "name": "Insecure pattern 'cors_wildcard' in packages/api/src/server.ts:872", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/api/src/server.ts:872"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83b8136ed2abb813", "name": "Insecure pattern 'cors_wildcard' in packages/api/src/mcp.ts:502", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/api/src/mcp.ts:502"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7e0c9f4c85ebedc", "name": "Possible secret in packages/api/src/seed.ts", "shortDescription": {"text": "Possible secret in packages/api/src/seed.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-07bedc65bc228cb6", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/web/src/markdown.tsx:49", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/web/src/markdown.tsx:49"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/build-push-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6fa5808b2dbfca4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/build-push-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7f250962c63268e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0e91623bfbc4308", "name": "Very large file: packages/api/src/store.ts (3085 lines)", "shortDescription": {"text": "Very large file: packages/api/src/store.ts (3085 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a66e069165c7c45", "name": "Very large file: api/src/mcp.rs (1374 lines)", "shortDescription": {"text": "Very large file: api/src/mcp.rs (1374 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 88 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee6f99f4b0870116", "name": "Node manifest has dependencies but no lockfile: packages/worker/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/worker/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a0634ffe3eb1107", "name": "Node manifest has dependencies but no lockfile: packages/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a28850983a0b02d5", "name": "Node manifest has dependencies but no lockfile: packages/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 19 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 13 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fd54b8aaf8f6335", "name": "Legacy-named symbol `importLegacy` in packages/api/src/server.ts:39", "shortDescription": {"text": "Legacy-named symbol `importLegacy` in packages/api/src/server.ts:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88eaec226959cc33", "name": "Commented-code block (10 lines) in packages/api/src/server.ts:739", "shortDescription": {"text": "Commented-code block (10 lines) in packages/api/src/server.ts:739"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c6140983b8d207a1", "name": "Legacy-named symbol `importLegacy` in packages/api/src/store.ts:780", "shortDescription": {"text": "Legacy-named symbol `importLegacy` in packages/api/src/store.ts:780"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea914580e9b498f2", "name": "Commented-code block (5 lines) in packages/api/src/store.ts:994", "shortDescription": {"text": "Commented-code block (5 lines) in packages/api/src/store.ts:994"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-91a8f42058d4bd20", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api/src/store.ts:2434", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api/src/store.ts:2434"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-351731af00739006", "name": "Commented-code block (5 lines) in packages/api/src/mcp.ts:111", "shortDescription": {"text": "Commented-code block (5 lines) in packages/api/src/mcp.ts:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-477366e0dde5205e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api/src/oidc.ts:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api/src/oidc.ts:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec0d6b0ea2a913c4", "name": "Commented-code block (5 lines) in packages/api/src/scrape.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in packages/api/src/scrape.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ab401b09ebe8d1b", "name": "Commented-code block (11 lines) in packages/api/src/embed.ts:6", "shortDescription": {"text": "Commented-code block (11 lines) in packages/api/src/embed.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90a2144d05bc8cb2", "name": "Commented-code block (6 lines) in packages/api/src/seed.ts:263", "shortDescription": {"text": "Commented-code block (6 lines) in packages/api/src/seed.ts:263"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-245583b870adfa4b", "name": "Commented-code block (5 lines) in packages/api/src/db.ts:412", "shortDescription": {"text": "Commented-code block (5 lines) in packages/api/src/db.ts:412"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5a1026cbd820b64", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/index.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/index.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9ba30e0d41eac0e", "name": "Commented-code block (11 lines) in packages/web/src/Journal.tsx:3", "shortDescription": {"text": "Commented-code block (11 lines) in packages/web/src/Journal.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c3242d9fb9caf58f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/web/src/api.ts:188", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/web/src/api.ts:188"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-632d510fd63c1898", "name": "Commented-code block (5 lines) in packages/web/src/App.tsx:140", "shortDescription": {"text": "Commented-code block (5 lines) in packages/web/src/App.tsx:140"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40b5caefa06e6512", "name": "Dangling fetch: GET /api${path} (packages/web/src/api.ts:71)", "shortDescription": {"text": "Dangling fetch: GET /api${path} (packages/web/src/api.ts:71)"}, "fullDescription": {"text": "`packages/web/src/api.ts:71` calls `GET /api${path}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/api/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-76d4f8cfb9c4f6e7", "name": "Unused endpoint: GET /api/healthz", "shortDescription": {"text": "Unused endpoint: GET /api/healthz"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/healthz` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a0b17f3b9d6a1a4", "name": "Unused endpoint: GET /api/onboarding/status", "shortDescription": {"text": "Unused endpoint: GET /api/onboarding/status"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/onboarding/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5dcd1034aee6cec5", "name": "Unused endpoint: POST /api/onboarding", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/onboarding` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd55aa0818a7c897", "name": "Unused endpoint: POST /api/auth/login", "shortDescription": {"text": "Unused endpoint: POST /api/auth/login"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5a39262ac205120", "name": "Unused endpoint: POST /api/auth/logout", "shortDescription": {"text": "Unused endpoint: POST /api/auth/logout"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee4aa5ddab88c9dc", "name": "Unused endpoint: GET /api/auth/me", "shortDescription": {"text": "Unused endpoint: GET /api/auth/me"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a3c45156489b020", "name": "Unused endpoint: GET /api/users", "shortDescription": {"text": "Unused endpoint: GET /api/users"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49546f6900fb04c5", "name": "Unused endpoint: POST /api/users", "shortDescription": {"text": "Unused endpoint: POST /api/users"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c29fb07d6f12479", "name": "Unused endpoint: GET /api/tokens", "shortDescription": {"text": "Unused endpoint: GET /api/tokens"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/tokens` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73d9090b6e4a9550", "name": "Unused endpoint: POST /api/tokens", "shortDescription": {"text": "Unused endpoint: POST /api/tokens"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/tokens` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ac40a047d895b17", "name": "Unused endpoint: DELETE /api/tokens/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/tokens/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `DELETE /api/tokens/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee9829911d5cd293", "name": "Unused endpoint: POST /api/import", "shortDescription": {"text": "Unused endpoint: POST /api/import"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2892aaf3abf81e3d", "name": "Unused endpoint: DELETE /api/actors/:slug", "shortDescription": {"text": "Unused endpoint: DELETE /api/actors/:slug"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `DELETE /api/actors/:slug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdedbeb70ee37b2b", "name": "Unused endpoint: POST /api/actors/:slug/merge", "shortDescription": {"text": "Unused endpoint: POST /api/actors/:slug/merge"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/actors/:slug/merge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-414846c9edbf5134", "name": "Unused endpoint: GET /api/identities", "shortDescription": {"text": "Unused endpoint: GET /api/identities"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/identities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9b08a6f4e467ea8", "name": "Unused endpoint: POST /api/identities", "shortDescription": {"text": "Unused endpoint: POST /api/identities"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/identities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0c6a3fafbf120f6", "name": "Unused endpoint: GET /api/identities/:id", "shortDescription": {"text": "Unused endpoint: GET /api/identities/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/identities/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18e544ddc9334b84", "name": "Unused endpoint: PATCH /api/identities/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/identities/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `PATCH /api/identities/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3205e6ad5e1fd1e3", "name": "Unused endpoint: DELETE /api/identities/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/identities/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `DELETE /api/identities/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63eb73ce1712dce4", "name": "Unused endpoint: GET /api/identities/resolve/:platform/:platform_id", "shortDescription": {"text": "Unused endpoint: GET /api/identities/resolve/:platform/:platform_id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/identities/resolve/:platform/:platform_id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ce45d28cb89174c", "name": "Unused endpoint: GET /api/auth/config", "shortDescription": {"text": "Unused endpoint: GET /api/auth/config"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/auth/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f97a00df2b7643a1", "name": "Unused endpoint: POST /oauth/register", "shortDescription": {"text": "Unused endpoint: POST /oauth/register"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /oauth/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d345fa90f5de3745", "name": "Unused endpoint: GET /authorize", "shortDescription": {"text": "Unused endpoint: GET /authorize"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /authorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30c1225f6259028b", "name": "Unused endpoint: POST /oauth/token", "shortDescription": {"text": "Unused endpoint: POST /oauth/token"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /oauth/token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-603ea4c50516c5fe", "name": "Unused endpoint: GET /api/auth/oidc/start", "shortDescription": {"text": "Unused endpoint: GET /api/auth/oidc/start"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/auth/oidc/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98871b659d7c5887", "name": "Unused endpoint: GET /api/auth/oidc/callback", "shortDescription": {"text": "Unused endpoint: GET /api/auth/oidc/callback"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/auth/oidc/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c123857075c7c046", "name": "Unused endpoint: GET /api/journal/writers", "shortDescription": {"text": "Unused endpoint: GET /api/journal/writers"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/journal/writers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2996752c7b3b2906", "name": "Unused endpoint: GET /api/journal", "shortDescription": {"text": "Unused endpoint: GET /api/journal"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/journal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-171fe460bef07256", "name": "Unused endpoint: POST /api/journal", "shortDescription": {"text": "Unused endpoint: POST /api/journal"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/journal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfe3e806d5d5da33", "name": "Unused endpoint: GET /api/journal/:id", "shortDescription": {"text": "Unused endpoint: GET /api/journal/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/journal/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf16ae0930dc161a", "name": "Unused endpoint: GET /api/tasks", "shortDescription": {"text": "Unused endpoint: GET /api/tasks"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b52d0b343a528754", "name": "Unused endpoint: GET /api/tasks/:id", "shortDescription": {"text": "Unused endpoint: GET /api/tasks/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/tasks/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d5b18f8708facc4", "name": "Unused endpoint: PATCH /api/tasks/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/tasks/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `PATCH /api/tasks/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c072de27f728ed2", "name": "Unused endpoint: GET /api/decisions", "shortDescription": {"text": "Unused endpoint: GET /api/decisions"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/decisions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd3c6be4bfadc3db", "name": "Unused endpoint: GET /api/decisions/:id", "shortDescription": {"text": "Unused endpoint: GET /api/decisions/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/decisions/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86a5cadcf3959692", "name": "Unused endpoint: PATCH /api/decisions/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/decisions/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `PATCH /api/decisions/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32af5edd087acbbc", "name": "Unused endpoint: GET /api/events", "shortDescription": {"text": "Unused endpoint: GET /api/events"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0da03f5572c5475", "name": "Unused endpoint: GET /api/events/:id", "shortDescription": {"text": "Unused endpoint: GET /api/events/:id"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/events/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-565cebd2941a778d", "name": "Unused endpoint: GET /api/inbox/:recipient", "shortDescription": {"text": "Unused endpoint: GET /api/inbox/:recipient"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/inbox/:recipient` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1981e66c5fa4610d", "name": "Unused endpoint: POST /api/inbox/:recipient/read", "shortDescription": {"text": "Unused endpoint: POST /api/inbox/:recipient/read"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/inbox/:recipient/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c08999c2b8016d05", "name": "Unused endpoint: POST /api/inbox/item/:id/read", "shortDescription": {"text": "Unused endpoint: POST /api/inbox/item/:id/read"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/inbox/item/:id/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58a1bf4cb9030876", "name": "Unused endpoint: GET /api/people", "shortDescription": {"text": "Unused endpoint: GET /api/people"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/people` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed866b4dfd63d689", "name": "Unused endpoint: GET /api/people/:slug", "shortDescription": {"text": "Unused endpoint: GET /api/people/:slug"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/people/:slug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da305e686868438d", "name": "Unused endpoint: PATCH /api/people/:slug", "shortDescription": {"text": "Unused endpoint: PATCH /api/people/:slug"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `PATCH /api/people/:slug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15353c57addbd5a6", "name": "Unused endpoint: POST /api/people", "shortDescription": {"text": "Unused endpoint: POST /api/people"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/people` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3d127cc7f11efbe", "name": "Unused endpoint: GET /api/profile/:actor", "shortDescription": {"text": "Unused endpoint: GET /api/profile/:actor"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/profile/:actor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20ca2b4519fb3b56", "name": "Unused endpoint: POST /api/profile/:actor", "shortDescription": {"text": "Unused endpoint: POST /api/profile/:actor"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/profile/:actor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb2f61a742186425", "name": "Unused endpoint: POST /api/recall", "shortDescription": {"text": "Unused endpoint: POST /api/recall"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/recall` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b37929d96824ba96", "name": "Unused endpoint: POST /api/shares", "shortDescription": {"text": "Unused endpoint: POST /api/shares"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `POST /api/shares` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0247ab23199edf37", "name": "Unused endpoint: GET /api/shares", "shortDescription": {"text": "Unused endpoint: GET /api/shares"}, "fullDescription": {"text": "`packages/api/src/server.ts` declares `GET /api/shares` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24519"}, "properties": {"repository": "bees-roadhouse/hive", "repoUrl": "https://github.com/bees-roadhouse/hive", "branch": "main"}, "results": [{"ruleId": "scanner-7f2bfe2040b0ef73", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/api/src/seed.ts:257"}, "properties": {"repobilityId": "901aa8468a0706bc", "scanner": "scanner-primary", "fingerprint": "7f2bfe2040b0ef73", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-30cb1a31de9d1386", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/index.ts:77"}, "properties": {"repobilityId": "7d672af1a16d6a76", "scanner": "scanner-primary", "fingerprint": "30cb1a31de9d1386", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d2bca1e86e314295", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/api/src/server.ts:872"}, "properties": {"repobilityId": "fe4350eec9e2f1f9", "scanner": "scanner-primary", "fingerprint": "d2bca1e86e314295", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api/src/server.ts"}, "region": {"startLine": 872}}}]}, {"ruleId": "scanner-83b8136ed2abb813", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/api/src/mcp.ts:502"}, "properties": {"repobilityId": "6fe1e55a1b863745", "scanner": "scanner-primary", "fingerprint": "83b8136ed2abb813", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api/src/mcp.ts"}, "region": {"startLine": 502}}}]}, {"ruleId": "scanner-a7e0c9f4c85ebedc", "level": "error", "message": {"text": "Possible secret in packages/api/src/seed.ts"}, "properties": {"repobilityId": "c0b487d474e213cf", "scanner": "scanner-primary", "fingerprint": "a7e0c9f4c85ebedc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api/src/seed.ts"}, "region": {"startLine": 333}}}]}, {"ruleId": "scanner-07bedc65bc228cb6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/web/src/markdown.tsx:49"}, "properties": {"repobilityId": "d9883a0af3199249", "scanner": "scanner-primary", "fingerprint": "07bedc65bc228cb6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/src/markdown.tsx"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d08151bb856f4436", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6fa5808b2dbfca4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7a66452a01b71ab5", "scanner": "scanner-primary", "fingerprint": "e6fa5808b2dbfca4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/hermes-dev.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-b7f250962c63268e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "023ec0b6afa3c4c8", "scanner": "scanner-primary", "fingerprint": "b7f250962c63268e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/hermes-dev.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0e91623bfbc4308", "level": "note", "message": {"text": "Very large file: packages/api/src/store.ts (3085 lines)"}, "properties": {"repobilityId": "72be8896f0bc1f88", "scanner": "scanner-primary", "fingerprint": "b0e91623bfbc4308", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3a66e069165c7c45", "level": "note", "message": {"text": "Very large file: api/src/mcp.rs (1374 lines)"}, "properties": {"repobilityId": "787e3b0a1f2cdb69", "scanner": "scanner-primary", "fingerprint": "3a66e069165c7c45", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "0e0dae8d68f1b293", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ee6f99f4b0870116", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/worker/package.json"}, "properties": {"repobilityId": "f8b7873d4333ee74", "scanner": "scanner-primary", "fingerprint": "ee6f99f4b0870116", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/worker/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a0634ffe3eb1107", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/api/package.json"}, "properties": {"repobilityId": "61aa8b13d545e157", "scanner": "scanner-primary", "fingerprint": "0a0634ffe3eb1107", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a28850983a0b02d5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/web/package.json"}, "properties": {"repobilityId": "8f313f0fe526a925", "scanner": "scanner-primary", "fingerprint": "a28850983a0b02d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8b4b78bcb59a64b1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d8255770500797a6", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "5d7031eb94417381", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e94373534edbdf81", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d895b4d7979c9d47", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fd54b8aaf8f6335", "level": "note", "message": {"text": "Legacy-named symbol `importLegacy` in packages/api/src/server.ts:39"}, "properties": {"repobilityId": "cd25526ed4b6c1a8", "scanner": "scanner-primary", "fingerprint": "4fd54b8aaf8f6335", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-88eaec226959cc33", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/api/src/server.ts:739"}, "properties": {"repobilityId": "42b22ba87fbb2cdb", "scanner": "scanner-primary", "fingerprint": "88eaec226959cc33", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c6140983b8d207a1", "level": "note", "message": {"text": "Legacy-named symbol `importLegacy` in packages/api/src/store.ts:780"}, "properties": {"repobilityId": "56422499015ba64a", "scanner": "scanner-primary", "fingerprint": "c6140983b8d207a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ea914580e9b498f2", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/api/src/store.ts:994"}, "properties": {"repobilityId": "5928cc597749338c", "scanner": "scanner-primary", "fingerprint": "ea914580e9b498f2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-91a8f42058d4bd20", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api/src/store.ts:2434"}, "properties": {"repobilityId": "f51f9129373892a4", "scanner": "scanner-primary", "fingerprint": "91a8f42058d4bd20", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-351731af00739006", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/api/src/mcp.ts:111"}, "properties": {"repobilityId": "80aed34f1744fa2a", "scanner": "scanner-primary", "fingerprint": "351731af00739006", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-477366e0dde5205e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api/src/oidc.ts:41"}, "properties": {"repobilityId": "0ccee2708a23d321", "scanner": "scanner-primary", "fingerprint": "477366e0dde5205e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ec0d6b0ea2a913c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/api/src/scrape.ts:1"}, "properties": {"repobilityId": "f9f36a7bca5fed33", "scanner": "scanner-primary", "fingerprint": "ec0d6b0ea2a913c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ab401b09ebe8d1b", "level": "none", "message": {"text": "Commented-code block (11 lines) in packages/api/src/embed.ts:6"}, "properties": {"repobilityId": "07296919ee82b30a", "scanner": "scanner-primary", "fingerprint": "0ab401b09ebe8d1b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90a2144d05bc8cb2", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/api/src/seed.ts:263"}, "properties": {"repobilityId": "c779467eb3b1726d", "scanner": "scanner-primary", "fingerprint": "90a2144d05bc8cb2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-245583b870adfa4b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/api/src/db.ts:412"}, "properties": {"repobilityId": "5f75e130312e4298", "scanner": "scanner-primary", "fingerprint": "245583b870adfa4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c5a1026cbd820b64", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/index.ts:15"}, "properties": {"repobilityId": "d00292c4fd3fde7d", "scanner": "scanner-primary", "fingerprint": "c5a1026cbd820b64", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b9ba30e0d41eac0e", "level": "none", "message": {"text": "Commented-code block (11 lines) in packages/web/src/Journal.tsx:3"}, "properties": {"repobilityId": "4e480bda9841118b", "scanner": "scanner-primary", "fingerprint": "b9ba30e0d41eac0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c3242d9fb9caf58f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/web/src/api.ts:188"}, "properties": {"repobilityId": "ac94a37ae2404095", "scanner": "scanner-primary", "fingerprint": "c3242d9fb9caf58f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-632d510fd63c1898", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/web/src/App.tsx:140"}, "properties": {"repobilityId": "ad56d7a89eb09d76", "scanner": "scanner-primary", "fingerprint": "632d510fd63c1898", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40b5caefa06e6512", "level": "error", "message": {"text": "Dangling fetch: GET /api${path} (packages/web/src/api.ts:71)"}, "properties": {"repobilityId": "ce6d947db128d83f", "scanner": "scanner-primary", "fingerprint": "40b5caefa06e6512", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-76d4f8cfb9c4f6e7", "level": "note", "message": {"text": "Unused endpoint: GET /api/healthz"}, "properties": {"repobilityId": "782af09be92684b1", "scanner": "scanner-primary", "fingerprint": "76d4f8cfb9c4f6e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a0b17f3b9d6a1a4", "level": "note", "message": {"text": "Unused endpoint: GET /api/onboarding/status"}, "properties": {"repobilityId": "b85da790b4af7e04", "scanner": "scanner-primary", "fingerprint": "6a0b17f3b9d6a1a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5dcd1034aee6cec5", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding"}, "properties": {"repobilityId": "78b7bfc1a887938c", "scanner": "scanner-primary", "fingerprint": "5dcd1034aee6cec5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd55aa0818a7c897", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/login"}, "properties": {"repobilityId": "e84be710663cd690", "scanner": "scanner-primary", "fingerprint": "fd55aa0818a7c897", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5a39262ac205120", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/logout"}, "properties": {"repobilityId": "ffbee1227ea295bf", "scanner": "scanner-primary", "fingerprint": "d5a39262ac205120", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee4aa5ddab88c9dc", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/me"}, "properties": {"repobilityId": "e7bbb4d288afbb9c", "scanner": "scanner-primary", "fingerprint": "ee4aa5ddab88c9dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a3c45156489b020", "level": "note", "message": {"text": "Unused endpoint: GET /api/users"}, "properties": {"repobilityId": "4793bd1cdc3a41b9", "scanner": "scanner-primary", "fingerprint": "3a3c45156489b020", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49546f6900fb04c5", "level": "note", "message": {"text": "Unused endpoint: POST /api/users"}, "properties": {"repobilityId": "1dbfaf902f69ef92", "scanner": "scanner-primary", "fingerprint": "49546f6900fb04c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c29fb07d6f12479", "level": "note", "message": {"text": "Unused endpoint: GET /api/tokens"}, "properties": {"repobilityId": "8619bd05fdd9687c", "scanner": "scanner-primary", "fingerprint": "0c29fb07d6f12479", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-73d9090b6e4a9550", "level": "note", "message": {"text": "Unused endpoint: POST /api/tokens"}, "properties": {"repobilityId": "c06943f741c6e322", "scanner": "scanner-primary", "fingerprint": "73d9090b6e4a9550", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6ac40a047d895b17", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/tokens/:id"}, "properties": {"repobilityId": "f2d21b8e367226a0", "scanner": "scanner-primary", "fingerprint": "6ac40a047d895b17", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee9829911d5cd293", "level": "note", "message": {"text": "Unused endpoint: POST /api/import"}, "properties": {"repobilityId": "e73f251e7edcf801", "scanner": "scanner-primary", "fingerprint": "ee9829911d5cd293", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2892aaf3abf81e3d", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/actors/:slug"}, "properties": {"repobilityId": "e91ecb9dcb6b27e5", "scanner": "scanner-primary", "fingerprint": "2892aaf3abf81e3d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cdedbeb70ee37b2b", "level": "note", "message": {"text": "Unused endpoint: POST /api/actors/:slug/merge"}, "properties": {"repobilityId": "e5268850a9624d18", "scanner": "scanner-primary", "fingerprint": "cdedbeb70ee37b2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-414846c9edbf5134", "level": "note", "message": {"text": "Unused endpoint: GET /api/identities"}, "properties": {"repobilityId": "201aaa448d211fd7", "scanner": "scanner-primary", "fingerprint": "414846c9edbf5134", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9b08a6f4e467ea8", "level": "note", "message": {"text": "Unused endpoint: POST /api/identities"}, "properties": {"repobilityId": "c08741e49f77fc1d", "scanner": "scanner-primary", "fingerprint": "e9b08a6f4e467ea8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0c6a3fafbf120f6", "level": "note", "message": {"text": "Unused endpoint: GET /api/identities/:id"}, "properties": {"repobilityId": "1e1099092100d906", "scanner": "scanner-primary", "fingerprint": "c0c6a3fafbf120f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18e544ddc9334b84", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/identities/:id"}, "properties": {"repobilityId": "2a07040666e1d07c", "scanner": "scanner-primary", "fingerprint": "18e544ddc9334b84", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3205e6ad5e1fd1e3", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/identities/:id"}, "properties": {"repobilityId": "fc00ef7664104629", "scanner": "scanner-primary", "fingerprint": "3205e6ad5e1fd1e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63eb73ce1712dce4", "level": "note", "message": {"text": "Unused endpoint: GET /api/identities/resolve/:platform/:platform_id"}, "properties": {"repobilityId": "ff1226409c24b1ac", "scanner": "scanner-primary", "fingerprint": "63eb73ce1712dce4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ce45d28cb89174c", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/config"}, "properties": {"repobilityId": "f58aad175b11f5ed", "scanner": "scanner-primary", "fingerprint": "5ce45d28cb89174c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f97a00df2b7643a1", "level": "note", "message": {"text": "Unused endpoint: POST /oauth/register"}, "properties": {"repobilityId": "4082cd2cd6595686", "scanner": "scanner-primary", "fingerprint": "f97a00df2b7643a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d345fa90f5de3745", "level": "note", "message": {"text": "Unused endpoint: GET /authorize"}, "properties": {"repobilityId": "6ac05db1ff68aa64", "scanner": "scanner-primary", "fingerprint": "d345fa90f5de3745", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-30c1225f6259028b", "level": "note", "message": {"text": "Unused endpoint: POST /oauth/token"}, "properties": {"repobilityId": "7588f5c7431e4418", "scanner": "scanner-primary", "fingerprint": "30c1225f6259028b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-603ea4c50516c5fe", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/oidc/start"}, "properties": {"repobilityId": "d4008b3f27aeccd2", "scanner": "scanner-primary", "fingerprint": "603ea4c50516c5fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98871b659d7c5887", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/oidc/callback"}, "properties": {"repobilityId": "05e3044b95177435", "scanner": "scanner-primary", "fingerprint": "98871b659d7c5887", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c123857075c7c046", "level": "note", "message": {"text": "Unused endpoint: GET /api/journal/writers"}, "properties": {"repobilityId": "8add01e81f3e5246", "scanner": "scanner-primary", "fingerprint": "c123857075c7c046", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2996752c7b3b2906", "level": "note", "message": {"text": "Unused endpoint: GET /api/journal"}, "properties": {"repobilityId": "124245b72f78dc90", "scanner": "scanner-primary", "fingerprint": "2996752c7b3b2906", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-171fe460bef07256", "level": "note", "message": {"text": "Unused endpoint: POST /api/journal"}, "properties": {"repobilityId": "2d454cd8739beca0", "scanner": "scanner-primary", "fingerprint": "171fe460bef07256", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfe3e806d5d5da33", "level": "note", "message": {"text": "Unused endpoint: GET /api/journal/:id"}, "properties": {"repobilityId": "f63824d0a6ae2509", "scanner": "scanner-primary", "fingerprint": "bfe3e806d5d5da33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf16ae0930dc161a", "level": "note", "message": {"text": "Unused endpoint: GET /api/tasks"}, "properties": {"repobilityId": "099eb55a42e7a46d", "scanner": "scanner-primary", "fingerprint": "cf16ae0930dc161a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b52d0b343a528754", "level": "note", "message": {"text": "Unused endpoint: GET /api/tasks/:id"}, "properties": {"repobilityId": "c867b89f2fe0e5f0", "scanner": "scanner-primary", "fingerprint": "b52d0b343a528754", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d5b18f8708facc4", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/tasks/:id"}, "properties": {"repobilityId": "652dbc56eaa4072a", "scanner": "scanner-primary", "fingerprint": "1d5b18f8708facc4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1c072de27f728ed2", "level": "note", "message": {"text": "Unused endpoint: GET /api/decisions"}, "properties": {"repobilityId": "7b40b4754768fa08", "scanner": "scanner-primary", "fingerprint": "1c072de27f728ed2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd3c6be4bfadc3db", "level": "note", "message": {"text": "Unused endpoint: GET /api/decisions/:id"}, "properties": {"repobilityId": "14fcddd6ecb69130", "scanner": "scanner-primary", "fingerprint": "cd3c6be4bfadc3db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86a5cadcf3959692", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/decisions/:id"}, "properties": {"repobilityId": "37da6e75c196a470", "scanner": "scanner-primary", "fingerprint": "86a5cadcf3959692", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32af5edd087acbbc", "level": "note", "message": {"text": "Unused endpoint: GET /api/events"}, "properties": {"repobilityId": "004f777c1fb86e57", "scanner": "scanner-primary", "fingerprint": "32af5edd087acbbc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0da03f5572c5475", "level": "note", "message": {"text": "Unused endpoint: GET /api/events/:id"}, "properties": {"repobilityId": "c449086874040d8c", "scanner": "scanner-primary", "fingerprint": "c0da03f5572c5475", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-565cebd2941a778d", "level": "note", "message": {"text": "Unused endpoint: GET /api/inbox/:recipient"}, "properties": {"repobilityId": "d6039e91ea8d9294", "scanner": "scanner-primary", "fingerprint": "565cebd2941a778d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1981e66c5fa4610d", "level": "note", "message": {"text": "Unused endpoint: POST /api/inbox/:recipient/read"}, "properties": {"repobilityId": "016cc6caceab5360", "scanner": "scanner-primary", "fingerprint": "1981e66c5fa4610d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c08999c2b8016d05", "level": "note", "message": {"text": "Unused endpoint: POST /api/inbox/item/:id/read"}, "properties": {"repobilityId": "3e5024221d781c03", "scanner": "scanner-primary", "fingerprint": "c08999c2b8016d05", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58a1bf4cb9030876", "level": "note", "message": {"text": "Unused endpoint: GET /api/people"}, "properties": {"repobilityId": "e5deb94b5e2f5064", "scanner": "scanner-primary", "fingerprint": "58a1bf4cb9030876", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed866b4dfd63d689", "level": "note", "message": {"text": "Unused endpoint: GET /api/people/:slug"}, "properties": {"repobilityId": "5eb7ec099c5c1dde", "scanner": "scanner-primary", "fingerprint": "ed866b4dfd63d689", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da305e686868438d", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/people/:slug"}, "properties": {"repobilityId": "2593313b031a60e2", "scanner": "scanner-primary", "fingerprint": "da305e686868438d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-15353c57addbd5a6", "level": "note", "message": {"text": "Unused endpoint: POST /api/people"}, "properties": {"repobilityId": "3bd83952c87638ae", "scanner": "scanner-primary", "fingerprint": "15353c57addbd5a6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b3d127cc7f11efbe", "level": "note", "message": {"text": "Unused endpoint: GET /api/profile/:actor"}, "properties": {"repobilityId": "3cd7532db4e403fd", "scanner": "scanner-primary", "fingerprint": "b3d127cc7f11efbe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-20ca2b4519fb3b56", "level": "note", "message": {"text": "Unused endpoint: POST /api/profile/:actor"}, "properties": {"repobilityId": "3584dfaad474f4a2", "scanner": "scanner-primary", "fingerprint": "20ca2b4519fb3b56", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fb2f61a742186425", "level": "note", "message": {"text": "Unused endpoint: POST /api/recall"}, "properties": {"repobilityId": "3dd0948e227eda2c", "scanner": "scanner-primary", "fingerprint": "fb2f61a742186425", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b37929d96824ba96", "level": "note", "message": {"text": "Unused endpoint: POST /api/shares"}, "properties": {"repobilityId": "837c4186ac6df4fd", "scanner": "scanner-primary", "fingerprint": "b37929d96824ba96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0247ab23199edf37", "level": "note", "message": {"text": "Unused endpoint: GET /api/shares"}, "properties": {"repobilityId": "29b40e8c41bac35a", "scanner": "scanner-primary", "fingerprint": "0247ab23199edf37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}