{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-41a7089e1e8a66eb", "name": "Stray `console.log` in TS/JS \u2014 server.js:115", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:115"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93e02e0d67c8f3e8", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-792398356ab9fd21", "name": "Possible secret in server.js", "shortDescription": {"text": "Possible secret in server.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9b337c0d7067aa84", "name": "Insecure pattern 'direct_innerhtml_assignment' in server.js:1289", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server.js:1289"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e48d39caccbe9126", "name": "Very large file: server.js (1351 lines)", "shortDescription": {"text": "Very large file: server.js (1351 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1813a2affa6f025d", "name": "Legacy-named symbol `PisosPacific_DataApp_v1` in server.js:83", "shortDescription": {"text": "Legacy-named symbol `PisosPacific_DataApp_v1` in server.js:83"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ee3728b54f9267c", "name": "Commented-code block (6 lines) in server.js:894", "shortDescription": {"text": "Commented-code block (6 lines) in server.js:894"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5f9310608760b2b1", "name": "Dangling fetch: GET https://dolarapi.com/v1/dolares/blue (server.js:435)", "shortDescription": {"text": "Dangling fetch: GET https://dolarapi.com/v1/dolares/blue (server.js:435)"}, "fullDescription": {"text": "`server.js:435` calls `GET https://dolarapi.com/v1/dolares/blue` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/dolarapi.com/v1/dolares/blue`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-074db7309828674f", "name": "Dangling fetch: POST https://oauth2.googleapis.com/token (server.js:559)", "shortDescription": {"text": "Dangling fetch: POST https://oauth2.googleapis.com/token (server.js:559)"}, "fullDescription": {"text": "`server.js:559` calls `POST https://oauth2.googleapis.com/token` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/oauth2.googleapis.com/token`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-438364bede441567", "name": "Dangling fetch: POST https://api.mercadopago.com/checkout/preferences (server.js:914)", "shortDescription": {"text": "Dangling fetch: POST https://api.mercadopago.com/checkout/preferences (server.js:914)"}, "fullDescription": {"text": "`server.js:914` calls `POST https://api.mercadopago.com/checkout/preferences` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.mercadopago.com/checkout/preferences`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66b021906dff35b2", "name": "Dangling fetch: GET https://api.mercadopago.com/v1/payments/${payment_id} (server.js:973)", "shortDescription": {"text": "Dangling fetch: GET https://api.mercadopago.com/v1/payments/${payment_id} (server.js:973)"}, "fullDescription": {"text": "`server.js:973` calls `GET https://api.mercadopago.com/v1/payments/${payment_id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.mercadopago.com/v1/payments/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9daee89b78e9ceac", "name": "Unused endpoint: GET /privacy", "shortDescription": {"text": "Unused endpoint: GET /privacy"}, "fullDescription": {"text": "`server.js` declares `GET /privacy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd55aa0818a7c897", "name": "Unused endpoint: POST /api/auth/login", "shortDescription": {"text": "Unused endpoint: POST /api/auth/login"}, "fullDescription": {"text": "`server.js` declares `POST /api/auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5a39262ac205120", "name": "Unused endpoint: POST /api/auth/logout", "shortDescription": {"text": "Unused endpoint: POST /api/auth/logout"}, "fullDescription": {"text": "`server.js` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee4aa5ddab88c9dc", "name": "Unused endpoint: GET /api/auth/me", "shortDescription": {"text": "Unused endpoint: GET /api/auth/me"}, "fullDescription": {"text": "`server.js` declares `GET /api/auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-866cfadefccd0b5c", "name": "Unused endpoint: POST /api/auth/change-password", "shortDescription": {"text": "Unused endpoint: POST /api/auth/change-password"}, "fullDescription": {"text": "`server.js` declares `POST /api/auth/change-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0e81858fbfe443b", "name": "Unused endpoint: POST /api/auth/forgot-password", "shortDescription": {"text": "Unused endpoint: POST /api/auth/forgot-password"}, "fullDescription": {"text": "`server.js` declares `POST /api/auth/forgot-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-deb991b140ed4125", "name": "Unused endpoint: POST /api/auth/reset-password", "shortDescription": {"text": "Unused endpoint: POST /api/auth/reset-password"}, "fullDescription": {"text": "`server.js` declares `POST /api/auth/reset-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dde3adb27bf7eebe", "name": "Unused endpoint: USE /api", "shortDescription": {"text": "Unused endpoint: USE /api"}, "fullDescription": {"text": "`server.js` declares `USE /api` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b695a5b67fb4fb96", "name": "Unused endpoint: GET /api/products", "shortDescription": {"text": "Unused endpoint: GET /api/products"}, "fullDescription": {"text": "`server.js` declares `GET /api/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c45fefaa49f964f2", "name": "Unused endpoint: GET /api/sales", "shortDescription": {"text": "Unused endpoint: GET /api/sales"}, "fullDescription": {"text": "`server.js` declares `GET /api/sales` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d018b74536d52921", "name": "Unused endpoint: GET /api/quotes", "shortDescription": {"text": "Unused endpoint: GET /api/quotes"}, "fullDescription": {"text": "`server.js` declares `GET /api/quotes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7a05d36b74b51ae", "name": "Unused endpoint: GET /api/clients", "shortDescription": {"text": "Unused endpoint: GET /api/clients"}, "fullDescription": {"text": "`server.js` declares `GET /api/clients` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8ecee161927d1e1", "name": "Unused endpoint: GET /api/expenses", "shortDescription": {"text": "Unused endpoint: GET /api/expenses"}, "fullDescription": {"text": "`server.js` declares `GET /api/expenses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4f01423e4c38ed6", "name": "Unused endpoint: GET /api/leads", "shortDescription": {"text": "Unused endpoint: GET /api/leads"}, "fullDescription": {"text": "`server.js` declares `GET /api/leads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf16ae0930dc161a", "name": "Unused endpoint: GET /api/tasks", "shortDescription": {"text": "Unused endpoint: GET /api/tasks"}, "fullDescription": {"text": "`server.js` declares `GET /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bc1eb83de615f9e", "name": "Unused endpoint: GET /api/suppliers", "shortDescription": {"text": "Unused endpoint: GET /api/suppliers"}, "fullDescription": {"text": "`server.js` declares `GET /api/suppliers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5926c673ce6a1271", "name": "Unused endpoint: GET /api/categories", "shortDescription": {"text": "Unused endpoint: GET /api/categories"}, "fullDescription": {"text": "`server.js` declares `GET /api/categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2e31a7afb209f45", "name": "Unused endpoint: GET /api/fx/blue", "shortDescription": {"text": "Unused endpoint: GET /api/fx/blue"}, "fullDescription": {"text": "`server.js` declares `GET /api/fx/blue` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f4a6739733c0620", "name": "Unused endpoint: GET /api/cashflow", "shortDescription": {"text": "Unused endpoint: GET /api/cashflow"}, "fullDescription": {"text": "`server.js` declares `GET /api/cashflow` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-182c7384c61619fc", "name": "Unused endpoint: GET /api/cajas", "shortDescription": {"text": "Unused endpoint: GET /api/cajas"}, "fullDescription": {"text": "`server.js` declares `GET /api/cajas` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8870d1363290bdc8", "name": "Unused endpoint: GET /api/cajas/balances", "shortDescription": {"text": "Unused endpoint: GET /api/cajas/balances"}, "fullDescription": {"text": "`server.js` declares `GET /api/cajas/balances` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c921d242ce55dba1", "name": "Unused endpoint: GET /api/conversations", "shortDescription": {"text": "Unused endpoint: GET /api/conversations"}, "fullDescription": {"text": "`server.js` declares `GET /api/conversations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b46238010303501", "name": "Unused endpoint: GET /api/conversations/:id/messages", "shortDescription": {"text": "Unused endpoint: GET /api/conversations/:id/messages"}, "fullDescription": {"text": "`server.js` declares `GET /api/conversations/:id/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e91aa82ad0e0171", "name": "Unused endpoint: POST /api/conversations/:id/messages", "shortDescription": {"text": "Unused endpoint: POST /api/conversations/:id/messages"}, "fullDescription": {"text": "`server.js` declares `POST /api/conversations/:id/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55c103bf61884e81", "name": "Unused endpoint: POST /api/conversations/:id/read", "shortDescription": {"text": "Unused endpoint: POST /api/conversations/:id/read"}, "fullDescription": {"text": "`server.js` declares `POST /api/conversations/:id/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b499aa0db7c751dd", "name": "Unused endpoint: GET /api/templates", "shortDescription": {"text": "Unused endpoint: GET /api/templates"}, "fullDescription": {"text": "`server.js` declares `GET /api/templates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c60f9aa268d54e8", "name": "Unused endpoint: POST /api/integrations/gmail/sync", "shortDescription": {"text": "Unused endpoint: POST /api/integrations/gmail/sync"}, "fullDescription": {"text": "`server.js` declares `POST /api/integrations/gmail/sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddef10c080ebe65e", "name": "Unused endpoint: GET /api/integrations/google/connect", "shortDescription": {"text": "Unused endpoint: GET /api/integrations/google/connect"}, "fullDescription": {"text": "`server.js` declares `GET /api/integrations/google/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b5b86e889ebe15e", "name": "Unused endpoint: GET /api/integrations/google/callback", "shortDescription": {"text": "Unused endpoint: GET /api/integrations/google/callback"}, "fullDescription": {"text": "`server.js` declares `GET /api/integrations/google/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-379b09f9de636500", "name": "Unused endpoint: GET /api/settings", "shortDescription": {"text": "Unused endpoint: GET /api/settings"}, "fullDescription": {"text": "`server.js` declares `GET /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ddfaa00d1e5e7c0", "name": "Unused endpoint: PATCH /api/settings", "shortDescription": {"text": "Unused endpoint: PATCH /api/settings"}, "fullDescription": {"text": "`server.js` declares `PATCH /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87ab45a498b08877", "name": "Unused endpoint: GET /api/containers", "shortDescription": {"text": "Unused endpoint: GET /api/containers"}, "fullDescription": {"text": "`server.js` declares `GET /api/containers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb2f98668d40cc8d", "name": "Unused endpoint: GET /api/containers/:id", "shortDescription": {"text": "Unused endpoint: GET /api/containers/:id"}, "fullDescription": {"text": "`server.js` declares `GET /api/containers/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-404a155a50f0fb16", "name": "Unused endpoint: POST /api/containers", "shortDescription": {"text": "Unused endpoint: POST /api/containers"}, "fullDescription": {"text": "`server.js` declares `POST /api/containers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e90bc440b9d19ec", "name": "Unused endpoint: PATCH /api/containers/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/containers/:id"}, "fullDescription": {"text": "`server.js` declares `PATCH /api/containers/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-770131393278c9c3", "name": "Unused endpoint: POST /api/containers/:id/receive", "shortDescription": {"text": "Unused endpoint: POST /api/containers/:id/receive"}, "fullDescription": {"text": "`server.js` declares `POST /api/containers/:id/receive` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e811b0c513c2faf6", "name": "Unused endpoint: GET /api/stock_movements", "shortDescription": {"text": "Unused endpoint: GET /api/stock_movements"}, "fullDescription": {"text": "`server.js` declares `GET /api/stock_movements` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-706d034706ec9578", "name": "Unused endpoint: PATCH /api/leads/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/leads/:id"}, "fullDescription": {"text": "`server.js` declares `PATCH /api/leads/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e6ea349e760b35a", "name": "Unused endpoint: POST /api/import/parse", "shortDescription": {"text": "Unused endpoint: POST /api/import/parse"}, "fullDescription": {"text": "`server.js` declares `POST /api/import/parse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84b2095565696199", "name": "Unused endpoint: POST /api/import/mp-sync/start", "shortDescription": {"text": "Unused endpoint: POST /api/import/mp-sync/start"}, "fullDescription": {"text": "`server.js` declares `POST /api/import/mp-sync/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e9e5f815e2ec13d", "name": "Unused endpoint: POST /api/import/mp-email", "shortDescription": {"text": "Unused endpoint: POST /api/import/mp-email"}, "fullDescription": {"text": "`server.js` declares `POST /api/import/mp-email` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95bdf37675780dee", "name": "Unused endpoint: POST /api/import/mp-sync/result", "shortDescription": {"text": "Unused endpoint: POST /api/import/mp-sync/result"}, "fullDescription": {"text": "`server.js` declares `POST /api/import/mp-sync/result` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56351011afd8791f", "name": "Unused endpoint: POST /api/import/mp-sync/auto-run", "shortDescription": {"text": "Unused endpoint: POST /api/import/mp-sync/auto-run"}, "fullDescription": {"text": "`server.js` declares `POST /api/import/mp-sync/auto-run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfb44b1ff06a8f3f", "name": "Unused endpoint: POST /api/import/commit", "shortDescription": {"text": "Unused endpoint: POST /api/import/commit"}, "fullDescription": {"text": "`server.js` declares `POST /api/import/commit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8334037c356a0602", "name": "Unused endpoint: POST /api/quotes/:id/transition", "shortDescription": {"text": "Unused endpoint: POST /api/quotes/:id/transition"}, "fullDescription": {"text": "`server.js` declares `POST /api/quotes/:id/transition` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6dd22882f4760fb", "name": "Unused endpoint: POST /api/sales/:id/transition", "shortDescription": {"text": "Unused endpoint: POST /api/sales/:id/transition"}, "fullDescription": {"text": "`server.js` declares `POST /api/sales/:id/transition` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f357a042728bc93e", "name": "Unused endpoint: POST /api/sales/:id/payment-link", "shortDescription": {"text": "Unused endpoint: POST /api/sales/:id/payment-link"}, "fullDescription": {"text": "`server.js` declares `POST /api/sales/:id/payment-link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c911a93ffd592ee", "name": "Unused endpoint: GET /api/payment-links", "shortDescription": {"text": "Unused endpoint: GET /api/payment-links"}, "fullDescription": {"text": "`server.js` declares `GET /api/payment-links` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f943de63e1cafc63", "name": "Unused endpoint: GET /api/payment-links/:id", "shortDescription": {"text": "Unused endpoint: GET /api/payment-links/:id"}, "fullDescription": {"text": "`server.js` declares `GET /api/payment-links/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d1e45ee8d4fc652", "name": "Unused endpoint: POST /api/payment-links/:id/simulate-paid", "shortDescription": {"text": "Unused endpoint: POST /api/payment-links/:id/simulate-paid"}, "fullDescription": {"text": "`server.js` declares `POST /api/payment-links/:id/simulate-paid` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/27013"}, "properties": {"repository": "juanrmomesso-pisospacific/pisos-pacific-app", "repoUrl": "https://github.com/juanrmomesso-pisospacific/pisos-pacific-app", "branch": "main"}, "results": [{"ruleId": "scanner-41a7089e1e8a66eb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:115"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "41a7089e1e8a66eb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-93e02e0d67c8f3e8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "dec0055f631696d7", "scanner": "scanner-primary", "fingerprint": "93e02e0d67c8f3e8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-792398356ab9fd21", "level": "error", "message": {"text": "Possible secret in server.js"}, "properties": {"repobilityId": "bf6994e7b6e7d67b", "scanner": "scanner-primary", "fingerprint": "792398356ab9fd21", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-792398356ab9fd21", "level": "error", "message": {"text": "Possible secret in server.js"}, "properties": {"repobilityId": "bf6994e7b6e7d67b", "scanner": "scanner-primary", "fingerprint": "792398356ab9fd21", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 200}}}]}, {"ruleId": "scanner-9b337c0d7067aa84", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server.js:1289"}, "properties": {"repobilityId": "eced4d3daf81c2bf", "scanner": "scanner-primary", "fingerprint": "9b337c0d7067aa84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 1289}}}]}, {"ruleId": "scanner-e48d39caccbe9126", "level": "note", "message": {"text": "Very large file: server.js (1351 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "e48d39caccbe9126", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d397d685c74f3b71", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "7c3e5cbeb92eacde", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "18a2315b7140eecd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "ba95752ebe580f7d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e299bee87aac6aa5", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "46346857fd36135b", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-1813a2affa6f025d", "level": "note", "message": {"text": "Legacy-named symbol `PisosPacific_DataApp_v1` in server.js:83"}, "properties": {"repobilityId": "11a518af9df69649", "scanner": "scanner-primary", "fingerprint": "1813a2affa6f025d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3ee3728b54f9267c", "level": "none", "message": {"text": "Commented-code block (6 lines) in server.js:894"}, "properties": {"repobilityId": "7c6b515b7d4bd29e", "scanner": "scanner-primary", "fingerprint": "3ee3728b54f9267c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5f9310608760b2b1", "level": "error", "message": {"text": "Dangling fetch: GET https://dolarapi.com/v1/dolares/blue (server.js:435)"}, "properties": {"repobilityId": "00525b50daa01cfc", "scanner": "scanner-primary", "fingerprint": "5f9310608760b2b1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-074db7309828674f", "level": "error", "message": {"text": "Dangling fetch: POST https://oauth2.googleapis.com/token (server.js:559)"}, "properties": {"repobilityId": "251f7085134f1665", "scanner": "scanner-primary", "fingerprint": "074db7309828674f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-438364bede441567", "level": "error", "message": {"text": "Dangling fetch: POST https://api.mercadopago.com/checkout/preferences (server.js:914)"}, "properties": {"repobilityId": "07805e5021a47c67", "scanner": "scanner-primary", "fingerprint": "438364bede441567", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-66b021906dff35b2", "level": "error", "message": {"text": "Dangling fetch: GET https://api.mercadopago.com/v1/payments/${payment_id} (server.js:973)"}, "properties": {"repobilityId": "a0199414a641d9f1", "scanner": "scanner-primary", "fingerprint": "66b021906dff35b2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9daee89b78e9ceac", "level": "note", "message": {"text": "Unused endpoint: GET /privacy"}, "properties": {"repobilityId": "a5fa38dbc797b050", "scanner": "scanner-primary", "fingerprint": "9daee89b78e9ceac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd55aa0818a7c897", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/login"}, "properties": {"repobilityId": "4b2c3310a7f2d8f2", "scanner": "scanner-primary", "fingerprint": "fd55aa0818a7c897", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5a39262ac205120", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/logout"}, "properties": {"repobilityId": "aa3173c3593ae21d", "scanner": "scanner-primary", "fingerprint": "d5a39262ac205120", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee4aa5ddab88c9dc", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/me"}, "properties": {"repobilityId": "0fc801facb986854", "scanner": "scanner-primary", "fingerprint": "ee4aa5ddab88c9dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-866cfadefccd0b5c", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/change-password"}, "properties": {"repobilityId": "88d3e4801e03d632", "scanner": "scanner-primary", "fingerprint": "866cfadefccd0b5c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a0e81858fbfe443b", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/forgot-password"}, "properties": {"repobilityId": "d4d439244b3a9a4b", "scanner": "scanner-primary", "fingerprint": "a0e81858fbfe443b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-deb991b140ed4125", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/reset-password"}, "properties": {"repobilityId": "2559f2d61c51651e", "scanner": "scanner-primary", "fingerprint": "deb991b140ed4125", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dde3adb27bf7eebe", "level": "note", "message": {"text": "Unused endpoint: USE /api"}, "properties": {"repobilityId": "a3eddf5065ffbf6c", "scanner": "scanner-primary", "fingerprint": "dde3adb27bf7eebe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b695a5b67fb4fb96", "level": "note", "message": {"text": "Unused endpoint: GET /api/products"}, "properties": {"repobilityId": "eae1c7b4781b8a24", "scanner": "scanner-primary", "fingerprint": "b695a5b67fb4fb96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c45fefaa49f964f2", "level": "note", "message": {"text": "Unused endpoint: GET /api/sales"}, "properties": {"repobilityId": "48d40bae92912223", "scanner": "scanner-primary", "fingerprint": "c45fefaa49f964f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d018b74536d52921", "level": "note", "message": {"text": "Unused endpoint: GET /api/quotes"}, "properties": {"repobilityId": "99b9f5f6b067ddae", "scanner": "scanner-primary", "fingerprint": "d018b74536d52921", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c7a05d36b74b51ae", "level": "note", "message": {"text": "Unused endpoint: GET /api/clients"}, "properties": {"repobilityId": "67620b03fb9cf39b", "scanner": "scanner-primary", "fingerprint": "c7a05d36b74b51ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d8ecee161927d1e1", "level": "note", "message": {"text": "Unused endpoint: GET /api/expenses"}, "properties": {"repobilityId": "23aa33d9887f393e", "scanner": "scanner-primary", "fingerprint": "d8ecee161927d1e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4f01423e4c38ed6", "level": "note", "message": {"text": "Unused endpoint: GET /api/leads"}, "properties": {"repobilityId": "92d748e2e74fb1f3", "scanner": "scanner-primary", "fingerprint": "b4f01423e4c38ed6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf16ae0930dc161a", "level": "note", "message": {"text": "Unused endpoint: GET /api/tasks"}, "properties": {"repobilityId": "c073568a26bd90e7", "scanner": "scanner-primary", "fingerprint": "cf16ae0930dc161a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6bc1eb83de615f9e", "level": "note", "message": {"text": "Unused endpoint: GET /api/suppliers"}, "properties": {"repobilityId": "407ed9eb7aff0c83", "scanner": "scanner-primary", "fingerprint": "6bc1eb83de615f9e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5926c673ce6a1271", "level": "note", "message": {"text": "Unused endpoint: GET /api/categories"}, "properties": {"repobilityId": "d1aba46632a74c7b", "scanner": "scanner-primary", "fingerprint": "5926c673ce6a1271", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2e31a7afb209f45", "level": "note", "message": {"text": "Unused endpoint: GET /api/fx/blue"}, "properties": {"repobilityId": "2c1180a606483ac7", "scanner": "scanner-primary", "fingerprint": "e2e31a7afb209f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f4a6739733c0620", "level": "note", "message": {"text": "Unused endpoint: GET /api/cashflow"}, "properties": {"repobilityId": "2f73e0bf19273b62", "scanner": "scanner-primary", "fingerprint": "1f4a6739733c0620", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-182c7384c61619fc", "level": "note", "message": {"text": "Unused endpoint: GET /api/cajas"}, "properties": {"repobilityId": "bda95415159735c6", "scanner": "scanner-primary", "fingerprint": "182c7384c61619fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8870d1363290bdc8", "level": "note", "message": {"text": "Unused endpoint: GET /api/cajas/balances"}, "properties": {"repobilityId": "50210dbd420786bf", "scanner": "scanner-primary", "fingerprint": "8870d1363290bdc8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c921d242ce55dba1", "level": "note", "message": {"text": "Unused endpoint: GET /api/conversations"}, "properties": {"repobilityId": "e4162bff845d7a4f", "scanner": "scanner-primary", "fingerprint": "c921d242ce55dba1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9b46238010303501", "level": "note", "message": {"text": "Unused endpoint: GET /api/conversations/:id/messages"}, "properties": {"repobilityId": "e4353f1dcf0e2295", "scanner": "scanner-primary", "fingerprint": "9b46238010303501", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e91aa82ad0e0171", "level": "note", "message": {"text": "Unused endpoint: POST /api/conversations/:id/messages"}, "properties": {"repobilityId": "397798cbb93ddbc9", "scanner": "scanner-primary", "fingerprint": "8e91aa82ad0e0171", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55c103bf61884e81", "level": "note", "message": {"text": "Unused endpoint: POST /api/conversations/:id/read"}, "properties": {"repobilityId": "9518dc000fda56c3", "scanner": "scanner-primary", "fingerprint": "55c103bf61884e81", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b499aa0db7c751dd", "level": "note", "message": {"text": "Unused endpoint: GET /api/templates"}, "properties": {"repobilityId": "c6238ffa9506b577", "scanner": "scanner-primary", "fingerprint": "b499aa0db7c751dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c60f9aa268d54e8", "level": "note", "message": {"text": "Unused endpoint: POST /api/integrations/gmail/sync"}, "properties": {"repobilityId": "a5cae206df6e1b14", "scanner": "scanner-primary", "fingerprint": "0c60f9aa268d54e8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ddef10c080ebe65e", "level": "note", "message": {"text": "Unused endpoint: GET /api/integrations/google/connect"}, "properties": {"repobilityId": "80e5345d0a4b6ce1", "scanner": "scanner-primary", "fingerprint": "ddef10c080ebe65e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b5b86e889ebe15e", "level": "note", "message": {"text": "Unused endpoint: GET /api/integrations/google/callback"}, "properties": {"repobilityId": "65f0c2aca22736eb", "scanner": "scanner-primary", "fingerprint": "5b5b86e889ebe15e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-379b09f9de636500", "level": "note", "message": {"text": "Unused endpoint: GET /api/settings"}, "properties": {"repobilityId": "ed33f347e73d737c", "scanner": "scanner-primary", "fingerprint": "379b09f9de636500", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ddfaa00d1e5e7c0", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/settings"}, "properties": {"repobilityId": "c09c541c913f81ee", "scanner": "scanner-primary", "fingerprint": "2ddfaa00d1e5e7c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87ab45a498b08877", "level": "note", "message": {"text": "Unused endpoint: GET /api/containers"}, "properties": {"repobilityId": "bcec1614adc6c8f0", "scanner": "scanner-primary", "fingerprint": "87ab45a498b08877", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bb2f98668d40cc8d", "level": "note", "message": {"text": "Unused endpoint: GET /api/containers/:id"}, "properties": {"repobilityId": "bbc9694ca3fc4051", "scanner": "scanner-primary", "fingerprint": "bb2f98668d40cc8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-404a155a50f0fb16", "level": "note", "message": {"text": "Unused endpoint: POST /api/containers"}, "properties": {"repobilityId": "6d9c696edb155873", "scanner": "scanner-primary", "fingerprint": "404a155a50f0fb16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7e90bc440b9d19ec", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/containers/:id"}, "properties": {"repobilityId": "65aec2f5f74cd7ba", "scanner": "scanner-primary", "fingerprint": "7e90bc440b9d19ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-770131393278c9c3", "level": "note", "message": {"text": "Unused endpoint: POST /api/containers/:id/receive"}, "properties": {"repobilityId": "4142182dbdad5be4", "scanner": "scanner-primary", "fingerprint": "770131393278c9c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e811b0c513c2faf6", "level": "note", "message": {"text": "Unused endpoint: GET /api/stock_movements"}, "properties": {"repobilityId": "de8785b38359ded6", "scanner": "scanner-primary", "fingerprint": "e811b0c513c2faf6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-706d034706ec9578", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/leads/:id"}, "properties": {"repobilityId": "cd730bacc4844774", "scanner": "scanner-primary", "fingerprint": "706d034706ec9578", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e6ea349e760b35a", "level": "note", "message": {"text": "Unused endpoint: POST /api/import/parse"}, "properties": {"repobilityId": "8366d05feb53bca3", "scanner": "scanner-primary", "fingerprint": "3e6ea349e760b35a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84b2095565696199", "level": "note", "message": {"text": "Unused endpoint: POST /api/import/mp-sync/start"}, "properties": {"repobilityId": "c439778f9e4a4225", "scanner": "scanner-primary", "fingerprint": "84b2095565696199", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e9e5f815e2ec13d", "level": "note", "message": {"text": "Unused endpoint: POST /api/import/mp-email"}, "properties": {"repobilityId": "bdd3a89b552bec9a", "scanner": "scanner-primary", "fingerprint": "8e9e5f815e2ec13d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-95bdf37675780dee", "level": "note", "message": {"text": "Unused endpoint: POST /api/import/mp-sync/result"}, "properties": {"repobilityId": "4cf7a5de58ab5767", "scanner": "scanner-primary", "fingerprint": "95bdf37675780dee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-56351011afd8791f", "level": "note", "message": {"text": "Unused endpoint: POST /api/import/mp-sync/auto-run"}, "properties": {"repobilityId": "e68e2886c02010b2", "scanner": "scanner-primary", "fingerprint": "56351011afd8791f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cfb44b1ff06a8f3f", "level": "note", "message": {"text": "Unused endpoint: POST /api/import/commit"}, "properties": {"repobilityId": "f3cad5db5c0526ff", "scanner": "scanner-primary", "fingerprint": "cfb44b1ff06a8f3f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8334037c356a0602", "level": "note", "message": {"text": "Unused endpoint: POST /api/quotes/:id/transition"}, "properties": {"repobilityId": "bf43de58797e5eb8", "scanner": "scanner-primary", "fingerprint": "8334037c356a0602", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e6dd22882f4760fb", "level": "note", "message": {"text": "Unused endpoint: POST /api/sales/:id/transition"}, "properties": {"repobilityId": "4812d9554db0643a", "scanner": "scanner-primary", "fingerprint": "e6dd22882f4760fb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f357a042728bc93e", "level": "note", "message": {"text": "Unused endpoint: POST /api/sales/:id/payment-link"}, "properties": {"repobilityId": "726fb7d5a970611d", "scanner": "scanner-primary", "fingerprint": "f357a042728bc93e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2c911a93ffd592ee", "level": "note", "message": {"text": "Unused endpoint: GET /api/payment-links"}, "properties": {"repobilityId": "ddf543549e41856a", "scanner": "scanner-primary", "fingerprint": "2c911a93ffd592ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f943de63e1cafc63", "level": "note", "message": {"text": "Unused endpoint: GET /api/payment-links/:id"}, "properties": {"repobilityId": "e11cd490f975ed7a", "scanner": "scanner-primary", "fingerprint": "f943de63e1cafc63", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d1e45ee8d4fc652", "level": "note", "message": {"text": "Unused endpoint: POST /api/payment-links/:id/simulate-paid"}, "properties": {"repobilityId": "6727f0d6ab5831c3", "scanner": "scanner-primary", "fingerprint": "8d1e45ee8d4fc652", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}