{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-739f33a687f6f2c9", "name": "Possibly dead Python function: shot_home", "shortDescription": {"text": "Possibly dead Python function: shot_home"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4eb16d8a05e920db", "name": "Possibly dead Python function: shot_battle_result", "shortDescription": {"text": "Possibly dead Python function: shot_battle_result"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bad91e07a60a1b56", "name": "Possibly dead Python function: shot_codex", "shortDescription": {"text": "Possibly dead Python function: shot_codex"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc7076297eeb6d41", "name": "Possibly dead Python function: shot_today_plan", "shortDescription": {"text": "Possibly dead Python function: shot_today_plan"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92de798745483549", "name": "Possibly dead Python function: shot_learning_report", "shortDescription": {"text": "Possibly dead Python function: shot_learning_report"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdf9c6a06081d202", "name": "Possibly dead Python function: shot_wishlist_history", "shortDescription": {"text": "Possibly dead Python function: shot_wishlist_history"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-395975cd84aac5b3", "name": "Possibly dead Python function: shot_config_and_pack", "shortDescription": {"text": "Possibly dead Python function: shot_config_and_pack"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a319cc75b0b4bfb", "name": "Possibly dead Python function: shot_parent_pin_surface", "shortDescription": {"text": "Possibly dead Python function: shot_parent_pin_surface"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86133bca39a00722", "name": "Possibly dead Python function: shot_scan_binding", "shortDescription": {"text": "Possibly dead Python function: shot_scan_binding"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fb26d5d7b463cbd", "name": "Possibly dead Python function: shot_parent_admin", "shortDescription": {"text": "Possibly dead Python function: shot_parent_admin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc8b90c0fb32de36", "name": "Possibly dead Python function: shot_bound_device_if_any", "shortDescription": {"text": "Possibly dead Python function: shot_bound_device_if_any"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f3e18aef370da5a", "name": "Possibly dead Python function: shot_dev_menu_and_bypass", "shortDescription": {"text": "Possibly dead Python function: shot_dev_menu_and_bypass"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9145f5d7ad5ded36", "name": "Possibly dead Python function: current_user", "shortDescription": {"text": "Possibly dead Python function: current_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-606811cb50dc7f19", "name": "Possibly dead Python function: current_admin_user", "shortDescription": {"text": "Possibly dead Python function: current_admin_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5843ccc6ef082199", "name": "Possibly dead Python function: current_parent_user", "shortDescription": {"text": "Possibly dead Python function: current_parent_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13b73ef06f92505e", "name": "Possibly dead Python function: current_device_binding", "shortDescription": {"text": "Possibly dead Python function: current_device_binding"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46f758dc83b6d329", "name": "Possibly dead Python function: preview_alipay_callback_url", "shortDescription": {"text": "Possibly dead Python function: preview_alipay_callback_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a8a063352d083c4", "name": "Possibly dead Python function: delete_feedback", "shortDescription": {"text": "Possibly dead Python function: delete_feedback"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8ffd7adc0d5cd2d", "name": "Possibly dead Python function: is_selected_lesson_provider_configured", "shortDescription": {"text": "Possibly dead Python function: is_selected_lesson_provider_configured"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4956b85ad4228322", "name": "Possibly dead Python function: selected_lesson_provider_missing_message", "shortDescription": {"text": "Possibly dead Python function: selected_lesson_provider_missing_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-666aaee3c889a864", "name": "Possibly dead Python function: effective_lesson_provider_missing_message", "shortDescription": {"text": "Possibly dead Python function: effective_lesson_provider_missing_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00ebc05aa7b7335d", "name": "Possibly dead Python function: extract_json_payload_with_responses_provider", "shortDescription": {"text": "Possibly dead Python function: extract_json_payload_with_responses_provider"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ff2f6915891c8db", "name": "Possibly dead Python function: finish_path", "shortDescription": {"text": "Possibly dead Python function: finish_path"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8759140f3d1fc650", "name": "Possibly dead Python function: preview_wechat_callback_url", "shortDescription": {"text": "Possibly dead Python function: preview_wechat_callback_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dad540a2a82df9b0", "name": "Possibly dead Python function: format_audit_timestamp", "shortDescription": {"text": "Possibly dead Python function: format_audit_timestamp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df545cf48ad1cb43", "name": "Stray `console.log` in TS/JS \u2014 cocos/native/engine/harmonyos-next/entry/src/main/ets/common/Eventify.ts:145", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 cocos/native/engine/harmonyos-next/entry/src/main/ets/common/Eventify.ts:145"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7c71cbf93e3409e", "name": "Stray `console.log` in TS/JS \u2014 harmonyos/entry/src/main/ets/cocosvendor/common/Eventify.ts:145", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 harmonyos/entry/src/main/ets/cocosvendor/common/Eventify.ts:145"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b69f45b2dcff8d24", "name": "Dockerfile runs as root: server/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: server/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5519735ba27324e6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b37a753988ba5dd", "name": "Insecure pattern 'private_key_in_repo' in server/app/services/alipay_oauth_service.py:133", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in server/app/services/alipay_oauth_service.py:133"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-953f3624b18375ad", "name": "Insecure pattern 'node_child_process' in tools/recraft/svg-to-png.mjs:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in tools/recraft/svg-to-png.mjs:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e7f8d5633b5878d", "name": "Insecure pattern 'node_child_process' in .github/workflows/server-cloudbase-cd.yml:191", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/workflows/server-cloudbase-cd.yml:191"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbef6e53906ad1f7", "name": "Insecure pattern 'node_child_process' in .github/workflows/server-cd.yml:98", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/workflows/server-cd.yml:98"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ab6b22e9d419753", "name": "Insecure pattern 'node_child_process' in .github/workflows/server-ci.yml:277", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/workflows/server-ci.yml:277"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e15a239536f161bc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38ed1a1746d2c701", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36b318ba8ed770b6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02adb48ef17e5848", "name": "Very large file: server/tests/test_admin_pages.py (1409 lines)", "shortDescription": {"text": "Very large file: server/tests/test_admin_pages.py (1409 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4986b643f1a3e7a0", "name": "Very large file: server/app/routers/admin_pages.py (1865 lines)", "shortDescription": {"text": "Very large file: server/app/routers/admin_pages.py (1865 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 118 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 58 placeholder/mock markers across 12 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-abbf4a8869aaa6ae", "name": "Agent authority lacks a verifier contract: .cursor/skills/safe-command-policy/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/safe-command-policy/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be4b4b3d696aeb73", "name": "Agent instruction contains unpinned remote install: .cursor/skills/safe-command-policy/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .cursor/skills/safe-command-policy/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eabc5ba48888eec3", "name": "Agent authority lacks a verifier contract: .cursor/skills/vercel-trigger-cron/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/vercel-trigger-cron/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1189c257b386377", "name": "Agent authority lacks a verifier contract: .cursor/skills/vercel-prune-deployments/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/vercel-prune-deployments/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ab7b6b3684bd832", "name": "Agent authority lacks a verifier contract: .cursor/skills/recraft-v4-vector/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/recraft-v4-vector/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efd2eddf743cfddd", "name": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-security-expert/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-security-expert/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4dd11f88732b2d13", "name": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-platform-integrator/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-platform-integrator/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-44ccea5a860612f6", "name": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-backend-integrator/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-backend-integrator/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc2edf71ae435a09", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_harmony_screenshots.py:52", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_harmony_screenshots.py:52"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6514641628a2988", "name": "Legacy-named symbol `words_v1` in server/mock_ui_server.py:78", "shortDescription": {"text": "Legacy-named symbol `words_v1` in server/mock_ui_server.py:78"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bfe3f0e96fa78c3", "name": "Commented-code block (6 lines) in server/mock_ui_server.py:128", "shortDescription": {"text": "Commented-code block (6 lines) in server/mock_ui_server.py:128"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-329058f01a5bc542", "name": "Legacy-named symbol `refreshed_old` in server/tests/test_redemption_flow.py:316", "shortDescription": {"text": "Legacy-named symbol `refreshed_old` in server/tests/test_redemption_flow.py:316"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0246277dd61d1b2", "name": "Legacy-named symbol `admin_family_pack_copy` in server/tests/test_admin_pages.py:546", "shortDescription": {"text": "Legacy-named symbol `admin_family_pack_copy` in server/tests/test_admin_pages.py:546"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d33a6d1e69c7a708", "name": "Legacy-named symbol `test_pack_with_distractors_is_schema_v2` in server/tests/test_pack_schema_v2.py:35", "shortDescription": {"text": "Legacy-named symbol `test_pack_with_distractors_is_schema_v2` in server/tests/test_pack_schema_v2.py:35"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0b24facbe740ef1", "name": "Legacy-named symbol `test_pack_with_no_category_rows_stays_at_v1` in server/tests/test_pack_schema_v4.py:113", "shortDescription": {"text": "Legacy-named symbol `test_pack_with_no_category_rows_stays_at_v1` in server/tests/test_pack_schema_v4.py:113"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f44e9eed26fc3ee9", "name": "Legacy-named symbol `fake_old` in server/tests/test_e2e_drop_old_pr_dbs.py:55", "shortDescription": {"text": "Legacy-named symbol `fake_old` in server/tests/test_e2e_drop_old_pr_dbs.py:55"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-930b92166d72f500", "name": "Legacy-named symbol `test_pending_token_marked_expired_by_expire_old` in server/tests/test_pair_flow.py:290", "shortDescription": {"text": "Legacy-named symbol `test_pending_token_marked_expired_by_expire_old` in server/tests/test_pair_flow.py:290"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-009ee81321197103", "name": "Legacy-named symbol `test_admin_split_global_draft_copy` in server/tests/test_admin_global_pack_router.py:273", "shortDescription": {"text": "Legacy-named symbol `test_admin_split_global_draft_copy` in server/tests/test_admin_global_pack_router.py:273"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73e2b83b4bf2f5d0", "name": "Commented-code block (5 lines) in server/tests/test_admin_llm_endpoint.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in server/tests/test_admin_llm_endpoint.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2993ef21d194ca2", "name": "Commented-code block (8 lines) in server/tests/e2e/conftest.py:56", "shortDescription": {"text": "Commented-code block (8 lines) in server/tests/e2e/conftest.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6becd00f5e14cc4e", "name": "Legacy-named symbol `publish_v1` in server/tests/e2e/test_parent_family_pack_e2e.py:150", "shortDescription": {"text": "Legacy-named symbol `publish_v1` in server/tests/e2e/test_parent_family_pack_e2e.py:150"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91759982f2f9103b", "name": "Commented-code block (5 lines) in server/tests/e2e/_utils/auth.py:123", "shortDescription": {"text": "Commented-code block (5 lines) in server/tests/e2e/_utils/auth.py:123"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd3946561fb62a6f", "name": "Commented-code block (5 lines) in server/tests/e2e/_utils/vercel.py:49", "shortDescription": {"text": "Commented-code block (5 lines) in server/tests/e2e/_utils/vercel.py:49"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-efc1894cfcf273e0", "name": "Legacy-named symbol `words_v1` in server/scripts/e2e_reset_db.py:72", "shortDescription": {"text": "Legacy-named symbol `words_v1` in server/scripts/e2e_reset_db.py:72"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69f321bd83587c41", "name": "Legacy-named symbol `words_v1` in server/scripts/seed_from_rawfile.py:3", "shortDescription": {"text": "Legacy-named symbol `words_v1` in server/scripts/seed_from_rawfile.py:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-456c029e9e25ddc0", "name": "Commented-code block (5 lines) in server/app/config.py:10", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/config.py:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a22a5aa8eb8c6726", "name": "Commented-code block (5 lines) in server/app/models/word_pack.py:23", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/models/word_pack.py:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b4d767498a782e86", "name": "Legacy-named symbol `schema_v1` in server/app/services/pack_service.py:196", "shortDescription": {"text": "Legacy-named symbol `schema_v1` in server/app/services/pack_service.py:196"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1117414b109978a5", "name": "Legacy-named symbol `words_v1` in server/app/services/parent_report_service.py:329", "shortDescription": {"text": "Legacy-named symbol `words_v1` in server/app/services/parent_report_service.py:329"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0377fcd79d5b82a", "name": "Commented-code block (6 lines) in server/app/services/pair_service.py:34", "shortDescription": {"text": "Commented-code block (6 lines) in server/app/services/pair_service.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3f566648a1720b1", "name": "Legacy-named symbol `admin_family_pack_copy` in server/app/services/admin_console_service.py:514", "shortDescription": {"text": "Legacy-named symbol `admin_family_pack_copy` in server/app/services/admin_console_service.py:514"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26bd3e1855d054f5", "name": "Commented-code block (5 lines) in server/app/services/word_stats_sync_service.py:169", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/services/word_stats_sync_service.py:169"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f2472cd2e0eb18b", "name": "Commented-code block (8 lines) in server/app/services/lesson_service.py:25", "shortDescription": {"text": "Commented-code block (8 lines) in server/app/services/lesson_service.py:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d586cf0296048146", "name": "Legacy-named symbol `gpk_split_copy` in server/app/routers/admin_pages.py:150", "shortDescription": {"text": "Legacy-named symbol `gpk_split_copy` in server/app/routers/admin_pages.py:150"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70d60905716d0c21", "name": "Commented-code block (5 lines) in server/app/routers/admin_cron.py:68", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/routers/admin_cron.py:68"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6b074d9f04855859", "name": "Commented-code block (6 lines) in tools/generate_scan_binding_qr_fixture.py:22", "shortDescription": {"text": "Commented-code block (6 lines) in tools/generate_scan_binding_qr_fixture.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31de4b6165a0dc3d", "name": "Network/subprocess call without timeout or try/except \u2014 tools/gap_detector/runners/commands.py:66", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/gap_detector/runners/commands.py:66"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8c275390ac3c204", "name": "`fetch()` without try/.catch or AbortSignal \u2014 tools/recraft/generate-v4-vector.mjs:111", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/recraft/generate-v4-vector.mjs:111"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-909b63da3c77213d", "name": "Commented-code block (6 lines) in tools/recraft/strip-svg-canvas.mjs:2", "shortDescription": {"text": "Commented-code block (6 lines) in tools/recraft/strip-svg-canvas.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-695698b73af5a909", "name": "Commented-code block (6 lines) in tools/recraft/svg-to-png.mjs:2", "shortDescription": {"text": "Commented-code block (6 lines) in tools/recraft/svg-to-png.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bac293174c98502b", "name": "Network/subprocess call without timeout or try/except \u2014 tools/parity_scout/doctor.py:83", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/parity_scout/doctor.py:83"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-789bf6bd56f00458", "name": "Commented-code block (6 lines) in cocos/tests/transportPathSync.test.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in cocos/tests/transportPathSync.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ba53a910b8f40b5", "name": "Commented-code block (6 lines) in cocos/assets/scripts/BattleSceneController.ts:59", "shortDescription": {"text": "Commented-code block (6 lines) in cocos/assets/scripts/BattleSceneController.ts:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f519af64618a9387", "name": "Commented-code block (5 lines) in cocos/assets/scripts/ui/resolutionPolicy.ts:29", "shortDescription": {"text": "Commented-code block (5 lines) in cocos/assets/scripts/ui/resolutionPolicy.ts:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29bcbaa774394173", "name": "Commented-code block (8 lines) in cocos/assets/scripts/ui/QuestionPanel.ts:1", "shortDescription": {"text": "Commented-code block (8 lines) in cocos/assets/scripts/ui/QuestionPanel.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52eb1bf061e03e99", "name": "Commented-code block (14 lines) in cocos/assets/scripts/bridge/transport.ts:7", "shortDescription": {"text": "Commented-code block (14 lines) in cocos/assets/scripts/bridge/transport.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver/mock_ui_server.py:admin_approve_draft, server/mock_ui_server.py:admin_reject_draft\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver/mock_ui_server.py:child_me, server/mock_ui_server.py:child_pull_word_stats, server/mock_ui_server.py:child_wishlist, server/mock_ui_server.py:child_list_redemptions\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver/mock_ui_server.py:child_sync_word_stats, server/mock_ui_server.py:child_wishlist_sync_custom, server/mock_ui_server.py:child_create_redemption\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-420e0ad4204d1651", "name": "FastAPI POST `admin_publish_pack` without auth dependency \u2014 server/mock_ui_server.py:548", "shortDescription": {"text": "FastAPI POST `admin_publish_pack` without auth dependency \u2014 server/mock_ui_server.py:548"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1fbdd78d8825e22f", "name": "FastAPI PATCH `admin_patch_draft` without auth dependency \u2014 server/mock_ui_server.py:616", "shortDescription": {"text": "FastAPI PATCH `admin_patch_draft` without auth dependency \u2014 server/mock_ui_server.py:616"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c6143f4245cf032", "name": "FastAPI PUT `admin_patch_draft` without auth dependency \u2014 server/mock_ui_server.py:617", "shortDescription": {"text": "FastAPI PUT `admin_patch_draft` without auth dependency \u2014 server/mock_ui_server.py:617"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53e0f71d540a0c97", "name": "FastAPI POST `admin_approve_draft` without auth dependency \u2014 server/mock_ui_server.py:641", "shortDescription": {"text": "FastAPI POST `admin_approve_draft` without auth dependency \u2014 server/mock_ui_server.py:641"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31c7fab84e7ca020", "name": "FastAPI POST `admin_reject_draft` without auth dependency \u2014 server/mock_ui_server.py:674", "shortDescription": {"text": "FastAPI POST `admin_reject_draft` without auth dependency \u2014 server/mock_ui_server.py:674"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4a08afa071da5b6c", "name": "FastAPI POST `admin_import_lesson` without auth dependency \u2014 server/mock_ui_server.py:694", "shortDescription": {"text": "FastAPI POST `admin_import_lesson` without auth dependency \u2014 server/mock_ui_server.py:694"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb39bcc54ed6c9a0", "name": "FastAPI POST `pair_redeem` without auth dependency \u2014 server/mock_ui_server.py:739", "shortDescription": {"text": "FastAPI POST `pair_redeem` without auth dependency \u2014 server/mock_ui_server.py:739"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d41941c5f76a62e2", "name": "FastAPI POST `child_unbind` without auth dependency \u2014 server/mock_ui_server.py:766", "shortDescription": {"text": "FastAPI POST `child_unbind` without auth dependency \u2014 server/mock_ui_server.py:766"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cb17805a65ceea4e", "name": "FastAPI PUT `child_profile_put` without auth dependency \u2014 server/mock_ui_server.py:803", "shortDescription": {"text": "FastAPI PUT `child_profile_put` without auth dependency \u2014 server/mock_ui_server.py:803"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73d907510feb8a8a", "name": "FastAPI POST `child_sync_word_stats` without auth dependency \u2014 server/mock_ui_server.py:948", "shortDescription": {"text": "FastAPI POST `child_sync_word_stats` without auth dependency \u2014 server/mock_ui_server.py:948"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a092e325f82654c", "name": "FastAPI POST `child_wishlist_sync_custom` without auth dependency \u2014 server/mock_ui_server.py:998", "shortDescription": {"text": "FastAPI POST `child_wishlist_sync_custom` without auth dependency \u2014 server/mock_ui_server.py:998"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d681eb33f6665fd9", "name": "FastAPI POST `child_create_redemption` without auth dependency \u2014 server/mock_ui_server.py:1009", "shortDescription": {"text": "FastAPI POST `child_create_redemption` without auth dependency \u2014 server/mock_ui_server.py:1009"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8c1d0e12fd0951e", "name": "FastAPI POST `admin_login_post` without auth dependency \u2014 server/app/routers/admin_pages.py:327", "shortDescription": {"text": "FastAPI POST `admin_login_post` without auth dependency \u2014 server/app/routers/admin_pages.py:327"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c4c197a6fd8583c", "name": "FastAPI POST `admin_logout` without auth dependency \u2014 server/app/routers/admin_pages.py:365", "shortDescription": {"text": "FastAPI POST `admin_logout` without auth dependency \u2014 server/app/routers/admin_pages.py:365"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df688e5d723f53aa", "name": "FastAPI POST `admin_system_config_llm_provider_post` without auth dependency \u2014 server/app/routers/admin_pages.py:413", "shortDescription": {"text": "FastAPI POST `admin_system_config_llm_provider_post` without auth dependency \u2014 server/app/routers/admin_pages.py:413"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4d5dc77d03e485ef", "name": "FastAPI POST `admin_system_config_llm_provider_test_post` without auth dependency \u2014 server/app/routers/admin_pages.py:45", "shortDescription": {"text": "FastAPI POST `admin_system_config_llm_provider_test_post` without auth dependency \u2014 server/app/routers/admin_pages.py:451"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22901a6131a322c4", "name": "FastAPI POST `admin_system_config_image_provider_post` without auth dependency \u2014 server/app/routers/admin_pages.py:484", "shortDescription": {"text": "FastAPI POST `admin_system_config_image_provider_post` without auth dependency \u2014 server/app/routers/admin_pages.py:484"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc8a54932731cc3c", "name": "FastAPI POST `admin_system_config_image_provider_test_post` without auth dependency \u2014 server/app/routers/admin_pages.py:", "shortDescription": {"text": "FastAPI POST `admin_system_config_image_provider_test_post` without auth dependency \u2014 server/app/routers/admin_pages.py:522"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf241db74d1017a1", "name": "FastAPI POST `admin_feedback_reply` without auth dependency \u2014 server/app/routers/admin_pages.py:577", "shortDescription": {"text": "FastAPI POST `admin_feedback_reply` without auth dependency \u2014 server/app/routers/admin_pages.py:577"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0be1fd014f46c4fa", "name": "FastAPI POST `admin_feedback_delete` without auth dependency \u2014 server/app/routers/admin_pages.py:609", "shortDescription": {"text": "FastAPI POST `admin_feedback_delete` without auth dependency \u2014 server/app/routers/admin_pages.py:609"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ee80d2be22d7796", "name": "FastAPI POST `admin_parent_suspend` without auth dependency \u2014 server/app/routers/admin_pages.py:685", "shortDescription": {"text": "FastAPI POST `admin_parent_suspend` without auth dependency \u2014 server/app/routers/admin_pages.py:685"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-adad67057920eeba", "name": "FastAPI POST `admin_parent_restore` without auth dependency \u2014 server/app/routers/admin_pages.py:710", "shortDescription": {"text": "FastAPI POST `admin_parent_restore` without auth dependency \u2014 server/app/routers/admin_pages.py:710"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d1b47345df7b603", "name": "FastAPI POST `admin_device_revoke_post` without auth dependency \u2014 server/app/routers/admin_pages.py:789", "shortDescription": {"text": "FastAPI POST `admin_device_revoke_post` without auth dependency \u2014 server/app/routers/admin_pages.py:789"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f154407dcb43b94d", "name": "FastAPI POST `admin_device_restore_post` without auth dependency \u2014 server/app/routers/admin_pages.py:834", "shortDescription": {"text": "FastAPI POST `admin_device_restore_post` without auth dependency \u2014 server/app/routers/admin_pages.py:834"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b4539cfe7ad41dae", "name": "FastAPI POST `admin_global_pack_create_post` without auth dependency \u2014 server/app/routers/admin_pages.py:894", "shortDescription": {"text": "FastAPI POST `admin_global_pack_create_post` without auth dependency \u2014 server/app/routers/admin_pages.py:894"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e46ca656fa540eac", "name": "FastAPI POST `admin_global_pack_import_image_post` without auth dependency \u2014 server/app/routers/admin_pages.py:925", "shortDescription": {"text": "FastAPI POST `admin_global_pack_import_image_post` without auth dependency \u2014 server/app/routers/admin_pages.py:925"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c889cd941d1bc3ab", "name": "FastAPI POST `admin_global_publish_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1011", "shortDescription": {"text": "FastAPI POST `admin_global_publish_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1011"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c47caa93d0b9c7d", "name": "FastAPI POST `admin_global_rollback_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1032", "shortDescription": {"text": "FastAPI POST `admin_global_rollback_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1032"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8b186e84975f467", "name": "FastAPI POST `admin_global_pack_detail_import_image_post` without auth dependency \u2014 server/app/routers/admin_pages.py:10", "shortDescription": {"text": "FastAPI POST `admin_global_pack_detail_import_image_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1088"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f45e6e968473c1a0", "name": "FastAPI POST `admin_global_pack_metadata_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1167", "shortDescription": {"text": "FastAPI POST `admin_global_pack_metadata_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1167"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e727a332abeab786", "name": "FastAPI POST `admin_global_pack_story_generate_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1207", "shortDescription": {"text": "FastAPI POST `admin_global_pack_story_generate_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1207"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f0935534bfe13338", "name": "FastAPI POST `admin_global_pack_cover_generate_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1257", "shortDescription": {"text": "FastAPI POST `admin_global_pack_cover_generate_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1257"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b07b39e75c8e6b09", "name": "FastAPI POST `admin_global_pack_publish_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:129", "shortDescription": {"text": "FastAPI POST `admin_global_pack_publish_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1298"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22e239a0a4a445aa", "name": "FastAPI POST `admin_global_pack_rollback_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:13", "shortDescription": {"text": "FastAPI POST `admin_global_pack_rollback_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1330"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c5bca3232f15bc7", "name": "FastAPI POST `admin_global_pack_delete_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1362", "shortDescription": {"text": "FastAPI POST `admin_global_pack_delete_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1362"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8fb5120eb4ddc710", "name": "FastAPI POST `admin_global_pack_draft_create_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1394", "shortDescription": {"text": "FastAPI POST `admin_global_pack_draft_create_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1394"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9351425f905b0392", "name": "FastAPI POST `admin_global_pack_draft_save_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1499", "shortDescription": {"text": "FastAPI POST `admin_global_pack_draft_save_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1499"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-93e490d9a94843de", "name": "FastAPI POST `admin_global_pack_draft_delete_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1542", "shortDescription": {"text": "FastAPI POST `admin_global_pack_draft_delete_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1542"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6da46e84d40899cd", "name": "FastAPI POST `admin_global_pack_draft_split_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1568", "shortDescription": {"text": "FastAPI POST `admin_global_pack_draft_split_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1568"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-756bff44c9bc7ff2", "name": "FastAPI POST `admin_family_unarchive_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1703", "shortDescription": {"text": "FastAPI POST `admin_family_unarchive_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1703"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0cf4fe6dffeb64b9", "name": "FastAPI POST `admin_family_rollback_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1728", "shortDescription": {"text": "FastAPI POST `admin_family_rollback_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1728"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35198f51a864d4f1", "name": "FastAPI POST `admin_family_delete_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1753", "shortDescription": {"text": "FastAPI POST `admin_family_delete_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1753"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a528d83154b5417", "name": "FastAPI POST `admin_family_copy_to_global_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1778", "shortDescription": {"text": "FastAPI POST `admin_family_copy_to_global_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1778"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f3aa6b650ebdaf31", "name": "FastAPI POST `admin_family_copy_to_family_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1807", "shortDescription": {"text": "FastAPI POST `admin_family_copy_to_family_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1807"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1ca8b0999d62ccc", "name": "FastAPI POST `post_oauth_bind_email_request_code` without auth dependency \u2014 server/app/routers/parent_pages.py:256", "shortDescription": {"text": "FastAPI POST `post_oauth_bind_email_request_code` without auth dependency \u2014 server/app/routers/parent_pages.py:256"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-918b39debb4c9b4d", "name": "FastAPI POST `post_oauth_bind_email_verify_code` without auth dependency \u2014 server/app/routers/parent_pages.py:299", "shortDescription": {"text": "FastAPI POST `post_oauth_bind_email_verify_code` without auth dependency \u2014 server/app/routers/parent_pages.py:299"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6379b5b6a4ea3240", "name": "FastAPI POST `post_request_code_form` without auth dependency \u2014 server/app/routers/parent_pages.py:421", "shortDescription": {"text": "FastAPI POST `post_request_code_form` without auth dependency \u2014 server/app/routers/parent_pages.py:421"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33c3aaddc0a3bed0", "name": "FastAPI POST `post_verify_code_form` without auth dependency \u2014 server/app/routers/parent_pages.py:448", "shortDescription": {"text": "FastAPI POST `post_verify_code_form` without auth dependency \u2014 server/app/routers/parent_pages.py:448"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e90bee85a2ccf075", "name": "FastAPI POST `post_password_login_form` without auth dependency \u2014 server/app/routers/parent_pages.py:527", "shortDescription": {"text": "FastAPI POST `post_password_login_form` without auth dependency \u2014 server/app/routers/parent_pages.py:527"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e9c54e12f5adf699", "name": "FastAPI POST `post_logout_form` without auth dependency \u2014 server/app/routers/parent_pages.py:590", "shortDescription": {"text": "FastAPI POST `post_logout_form` without auth dependency \u2014 server/app/routers/parent_pages.py:590"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32231ebd63f47cad", "name": "FastAPI POST `extract_pending` without auth dependency \u2014 server/app/routers/admin_cron.py:166", "shortDescription": {"text": "FastAPI POST `extract_pending` without auth dependency \u2014 server/app/routers/admin_cron.py:166"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46cef1c7bff1a4f3", "name": "FastAPI POST `create_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:223", "shortDescription": {"text": "FastAPI POST `create_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:223"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46732b6d93a825c1", "name": "FastAPI POST `update_pack_metadata_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:245", "shortDescription": {"text": "FastAPI POST `update_pack_metadata_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:245"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6b5e504727f9fa93", "name": "FastAPI POST `generate_pack_story_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:290", "shortDescription": {"text": "FastAPI POST `generate_pack_story_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:290"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47fccc03d1a957c9", "name": "FastAPI POST `generate_pack_cover_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:335", "shortDescription": {"text": "FastAPI POST `generate_pack_cover_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:335"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e9060d5d1944f8b", "name": "FastAPI POST `delete_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:375", "shortDescription": {"text": "FastAPI POST `delete_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:375"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-297b5fb0a3b55207", "name": "FastAPI POST `import_image_submit` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:424", "shortDescription": {"text": "FastAPI POST `import_image_submit` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:424"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-249eaa4dee83ade8", "name": "FastAPI POST `publish_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:516", "shortDescription": {"text": "FastAPI POST `publish_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:516"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e559ed7715280c47", "name": "FastAPI POST `rollback_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:562", "shortDescription": {"text": "FastAPI POST `rollback_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:562"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2293d5aafdd6adb8", "name": "FastAPI POST `draft_add_custom_word` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:588", "shortDescription": {"text": "FastAPI POST `draft_add_custom_word` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:588"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c7279a5947291cec", "name": "FastAPI POST `draft_delete_word` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:654", "shortDescription": {"text": "FastAPI POST `draft_delete_word` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:654"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc2068797272f8b0", "name": "FastAPI POST `draft_batch_delete_words` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:677", "shortDescription": {"text": "FastAPI POST `draft_batch_delete_words` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:677"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7470aa749ce5e5d4", "name": "FastAPI POST `draft_split_words` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:708", "shortDescription": {"text": "FastAPI POST `draft_split_words` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:708"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e28faac202f89b2", "name": "FastAPI POST `draft_batch_json` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:761", "shortDescription": {"text": "FastAPI POST `draft_batch_json` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:761"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed7eeca86c14e434", "name": "FastAPI POST `draft_edit_submit` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:852", "shortDescription": {"text": "FastAPI POST `draft_edit_submit` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:852"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-534b171ab3e5f279", "name": "FastAPI POST `import_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:79", "shortDescription": {"text": "FastAPI POST `import_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:79"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2ac599e287cc5d7a", "name": "FastAPI PATCH `patch_lesson_draft` without auth dependency \u2014 server/app/routers/family_lessons.py:192", "shortDescription": {"text": "FastAPI PATCH `patch_lesson_draft` without auth dependency \u2014 server/app/routers/family_lessons.py:192"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d2591ba9b7e9779f", "name": "FastAPI PUT `patch_lesson_draft` without auth dependency \u2014 server/app/routers/family_lessons.py:193", "shortDescription": {"text": "FastAPI PUT `patch_lesson_draft` without auth dependency \u2014 server/app/routers/family_lessons.py:193"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a9dd90a48bb847d2", "name": "FastAPI POST `approve_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:206", "shortDescription": {"text": "FastAPI POST `approve_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:206"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec1ca36fef57aca7", "name": "FastAPI POST `reject_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:258", "shortDescription": {"text": "FastAPI POST `reject_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:258"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8144a29989bde33", "name": "FastAPI POST `generate_distractors_endpoint` without auth dependency \u2014 server/app/routers/admin_drafts.py:120", "shortDescription": {"text": "FastAPI POST `generate_distractors_endpoint` without auth dependency \u2014 server/app/routers/admin_drafts.py:120"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df7d85686d6cd456", "name": "FastAPI POST `generate_example_endpoint` without auth dependency \u2014 server/app/routers/admin_drafts.py:130", "shortDescription": {"text": "FastAPI POST `generate_example_endpoint` without auth dependency \u2014 server/app/routers/admin_drafts.py:130"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84a69f14a42f3d6d", "name": "FastAPI PATCH `patch_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:208", "shortDescription": {"text": "FastAPI PATCH `patch_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:208"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8260e255f4acd5dd", "name": "FastAPI POST `approve_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:220", "shortDescription": {"text": "FastAPI POST `approve_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:220"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c829dc9d93d8c9e7", "name": "FastAPI POST `reject_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:249", "shortDescription": {"text": "FastAPI POST `reject_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:249"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e10541c1da8b26fa", "name": "FastAPI POST `create_category` without auth dependency \u2014 server/app/routers/admin_categories.py:60", "shortDescription": {"text": "FastAPI POST `create_category` without auth dependency \u2014 server/app/routers/admin_categories.py:60"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-29eda9dc5a447f12", "name": "FastAPI PUT `update_category` without auth dependency \u2014 server/app/routers/admin_categories.py:83", "shortDescription": {"text": "FastAPI PUT `update_category` without auth dependency \u2014 server/app/routers/admin_categories.py:83"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66bc3ed6d01e46b7", "name": "FastAPI DELETE `delete_category` without auth dependency \u2014 server/app/routers/admin_categories.py:103", "shortDescription": {"text": "FastAPI DELETE `delete_category` without auth dependency \u2014 server/app/routers/admin_categories.py:103"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0acf9eae732115e0", "name": "FastAPI POST `upload_illustration` without auth dependency \u2014 server/app/routers/admin_assets.py:51", "shortDescription": {"text": "FastAPI POST `upload_illustration` without auth dependency \u2014 server/app/routers/admin_assets.py:51"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7ddf9263cd6efe1", "name": "FastAPI DELETE `delete_illustration` without auth dependency \u2014 server/app/routers/admin_assets.py:92", "shortDescription": {"text": "FastAPI DELETE `delete_illustration` without auth dependency \u2014 server/app/routers/admin_assets.py:92"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a02bd38c02bcc499", "name": "FastAPI POST `upload_audio` without auth dependency \u2014 server/app/routers/admin_assets.py:108", "shortDescription": {"text": "FastAPI POST `upload_audio` without auth dependency \u2014 server/app/routers/admin_assets.py:108"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0df0b82718e297bf", "name": "FastAPI DELETE `delete_audio` without auth dependency \u2014 server/app/routers/admin_assets.py:145", "shortDescription": {"text": "FastAPI DELETE `delete_audio` without auth dependency \u2014 server/app/routers/admin_assets.py:145"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e3ba7fa99b53335f", "name": "FastAPI POST `publish_pack_endpoint` without auth dependency \u2014 server/app/routers/admin_packs.py:88", "shortDescription": {"text": "FastAPI POST `publish_pack_endpoint` without auth dependency \u2014 server/app/routers/admin_packs.py:88"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f83ed71d3ebf89e1", "name": "FastAPI POST `rollback_pack_endpoint` without auth dependency \u2014 server/app/routers/admin_packs.py:105", "shortDescription": {"text": "FastAPI POST `rollback_pack_endpoint` without auth dependency \u2014 server/app/routers/admin_packs.py:105"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b2819204c6945ec", "name": "FastAPI POST `sync_word_stats` without auth dependency \u2014 server/app/routers/child_word_stats.py:40", "shortDescription": {"text": "FastAPI POST `sync_word_stats` without auth dependency \u2014 server/app/routers/child_word_stats.py:40"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91474a2578756279", "name": "FastAPI PUT `put_self_profile` without auth dependency \u2014 server/app/routers/child_profile.py:34", "shortDescription": {"text": "FastAPI PUT `put_self_profile` without auth dependency \u2014 server/app/routers/child_profile.py:34"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-909742074c87310b", "name": "FastAPI POST `create_word` without auth dependency \u2014 server/app/routers/admin_words.py:98", "shortDescription": {"text": "FastAPI POST `create_word` without auth dependency \u2014 server/app/routers/admin_words.py:98"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e25d5ce50065906", "name": "FastAPI PUT `update_word` without auth dependency \u2014 server/app/routers/admin_words.py:125", "shortDescription": {"text": "FastAPI PUT `update_word` without auth dependency \u2014 server/app/routers/admin_words.py:125"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-deae5bcff814d6cc", "name": "FastAPI DELETE `soft_delete_word` without auth dependency \u2014 server/app/routers/admin_words.py:144", "shortDescription": {"text": "FastAPI DELETE `soft_delete_word` without auth dependency \u2014 server/app/routers/admin_words.py:144"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67cdfd8cfebec748", "name": "FastAPI POST `scan_words` without auth dependency \u2014 server/app/routers/admin_llm.py:31", "shortDescription": {"text": "FastAPI POST `scan_words` without auth dependency \u2014 server/app/routers/admin_llm.py:31"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41a1592aa6eac631", "name": "FastAPI POST `post_password_login` without auth dependency \u2014 server/app/routers/parent_auth.py:68", "shortDescription": {"text": "FastAPI POST `post_password_login` without auth dependency \u2014 server/app/routers/parent_auth.py:68"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f4d7b0762de0a76", "name": "FastAPI POST `post_request_code` without auth dependency \u2014 server/app/routers/parent_auth.py:114", "shortDescription": {"text": "FastAPI POST `post_request_code` without auth dependency \u2014 server/app/routers/parent_auth.py:114"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34333360cf9279d6", "name": "FastAPI POST `post_verify_code` without auth dependency \u2014 server/app/routers/parent_auth.py:146", "shortDescription": {"text": "FastAPI POST `post_verify_code` without auth dependency \u2014 server/app/routers/parent_auth.py:146"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e6d43174873d7f2d", "name": "FastAPI POST `post_logout` without auth dependency \u2014 server/app/routers/parent_auth.py:224", "shortDescription": {"text": "FastAPI POST `post_logout` without auth dependency \u2014 server/app/routers/parent_auth.py:224"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b4fbdfcf5e67616", "name": "FastAPI POST `sync_checkins` without auth dependency \u2014 server/app/routers/child_checkins.py:20", "shortDescription": {"text": "FastAPI POST `sync_checkins` without auth dependency \u2014 server/app/routers/child_checkins.py:20"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6536f5fa1e9fab18", "name": "FastAPI POST `sync_custom` without auth dependency \u2014 server/app/routers/child_wishlist.py:89", "shortDescription": {"text": "FastAPI POST `sync_custom` without auth dependency \u2014 server/app/routers/child_wishlist.py:89"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2998e6d9ee7da625", "name": "FastAPI POST `submit_redemption` without auth dependency \u2014 server/app/routers/child_wishlist.py:110", "shortDescription": {"text": "FastAPI POST `submit_redemption` without auth dependency \u2014 server/app/routers/child_wishlist.py:110"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1576fa491f69cfab", "name": "FastAPI POST `post_unbind` without auth dependency \u2014 server/app/routers/child_wishlist.py:185", "shortDescription": {"text": "FastAPI POST `post_unbind` without auth dependency \u2014 server/app/routers/child_wishlist.py:185"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5dcc1118d953c6b2", "name": "Unused endpoint: GET /api/v1/public/health", "shortDescription": {"text": "Unused endpoint: GET /api/v1/public/health"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/public/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2504727ec901d96a", "name": "Unused endpoint: GET /api/v1/public/packs/latest.json", "shortDescription": {"text": "Unused endpoint: GET /api/v1/public/packs/latest.json"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/public/packs/latest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4d528a10f4c85bf", "name": "Unused endpoint: GET /api/v1/public/global-packs/latest.json", "shortDescription": {"text": "Unused endpoint: GET /api/v1/public/global-packs/latest.json"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/public/global-packs/latest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9507f87ba515ba", "name": "Unused endpoint: GET /api/v1/admin/stats", "shortDescription": {"text": "Unused endpoint: GET /api/v1/admin/stats"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/admin/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d4d725cd9ebff8b", "name": "Unused endpoint: POST /api/v1/admin/packs/publish", "shortDescription": {"text": "Unused endpoint: POST /api/v1/admin/packs/publish"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/admin/packs/publish` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ac5a2d7025b0f4a", "name": "Unused endpoint: GET /api/v1/family/{family_id}/lesson-drafts", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/lesson-drafts"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/lesson-drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73a3c748a9a68e19", "name": "Unused endpoint: GET /api/v1/family/{family_id}/lesson-drafts/{draft_id}", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/lesson-drafts/{draft_id}"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/lesson-drafts/{draft_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4473ed7091330700", "name": "Unused endpoint: PATCH /api/v1/family/{family_id}/lesson-drafts/{draft_id}", "shortDescription": {"text": "Unused endpoint: PATCH /api/v1/family/{family_id}/lesson-drafts/{draft_id}"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `PATCH /api/v1/family/{family_id}/lesson-drafts/{draft_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84c94297915793ae", "name": "Unused endpoint: PUT /api/v1/family/{family_id}/lesson-drafts/{draft_id}", "shortDescription": {"text": "Unused endpoint: PUT /api/v1/family/{family_id}/lesson-drafts/{draft_id}"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `PUT /api/v1/family/{family_id}/lesson-drafts/{draft_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f48a852b082f6d56", "name": "Unused endpoint: POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/approve"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bc5e43958e4efff", "name": "Unused endpoint: POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/reject", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/reject"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08873464ace25055", "name": "Unused endpoint: POST /api/v1/family/{family_id}/lessons/import", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/lessons/import"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/lessons/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40d0c2bbb5abf440", "name": "Unused endpoint: POST /api/v1/public/pair/redeem", "shortDescription": {"text": "Unused endpoint: POST /api/v1/public/pair/redeem"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/public/pair/redeem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-358c97faf54a7428", "name": "Unused endpoint: POST /api/v1/family/{family_id}/unbind", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/unbind"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/unbind` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa00a848a43771b5", "name": "Unused endpoint: GET /api/v1/family/{family_id}/me", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/me"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d1059ef46d1cd94", "name": "Unused endpoint: PUT /api/v1/family/{family_id}/profile", "shortDescription": {"text": "Unused endpoint: PUT /api/v1/family/{family_id}/profile"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `PUT /api/v1/family/{family_id}/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48d5a02ca6b18e76", "name": "Unused endpoint: GET /api/v1/family/_/family-packs/latest.json", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/_/family-packs/latest.json"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/_/family-packs/latest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a944a23e581eb73e", "name": "Unused endpoint: GET /api/v1/family/{family_id}/family-packs/latest.json", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/family-packs/latest.json"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/family-packs/latest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f00e730c04b7d5a", "name": "Unused endpoint: GET /api/v1/family/_/packs/latest.json", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/_/packs/latest.json"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/_/packs/latest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcf2ae10791aa255", "name": "Unused endpoint: GET /api/v1/family/{family_id}/packs/latest.json", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/packs/latest.json"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/packs/latest.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4dcabcbe58829ad0", "name": "Unused endpoint: POST /api/v1/family/{family_id}/word-stats/sync", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/word-stats/sync"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/word-stats/sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56179ff0955aa703", "name": "Unused endpoint: GET /api/v1/family/{family_id}/word-stats", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/word-stats"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/word-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6541ef69a343bf8e", "name": "Unused endpoint: GET /api/v1/family/{family_id}/wishlist", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/wishlist"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/wishlist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fed968798097e3d9", "name": "Unused endpoint: POST /api/v1/family/{family_id}/wishlist/sync-custom", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/wishlist/sync-custom"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/wishlist/sync-custom` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d9ef6dfd360c690", "name": "Unused endpoint: POST /api/v1/family/{family_id}/redemption-requests", "shortDescription": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/redemption-requests"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `POST /api/v1/family/{family_id}/redemption-requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96903479db3cc4f6", "name": "Unused endpoint: GET /api/v1/family/{family_id}/redemption-requests", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/redemption-requests"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/redemption-requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ac764716e266b8b", "name": "Unused endpoint: GET /api/v1/family/{family_id}/redemption-requests/poll", "shortDescription": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/redemption-requests/poll"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /api/v1/family/{family_id}/redemption-requests/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d0943a91e562197", "name": "Unused endpoint: GET /__mock_state__", "shortDescription": {"text": "Unused endpoint: GET /__mock_state__"}, "fullDescription": {"text": "`server/mock_ui_server.py` declares `GET /__mock_state__` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`server/app/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a4dfcad3eb1618a", "name": "Unused endpoint: GET /login", "shortDescription": {"text": "Unused endpoint: GET /login"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f7be24c1900c442", "name": "Unused endpoint: GET /system-config", "shortDescription": {"text": "Unused endpoint: GET /system-config"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /system-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd97e13821048de4", "name": "Unused endpoint: POST /system-config/llm-provider", "shortDescription": {"text": "Unused endpoint: POST /system-config/llm-provider"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /system-config/llm-provider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2464d60cfd2ce421", "name": "Unused endpoint: POST /system-config/llm-provider/test", "shortDescription": {"text": "Unused endpoint: POST /system-config/llm-provider/test"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /system-config/llm-provider/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ebd37eaf190e484", "name": "Unused endpoint: POST /system-config/image-provider", "shortDescription": {"text": "Unused endpoint: POST /system-config/image-provider"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /system-config/image-provider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cecaea219123c22e", "name": "Unused endpoint: POST /system-config/image-provider/test", "shortDescription": {"text": "Unused endpoint: POST /system-config/image-provider/test"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /system-config/image-provider/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5766b6a628042997", "name": "Unused endpoint: GET /feedback", "shortDescription": {"text": "Unused endpoint: GET /feedback"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23e18080df98a228", "name": "Unused endpoint: POST /feedback/{feedback_id}/reply", "shortDescription": {"text": "Unused endpoint: POST /feedback/{feedback_id}/reply"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /feedback/{feedback_id}/reply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47e5d1e70de3e24e", "name": "Unused endpoint: POST /feedback/{feedback_id}/delete", "shortDescription": {"text": "Unused endpoint: POST /feedback/{feedback_id}/delete"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /feedback/{feedback_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86c100f235135108", "name": "Unused endpoint: GET /parents", "shortDescription": {"text": "Unused endpoint: GET /parents"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /parents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d375c34119c44f61", "name": "Unused endpoint: GET /parents/{username}", "shortDescription": {"text": "Unused endpoint: GET /parents/{username}"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /parents/{username}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b88a0bd30ec2bdb", "name": "Unused endpoint: POST /parents/{username}/suspend", "shortDescription": {"text": "Unused endpoint: POST /parents/{username}/suspend"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /parents/{username}/suspend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18a7a37c2b006039", "name": "Unused endpoint: POST /parents/{username}/restore", "shortDescription": {"text": "Unused endpoint: POST /parents/{username}/restore"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /parents/{username}/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8ebe817d16c5e42", "name": "Unused endpoint: GET /devices", "shortDescription": {"text": "Unused endpoint: GET /devices"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2f6bf2a18ca3ddb", "name": "Unused endpoint: GET /devices/{binding_id}/revoke", "shortDescription": {"text": "Unused endpoint: GET /devices/{binding_id}/revoke"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /devices/{binding_id}/revoke` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-154f2a3bf3cdf962", "name": "Unused endpoint: POST /devices/{binding_id}/revoke", "shortDescription": {"text": "Unused endpoint: POST /devices/{binding_id}/revoke"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /devices/{binding_id}/revoke` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d7229359bb04def", "name": "Unused endpoint: GET /devices/{binding_id}/restore", "shortDescription": {"text": "Unused endpoint: GET /devices/{binding_id}/restore"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /devices/{binding_id}/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81c03f43896de832", "name": "Unused endpoint: POST /devices/{binding_id}/restore", "shortDescription": {"text": "Unused endpoint: POST /devices/{binding_id}/restore"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `POST /devices/{binding_id}/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e035e9b9454ddf1", "name": "Unused endpoint: GET /global-packs", "shortDescription": {"text": "Unused endpoint: GET /global-packs"}, "fullDescription": {"text": "`server/app/routers/admin_pages.py` declares `GET /global-packs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21017"}, "properties": {"repository": "terryma2024/happyword", "repoUrl": "https://github.com/terryma2024/happyword", "branch": "main"}, "results": [{"ruleId": "scanner-739f33a687f6f2c9", "level": "note", "message": {"text": "Possibly dead Python function: shot_home"}, "properties": {"repobilityId": "11e6a717f0f698c8", "scanner": "scanner-primary", "fingerprint": "739f33a687f6f2c9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:320"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4eb16d8a05e920db", "level": "note", "message": {"text": "Possibly dead Python function: shot_battle_result"}, "properties": {"repobilityId": "fc914880f52b978d", "scanner": "scanner-primary", "fingerprint": "4eb16d8a05e920db", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:323"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bad91e07a60a1b56", "level": "note", "message": {"text": "Possibly dead Python function: shot_codex"}, "properties": {"repobilityId": "09b16303927b70c9", "scanner": "scanner-primary", "fingerprint": "bad91e07a60a1b56", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:330"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc7076297eeb6d41", "level": "note", "message": {"text": "Possibly dead Python function: shot_today_plan"}, "properties": {"repobilityId": "242fbb62031cc35a", "scanner": "scanner-primary", "fingerprint": "bc7076297eeb6d41", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:337"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92de798745483549", "level": "note", "message": {"text": "Possibly dead Python function: shot_learning_report"}, "properties": {"repobilityId": "4bc288977824a924", "scanner": "scanner-primary", "fingerprint": "92de798745483549", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:342"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdf9c6a06081d202", "level": "note", "message": {"text": "Possibly dead Python function: shot_wishlist_history"}, "properties": {"repobilityId": "f2bbf22fccd17740", "scanner": "scanner-primary", "fingerprint": "fdf9c6a06081d202", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:350"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-395975cd84aac5b3", "level": "note", "message": {"text": "Possibly dead Python function: shot_config_and_pack"}, "properties": {"repobilityId": "3fbafc729c4fe0b6", "scanner": "scanner-primary", "fingerprint": "395975cd84aac5b3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:358"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a319cc75b0b4bfb", "level": "note", "message": {"text": "Possibly dead Python function: shot_parent_pin_surface"}, "properties": {"repobilityId": "2e417f934d5b9b81", "scanner": "scanner-primary", "fingerprint": "2a319cc75b0b4bfb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:374"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86133bca39a00722", "level": "note", "message": {"text": "Possibly dead Python function: shot_scan_binding"}, "properties": {"repobilityId": "085aa1112b248f2d", "scanner": "scanner-primary", "fingerprint": "86133bca39a00722", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:389"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fb26d5d7b463cbd", "level": "note", "message": {"text": "Possibly dead Python function: shot_parent_admin"}, "properties": {"repobilityId": "11fe7c6f814a7674", "scanner": "scanner-primary", "fingerprint": "6fb26d5d7b463cbd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:410"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc8b90c0fb32de36", "level": "note", "message": {"text": "Possibly dead Python function: shot_bound_device_if_any"}, "properties": {"repobilityId": "1c59cb1dc71c63f0", "scanner": "scanner-primary", "fingerprint": "bc8b90c0fb32de36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:441"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f3e18aef370da5a", "level": "note", "message": {"text": "Possibly dead Python function: shot_dev_menu_and_bypass"}, "properties": {"repobilityId": "a5dc56b862c19851", "scanner": "scanner-primary", "fingerprint": "6f3e18aef370da5a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_harmony_screenshots.py:455"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9145f5d7ad5ded36", "level": "note", "message": {"text": "Possibly dead Python function: current_user"}, "properties": {"repobilityId": "271089411e6e6afb", "scanner": "scanner-primary", "fingerprint": "9145f5d7ad5ded36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/deps.py:19"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-606811cb50dc7f19", "level": "note", "message": {"text": "Possibly dead Python function: current_admin_user"}, "properties": {"repobilityId": "27061ec99f5fee93", "scanner": "scanner-primary", "fingerprint": "606811cb50dc7f19", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/deps.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5843ccc6ef082199", "level": "note", "message": {"text": "Possibly dead Python function: current_parent_user"}, "properties": {"repobilityId": "ffe7800f35566232", "scanner": "scanner-primary", "fingerprint": "5843ccc6ef082199", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/deps.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13b73ef06f92505e", "level": "note", "message": {"text": "Possibly dead Python function: current_device_binding"}, "properties": {"repobilityId": "617736adf46259b7", "scanner": "scanner-primary", "fingerprint": "13b73ef06f92505e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/deps.py:182"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46f758dc83b6d329", "level": "note", "message": {"text": "Possibly dead Python function: preview_alipay_callback_url"}, "properties": {"repobilityId": "c3d12b77b1e8985f", "scanner": "scanner-primary", "fingerprint": "46f758dc83b6d329", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/alipay_oauth_service.py:254"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a8a063352d083c4", "level": "note", "message": {"text": "Possibly dead Python function: delete_feedback"}, "properties": {"repobilityId": "d77b0899030281a4", "scanner": "scanner-primary", "fingerprint": "0a8a063352d083c4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/feedback_service.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8ffd7adc0d5cd2d", "level": "note", "message": {"text": "Possibly dead Python function: is_selected_lesson_provider_configured"}, "properties": {"repobilityId": "376fb4229253ac93", "scanner": "scanner-primary", "fingerprint": "b8ffd7adc0d5cd2d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/llm_providers.py:153"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4956b85ad4228322", "level": "note", "message": {"text": "Possibly dead Python function: selected_lesson_provider_missing_message"}, "properties": {"repobilityId": "eddd20f72bc523db", "scanner": "scanner-primary", "fingerprint": "4956b85ad4228322", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/llm_providers.py:191"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-666aaee3c889a864", "level": "note", "message": {"text": "Possibly dead Python function: effective_lesson_provider_missing_message"}, "properties": {"repobilityId": "420f480bc6db0cad", "scanner": "scanner-primary", "fingerprint": "666aaee3c889a864", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/llm_providers.py:200"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00ebc05aa7b7335d", "level": "note", "message": {"text": "Possibly dead Python function: extract_json_payload_with_responses_provider"}, "properties": {"repobilityId": "d288d887e17a1429", "scanner": "scanner-primary", "fingerprint": "00ebc05aa7b7335d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/llm_providers.py:718"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ff2f6915891c8db", "level": "note", "message": {"text": "Possibly dead Python function: finish_path"}, "properties": {"repobilityId": "269363cb4b4b8335", "scanner": "scanner-primary", "fingerprint": "1ff2f6915891c8db", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/oauth_redirect_urls.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8759140f3d1fc650", "level": "note", "message": {"text": "Possibly dead Python function: preview_wechat_callback_url"}, "properties": {"repobilityId": "3be47a4e18f6a5ca", "scanner": "scanner-primary", "fingerprint": "8759140f3d1fc650", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/wechat_oauth_service.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dad540a2a82df9b0", "level": "note", "message": {"text": "Possibly dead Python function: format_audit_timestamp"}, "properties": {"repobilityId": "d8111c104847be7d", "scanner": "scanner-primary", "fingerprint": "dad540a2a82df9b0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/admin_console_overview_service.py:61"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df545cf48ad1cb43", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 cocos/native/engine/harmonyos-next/entry/src/main/ets/common/Eventify.ts:145"}, "properties": {"repobilityId": "6e010dc690b92ac6", "scanner": "scanner-primary", "fingerprint": "df545cf48ad1cb43", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a7c71cbf93e3409e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 harmonyos/entry/src/main/ets/cocosvendor/common/Eventify.ts:145"}, "properties": {"repobilityId": "6fd96a1a56af202b", "scanner": "scanner-primary", "fingerprint": "a7c71cbf93e3409e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "1de0ecd007803dbd", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b69f45b2dcff8d24", "level": "warning", "message": {"text": "Dockerfile runs as root: server/Dockerfile"}, "properties": {"repobilityId": "4600ca3b571a3f30", "scanner": "scanner-primary", "fingerprint": "b69f45b2dcff8d24", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-5519735ba27324e6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "d779f937345069a4", "scanner": "scanner-primary", "fingerprint": "5519735ba27324e6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-2b37a753988ba5dd", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in server/app/services/alipay_oauth_service.py:133"}, "properties": {"repobilityId": "54761d7ba0d4a51f", "scanner": "scanner-primary", "fingerprint": "2b37a753988ba5dd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/alipay_oauth_service.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-953f3624b18375ad", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in tools/recraft/svg-to-png.mjs:11"}, "properties": {"repobilityId": "fa572e5432e64e58", "scanner": "scanner-primary", "fingerprint": "953f3624b18375ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/recraft/svg-to-png.mjs"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-4e7f8d5633b5878d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/workflows/server-cloudbase-cd.yml:191"}, "properties": {"repobilityId": "666d4d2169e163ed", "scanner": "scanner-primary", "fingerprint": "4e7f8d5633b5878d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cloudbase-cd.yml"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-bbef6e53906ad1f7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/workflows/server-cd.yml:98"}, "properties": {"repobilityId": "31126ab2bcc36775", "scanner": "scanner-primary", "fingerprint": "bbef6e53906ad1f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cd.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-0ab6b22e9d419753", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/workflows/server-ci.yml:277"}, "properties": {"repobilityId": "708f047d20621306", "scanner": "scanner-primary", "fingerprint": "0ab6b22e9d419753", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-ci.yml"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-e15a239536f161bc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d452d0dfcdc9ff2a", "scanner": "scanner-primary", "fingerprint": "e15a239536f161bc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cloudbase-cd.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-e15a239536f161bc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cf13cd760e037983", "scanner": "scanner-primary", "fingerprint": "e15a239536f161bc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cloudbase-cd.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-e15a239536f161bc", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4fe846b39f2424c6", "scanner": "scanner-primary", "fingerprint": "e15a239536f161bc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cloudbase-cd.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-e15a239536f161bc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b3adb1f65a919a3", "scanner": "scanner-primary", "fingerprint": "e15a239536f161bc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cloudbase-cd.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-38ed1a1746d2c701", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d561ba0ab0f54ab2", "scanner": "scanner-primary", "fingerprint": "38ed1a1746d2c701", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-cd.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-36b318ba8ed770b6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0c473244ea450a20", "scanner": "scanner-primary", "fingerprint": "36b318ba8ed770b6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-ci.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-36b318ba8ed770b6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c8e98191ea00ea4a", "scanner": "scanner-primary", "fingerprint": "36b318ba8ed770b6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-ci.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-36b318ba8ed770b6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7a8db5a0f2c88d6f", "scanner": "scanner-primary", "fingerprint": "36b318ba8ed770b6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-ci.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-36b318ba8ed770b6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "46859d909b2ff14c", "scanner": "scanner-primary", "fingerprint": "36b318ba8ed770b6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/server-ci.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-02adb48ef17e5848", "level": "note", "message": {"text": "Very large file: server/tests/test_admin_pages.py (1409 lines)"}, "properties": {"repobilityId": "0af684f9a17dfa1b", "scanner": "scanner-primary", "fingerprint": "02adb48ef17e5848", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4986b643f1a3e7a0", "level": "note", "message": {"text": "Very large file: server/app/routers/admin_pages.py (1865 lines)"}, "properties": {"repobilityId": "249009cc0dfe5f6c", "scanner": "scanner-primary", "fingerprint": "4986b643f1a3e7a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d742de003558a89f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "e2c0540622cfed2b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "15fe9c15f50296f9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f4dba5c939edb396", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "160ff6c7dbab2ce0", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-abbf4a8869aaa6ae", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/safe-command-policy/SKILL.md"}, "properties": {"repobilityId": "b12d93a32ef22184", "scanner": "scanner-primary", "fingerprint": "abbf4a8869aaa6ae", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/safe-command-policy/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be4b4b3d696aeb73", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .cursor/skills/safe-command-policy/SKILL.md"}, "properties": {"repobilityId": "829b7c5f9181bbe7", "scanner": "scanner-primary", "fingerprint": "be4b4b3d696aeb73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/safe-command-policy/SKILL.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-eabc5ba48888eec3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/vercel-trigger-cron/SKILL.md"}, "properties": {"repobilityId": "ffcf12eb0578aee0", "scanner": "scanner-primary", "fingerprint": "eabc5ba48888eec3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/vercel-trigger-cron/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1189c257b386377", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/vercel-prune-deployments/SKILL.md"}, "properties": {"repobilityId": "70f00b4238f85248", "scanner": "scanner-primary", "fingerprint": "e1189c257b386377", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/vercel-prune-deployments/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ab7b6b3684bd832", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/recraft-v4-vector/SKILL.md"}, "properties": {"repobilityId": "542acd666922ef8b", "scanner": "scanner-primary", "fingerprint": "0ab7b6b3684bd832", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/recraft-v4-vector/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efd2eddf743cfddd", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-security-expert/SKILL.md"}, "properties": {"repobilityId": "3c5230c5e417e73d", "scanner": "scanner-primary", "fingerprint": "efd2eddf743cfddd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/the1-cocos-codex-agent/skills/cocos-security-expert/SKILL.md"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-4dd11f88732b2d13", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-platform-integrator/SKILL.md"}, "properties": {"repobilityId": "f4d5057e02f428d9", "scanner": "scanner-primary", "fingerprint": "4dd11f88732b2d13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/the1-cocos-codex-agent/skills/cocos-platform-integrator/SKILL.md"}, "region": {"startLine": 645}}}]}, {"ruleId": "scanner-44ccea5a860612f6", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: plugins/the1-cocos-codex-agent/skills/cocos-backend-integrator/SKILL.md"}, "properties": {"repobilityId": "466b37b05f62f742", "scanner": "scanner-primary", "fingerprint": "44ccea5a860612f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/the1-cocos-codex-agent/skills/cocos-backend-integrator/SKILL.md"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-cc2edf71ae435a09", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/capture_harmony_screenshots.py:52"}, "properties": {"repobilityId": "c9f06e123ffafffb", "scanner": "scanner-primary", "fingerprint": "cc2edf71ae435a09", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d6514641628a2988", "level": "note", "message": {"text": "Legacy-named symbol `words_v1` in server/mock_ui_server.py:78"}, "properties": {"repobilityId": "2a26222721c458d3", "scanner": "scanner-primary", "fingerprint": "d6514641628a2988", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8bfe3f0e96fa78c3", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/mock_ui_server.py:128"}, "properties": {"repobilityId": "71931df7f2f81ebe", "scanner": "scanner-primary", "fingerprint": "8bfe3f0e96fa78c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-329058f01a5bc542", "level": "note", "message": {"text": "Legacy-named symbol `refreshed_old` in server/tests/test_redemption_flow.py:316"}, "properties": {"repobilityId": "9821a4b20b355546", "scanner": "scanner-primary", "fingerprint": "329058f01a5bc542", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c0246277dd61d1b2", "level": "note", "message": {"text": "Legacy-named symbol `admin_family_pack_copy` in server/tests/test_admin_pages.py:546"}, "properties": {"repobilityId": "2a816d022c32993c", "scanner": "scanner-primary", "fingerprint": "c0246277dd61d1b2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d33a6d1e69c7a708", "level": "note", "message": {"text": "Legacy-named symbol `test_pack_with_distractors_is_schema_v2` in server/tests/test_pack_schema_v2.py:35"}, "properties": {"repobilityId": "b8faa70cf1ad13e0", "scanner": "scanner-primary", "fingerprint": "d33a6d1e69c7a708", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f0b24facbe740ef1", "level": "note", "message": {"text": "Legacy-named symbol `test_pack_with_no_category_rows_stays_at_v1` in server/tests/test_pack_schema_v4.py:113"}, "properties": {"repobilityId": "c388bea87112261c", "scanner": "scanner-primary", "fingerprint": "f0b24facbe740ef1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f44e9eed26fc3ee9", "level": "note", "message": {"text": "Legacy-named symbol `fake_old` in server/tests/test_e2e_drop_old_pr_dbs.py:55"}, "properties": {"repobilityId": "2f439d89d201caec", "scanner": "scanner-primary", "fingerprint": "f44e9eed26fc3ee9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-930b92166d72f500", "level": "note", "message": {"text": "Legacy-named symbol `test_pending_token_marked_expired_by_expire_old` in server/tests/test_pair_flow.py:290"}, "properties": {"repobilityId": "3a6036b4accf6172", "scanner": "scanner-primary", "fingerprint": "930b92166d72f500", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-009ee81321197103", "level": "note", "message": {"text": "Legacy-named symbol `test_admin_split_global_draft_copy` in server/tests/test_admin_global_pack_router.py:273"}, "properties": {"repobilityId": "ac0649a3503f496a", "scanner": "scanner-primary", "fingerprint": "009ee81321197103", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-73e2b83b4bf2f5d0", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/tests/test_admin_llm_endpoint.py:73"}, "properties": {"repobilityId": "57f5c09c0fb77eeb", "scanner": "scanner-primary", "fingerprint": "73e2b83b4bf2f5d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2993ef21d194ca2", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/tests/e2e/conftest.py:56"}, "properties": {"repobilityId": "ff4954f61fea0945", "scanner": "scanner-primary", "fingerprint": "f2993ef21d194ca2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6becd00f5e14cc4e", "level": "note", "message": {"text": "Legacy-named symbol `publish_v1` in server/tests/e2e/test_parent_family_pack_e2e.py:150"}, "properties": {"repobilityId": "2ecf4da0fb5c723c", "scanner": "scanner-primary", "fingerprint": "6becd00f5e14cc4e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-91759982f2f9103b", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/tests/e2e/_utils/auth.py:123"}, "properties": {"repobilityId": "75ffc7ca3c822d57", "scanner": "scanner-primary", "fingerprint": "91759982f2f9103b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd3946561fb62a6f", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/tests/e2e/_utils/vercel.py:49"}, "properties": {"repobilityId": "82c4cc96185c8188", "scanner": "scanner-primary", "fingerprint": "cd3946561fb62a6f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-efc1894cfcf273e0", "level": "note", "message": {"text": "Legacy-named symbol `words_v1` in server/scripts/e2e_reset_db.py:72"}, "properties": {"repobilityId": "fa2022cc616992bf", "scanner": "scanner-primary", "fingerprint": "efc1894cfcf273e0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-69f321bd83587c41", "level": "note", "message": {"text": "Legacy-named symbol `words_v1` in server/scripts/seed_from_rawfile.py:3"}, "properties": {"repobilityId": "8ccedd42b2338b79", "scanner": "scanner-primary", "fingerprint": "69f321bd83587c41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-456c029e9e25ddc0", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/config.py:10"}, "properties": {"repobilityId": "733ce6cb8e02e97f", "scanner": "scanner-primary", "fingerprint": "456c029e9e25ddc0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a22a5aa8eb8c6726", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/models/word_pack.py:23"}, "properties": {"repobilityId": "ac4ceafcc5039df0", "scanner": "scanner-primary", "fingerprint": "a22a5aa8eb8c6726", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b4d767498a782e86", "level": "note", "message": {"text": "Legacy-named symbol `schema_v1` in server/app/services/pack_service.py:196"}, "properties": {"repobilityId": "6d9e5c849aa2df6b", "scanner": "scanner-primary", "fingerprint": "b4d767498a782e86", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1117414b109978a5", "level": "note", "message": {"text": "Legacy-named symbol `words_v1` in server/app/services/parent_report_service.py:329"}, "properties": {"repobilityId": "ec7aaa59887f24b9", "scanner": "scanner-primary", "fingerprint": "1117414b109978a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a0377fcd79d5b82a", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/app/services/pair_service.py:34"}, "properties": {"repobilityId": "d391e655fadc38c6", "scanner": "scanner-primary", "fingerprint": "a0377fcd79d5b82a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3f566648a1720b1", "level": "note", "message": {"text": "Legacy-named symbol `admin_family_pack_copy` in server/app/services/admin_console_service.py:514"}, "properties": {"repobilityId": "d78952267ccd11c1", "scanner": "scanner-primary", "fingerprint": "a3f566648a1720b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-26bd3e1855d054f5", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/services/word_stats_sync_service.py:169"}, "properties": {"repobilityId": "ca6435a7d06c0dbb", "scanner": "scanner-primary", "fingerprint": "26bd3e1855d054f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f2472cd2e0eb18b", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/app/services/lesson_service.py:25"}, "properties": {"repobilityId": "930f7d5ab425958d", "scanner": "scanner-primary", "fingerprint": "3f2472cd2e0eb18b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d586cf0296048146", "level": "note", "message": {"text": "Legacy-named symbol `gpk_split_copy` in server/app/routers/admin_pages.py:150"}, "properties": {"repobilityId": "d89ce70fd722e332", "scanner": "scanner-primary", "fingerprint": "d586cf0296048146", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-70d60905716d0c21", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/routers/admin_cron.py:68"}, "properties": {"repobilityId": "ef060d833a967a60", "scanner": "scanner-primary", "fingerprint": "70d60905716d0c21", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6b074d9f04855859", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/generate_scan_binding_qr_fixture.py:22"}, "properties": {"repobilityId": "df693c0df78b179d", "scanner": "scanner-primary", "fingerprint": "6b074d9f04855859", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-31de4b6165a0dc3d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/gap_detector/runners/commands.py:66"}, "properties": {"repobilityId": "9ec5432339ab6183", "scanner": "scanner-primary", "fingerprint": "31de4b6165a0dc3d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a8c275390ac3c204", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/recraft/generate-v4-vector.mjs:111"}, "properties": {"repobilityId": "30279a0957336009", "scanner": "scanner-primary", "fingerprint": "a8c275390ac3c204", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-909b63da3c77213d", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/recraft/strip-svg-canvas.mjs:2"}, "properties": {"repobilityId": "25e5a9803bd2cd27", "scanner": "scanner-primary", "fingerprint": "909b63da3c77213d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-695698b73af5a909", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/recraft/svg-to-png.mjs:2"}, "properties": {"repobilityId": "47e3e6d37146187c", "scanner": "scanner-primary", "fingerprint": "695698b73af5a909", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bac293174c98502b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/parity_scout/doctor.py:83"}, "properties": {"repobilityId": "a1188fd2be233bf6", "scanner": "scanner-primary", "fingerprint": "bac293174c98502b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-789bf6bd56f00458", "level": "none", "message": {"text": "Commented-code block (6 lines) in cocos/tests/transportPathSync.test.ts:3"}, "properties": {"repobilityId": "4d74e0dd6b9f14b0", "scanner": "scanner-primary", "fingerprint": "789bf6bd56f00458", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ba53a910b8f40b5", "level": "none", "message": {"text": "Commented-code block (6 lines) in cocos/assets/scripts/BattleSceneController.ts:59"}, "properties": {"repobilityId": "e68030ba83d674e7", "scanner": "scanner-primary", "fingerprint": "0ba53a910b8f40b5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f519af64618a9387", "level": "none", "message": {"text": "Commented-code block (5 lines) in cocos/assets/scripts/ui/resolutionPolicy.ts:29"}, "properties": {"repobilityId": "e98ab5d48f054efb", "scanner": "scanner-primary", "fingerprint": "f519af64618a9387", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29bcbaa774394173", "level": "none", "message": {"text": "Commented-code block (8 lines) in cocos/assets/scripts/ui/QuestionPanel.ts:1"}, "properties": {"repobilityId": "682eb67e4bb041e8", "scanner": "scanner-primary", "fingerprint": "29bcbaa774394173", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52eb1bf061e03e99", "level": "none", "message": {"text": "Commented-code block (14 lines) in cocos/assets/scripts/bridge/transport.ts:7"}, "properties": {"repobilityId": "52ff013ba5bb5036", "scanner": "scanner-primary", "fingerprint": "52eb1bf061e03e99", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "55db7ec8eafec5b0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "2246ccd25ed6b916", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "17ca0577715415b9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b6337680a7565b1b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e82f3d2db8cd576e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "570afde8fadd489e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aa5a4a0fa7dab683", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1e2966bd25c77438", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f6794a9cbdfd00ab", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8e875e0eeae52beb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b0c152a7c99dface", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7a0b5c431add8a18", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2c771b6e6124338f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c0c3e83fc897d0f9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f41ebcb27c6a8294", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d1ce4b371ae03d5a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e21ccd12e8261c4e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "630c9068fb1de815", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2157f0c634e3c0dd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "684483524631a602", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-420e0ad4204d1651", "level": "error", "message": {"text": "FastAPI POST `admin_publish_pack` without auth dependency \u2014 server/mock_ui_server.py:548"}, "properties": {"repobilityId": "e794a6ca82dec4c6", "scanner": "scanner-primary", "fingerprint": "420e0ad4204d1651", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-1fbdd78d8825e22f", "level": "error", "message": {"text": "FastAPI PATCH `admin_patch_draft` without auth dependency \u2014 server/mock_ui_server.py:616"}, "properties": {"repobilityId": "0975b4b0d1125f8d", "scanner": "scanner-primary", "fingerprint": "1fbdd78d8825e22f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 616}}}]}, {"ruleId": "scanner-3c6143f4245cf032", "level": "error", "message": {"text": "FastAPI PUT `admin_patch_draft` without auth dependency \u2014 server/mock_ui_server.py:617"}, "properties": {"repobilityId": "da9680c99888cdf7", "scanner": "scanner-primary", "fingerprint": "3c6143f4245cf032", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 617}}}]}, {"ruleId": "scanner-53e0f71d540a0c97", "level": "error", "message": {"text": "FastAPI POST `admin_approve_draft` without auth dependency \u2014 server/mock_ui_server.py:641"}, "properties": {"repobilityId": "cb6e4f3e5928fff7", "scanner": "scanner-primary", "fingerprint": "53e0f71d540a0c97", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 641}}}]}, {"ruleId": "scanner-31c7fab84e7ca020", "level": "error", "message": {"text": "FastAPI POST `admin_reject_draft` without auth dependency \u2014 server/mock_ui_server.py:674"}, "properties": {"repobilityId": "7c7c92ed77192d4b", "scanner": "scanner-primary", "fingerprint": "31c7fab84e7ca020", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 674}}}]}, {"ruleId": "scanner-4a08afa071da5b6c", "level": "error", "message": {"text": "FastAPI POST `admin_import_lesson` without auth dependency \u2014 server/mock_ui_server.py:694"}, "properties": {"repobilityId": "f1ff4263f37e6a11", "scanner": "scanner-primary", "fingerprint": "4a08afa071da5b6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 694}}}]}, {"ruleId": "scanner-fb39bcc54ed6c9a0", "level": "error", "message": {"text": "FastAPI POST `pair_redeem` without auth dependency \u2014 server/mock_ui_server.py:739"}, "properties": {"repobilityId": "0463501b2538c610", "scanner": "scanner-primary", "fingerprint": "fb39bcc54ed6c9a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 739}}}]}, {"ruleId": "scanner-d41941c5f76a62e2", "level": "error", "message": {"text": "FastAPI POST `child_unbind` without auth dependency \u2014 server/mock_ui_server.py:766"}, "properties": {"repobilityId": "61f67fffc54aef2b", "scanner": "scanner-primary", "fingerprint": "d41941c5f76a62e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 766}}}]}, {"ruleId": "scanner-cb17805a65ceea4e", "level": "error", "message": {"text": "FastAPI PUT `child_profile_put` without auth dependency \u2014 server/mock_ui_server.py:803"}, "properties": {"repobilityId": "ef585068bf9e34d3", "scanner": "scanner-primary", "fingerprint": "cb17805a65ceea4e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 803}}}]}, {"ruleId": "scanner-73d907510feb8a8a", "level": "error", "message": {"text": "FastAPI POST `child_sync_word_stats` without auth dependency \u2014 server/mock_ui_server.py:948"}, "properties": {"repobilityId": "924133f3e43b8b82", "scanner": "scanner-primary", "fingerprint": "73d907510feb8a8a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 948}}}]}, {"ruleId": "scanner-3a092e325f82654c", "level": "error", "message": {"text": "FastAPI POST `child_wishlist_sync_custom` without auth dependency \u2014 server/mock_ui_server.py:998"}, "properties": {"repobilityId": "6a68d185f71ed8d5", "scanner": "scanner-primary", "fingerprint": "3a092e325f82654c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 998}}}]}, {"ruleId": "scanner-d681eb33f6665fd9", "level": "error", "message": {"text": "FastAPI POST `child_create_redemption` without auth dependency \u2014 server/mock_ui_server.py:1009"}, "properties": {"repobilityId": "7ca989a2b0b84187", "scanner": "scanner-primary", "fingerprint": "d681eb33f6665fd9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/mock_ui_server.py"}, "region": {"startLine": 1009}}}]}, {"ruleId": "scanner-a8c1d0e12fd0951e", "level": "error", "message": {"text": "FastAPI POST `admin_login_post` without auth dependency \u2014 server/app/routers/admin_pages.py:327"}, "properties": {"repobilityId": "7b23656e005ee3ea", "scanner": "scanner-primary", "fingerprint": "a8c1d0e12fd0951e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-7c4c197a6fd8583c", "level": "error", "message": {"text": "FastAPI POST `admin_logout` without auth dependency \u2014 server/app/routers/admin_pages.py:365"}, "properties": {"repobilityId": "977ab218d11eb92c", "scanner": "scanner-primary", "fingerprint": "7c4c197a6fd8583c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 365}}}]}, {"ruleId": "scanner-df688e5d723f53aa", "level": "error", "message": {"text": "FastAPI POST `admin_system_config_llm_provider_post` without auth dependency \u2014 server/app/routers/admin_pages.py:413"}, "properties": {"repobilityId": "80bc45e964fc23a0", "scanner": "scanner-primary", "fingerprint": "df688e5d723f53aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 413}}}]}, {"ruleId": "scanner-4d5dc77d03e485ef", "level": "error", "message": {"text": "FastAPI POST `admin_system_config_llm_provider_test_post` without auth dependency \u2014 server/app/routers/admin_pages.py:451"}, "properties": {"repobilityId": "27623b029399cd1d", "scanner": "scanner-primary", "fingerprint": "4d5dc77d03e485ef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 451}}}]}, {"ruleId": "scanner-22901a6131a322c4", "level": "error", "message": {"text": "FastAPI POST `admin_system_config_image_provider_post` without auth dependency \u2014 server/app/routers/admin_pages.py:484"}, "properties": {"repobilityId": "2eb4f2060fc12635", "scanner": "scanner-primary", "fingerprint": "22901a6131a322c4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 484}}}]}, {"ruleId": "scanner-fc8a54932731cc3c", "level": "error", "message": {"text": "FastAPI POST `admin_system_config_image_provider_test_post` without auth dependency \u2014 server/app/routers/admin_pages.py:522"}, "properties": {"repobilityId": "f67491e8bb4fdaa9", "scanner": "scanner-primary", "fingerprint": "fc8a54932731cc3c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 522}}}]}, {"ruleId": "scanner-cf241db74d1017a1", "level": "error", "message": {"text": "FastAPI POST `admin_feedback_reply` without auth dependency \u2014 server/app/routers/admin_pages.py:577"}, "properties": {"repobilityId": "cda26a9cdbf29c7e", "scanner": "scanner-primary", "fingerprint": "cf241db74d1017a1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 577}}}]}, {"ruleId": "scanner-0be1fd014f46c4fa", "level": "error", "message": {"text": "FastAPI POST `admin_feedback_delete` without auth dependency \u2014 server/app/routers/admin_pages.py:609"}, "properties": {"repobilityId": "e2805f1f9e31a8cd", "scanner": "scanner-primary", "fingerprint": "0be1fd014f46c4fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 609}}}]}, {"ruleId": "scanner-8ee80d2be22d7796", "level": "error", "message": {"text": "FastAPI POST `admin_parent_suspend` without auth dependency \u2014 server/app/routers/admin_pages.py:685"}, "properties": {"repobilityId": "3202fcb4dc2b9241", "scanner": "scanner-primary", "fingerprint": "8ee80d2be22d7796", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 685}}}]}, {"ruleId": "scanner-adad67057920eeba", "level": "error", "message": {"text": "FastAPI POST `admin_parent_restore` without auth dependency \u2014 server/app/routers/admin_pages.py:710"}, "properties": {"repobilityId": "225bbfff72d459f7", "scanner": "scanner-primary", "fingerprint": "adad67057920eeba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 710}}}]}, {"ruleId": "scanner-8d1b47345df7b603", "level": "error", "message": {"text": "FastAPI POST `admin_device_revoke_post` without auth dependency \u2014 server/app/routers/admin_pages.py:789"}, "properties": {"repobilityId": "a5e717f0f5b09dda", "scanner": "scanner-primary", "fingerprint": "8d1b47345df7b603", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 789}}}]}, {"ruleId": "scanner-f154407dcb43b94d", "level": "error", "message": {"text": "FastAPI POST `admin_device_restore_post` without auth dependency \u2014 server/app/routers/admin_pages.py:834"}, "properties": {"repobilityId": "bbf323bfc2a5212c", "scanner": "scanner-primary", "fingerprint": "f154407dcb43b94d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 834}}}]}, {"ruleId": "scanner-b4539cfe7ad41dae", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_create_post` without auth dependency \u2014 server/app/routers/admin_pages.py:894"}, "properties": {"repobilityId": "63566586aa76de9f", "scanner": "scanner-primary", "fingerprint": "b4539cfe7ad41dae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 894}}}]}, {"ruleId": "scanner-e46ca656fa540eac", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_import_image_post` without auth dependency \u2014 server/app/routers/admin_pages.py:925"}, "properties": {"repobilityId": "863cb2bfad97771e", "scanner": "scanner-primary", "fingerprint": "e46ca656fa540eac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 925}}}]}, {"ruleId": "scanner-c889cd941d1bc3ab", "level": "error", "message": {"text": "FastAPI POST `admin_global_publish_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1011"}, "properties": {"repobilityId": "1dbcb3b37a54389c", "scanner": "scanner-primary", "fingerprint": "c889cd941d1bc3ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1011}}}]}, {"ruleId": "scanner-2c47caa93d0b9c7d", "level": "error", "message": {"text": "FastAPI POST `admin_global_rollback_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1032"}, "properties": {"repobilityId": "8aea010bca947e26", "scanner": "scanner-primary", "fingerprint": "2c47caa93d0b9c7d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1032}}}]}, {"ruleId": "scanner-c8b186e84975f467", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_detail_import_image_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1088"}, "properties": {"repobilityId": "e02b672f0da985fd", "scanner": "scanner-primary", "fingerprint": "c8b186e84975f467", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1088}}}]}, {"ruleId": "scanner-f45e6e968473c1a0", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_metadata_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1167"}, "properties": {"repobilityId": "0e0442fc5bec9def", "scanner": "scanner-primary", "fingerprint": "f45e6e968473c1a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1167}}}]}, {"ruleId": "scanner-e727a332abeab786", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_story_generate_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1207"}, "properties": {"repobilityId": "3bf2bc38032edc18", "scanner": "scanner-primary", "fingerprint": "e727a332abeab786", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1207}}}]}, {"ruleId": "scanner-f0935534bfe13338", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_cover_generate_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1257"}, "properties": {"repobilityId": "4df7c88d0e4affc0", "scanner": "scanner-primary", "fingerprint": "f0935534bfe13338", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1257}}}]}, {"ruleId": "scanner-b07b39e75c8e6b09", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_publish_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1298"}, "properties": {"repobilityId": "77141e28d7314f87", "scanner": "scanner-primary", "fingerprint": "b07b39e75c8e6b09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1298}}}]}, {"ruleId": "scanner-22e239a0a4a445aa", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_rollback_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1330"}, "properties": {"repobilityId": "bfd151eba9efb211", "scanner": "scanner-primary", "fingerprint": "22e239a0a4a445aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1330}}}]}, {"ruleId": "scanner-2c5bca3232f15bc7", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_delete_definition_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1362"}, "properties": {"repobilityId": "d2088e28c1ea5f86", "scanner": "scanner-primary", "fingerprint": "2c5bca3232f15bc7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1362}}}]}, {"ruleId": "scanner-8fb5120eb4ddc710", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_draft_create_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1394"}, "properties": {"repobilityId": "a88b6ba51abd2917", "scanner": "scanner-primary", "fingerprint": "8fb5120eb4ddc710", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1394}}}]}, {"ruleId": "scanner-9351425f905b0392", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_draft_save_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1499"}, "properties": {"repobilityId": "d5ecc7b0d91f4549", "scanner": "scanner-primary", "fingerprint": "9351425f905b0392", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1499}}}]}, {"ruleId": "scanner-93e490d9a94843de", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_draft_delete_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1542"}, "properties": {"repobilityId": "d6f239e2347cb392", "scanner": "scanner-primary", "fingerprint": "93e490d9a94843de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1542}}}]}, {"ruleId": "scanner-6da46e84d40899cd", "level": "error", "message": {"text": "FastAPI POST `admin_global_pack_draft_split_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1568"}, "properties": {"repobilityId": "f50f000ea0e45d77", "scanner": "scanner-primary", "fingerprint": "6da46e84d40899cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1568}}}]}, {"ruleId": "scanner-756bff44c9bc7ff2", "level": "error", "message": {"text": "FastAPI POST `admin_family_unarchive_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1703"}, "properties": {"repobilityId": "6adf69f01d81f659", "scanner": "scanner-primary", "fingerprint": "756bff44c9bc7ff2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1703}}}]}, {"ruleId": "scanner-0cf4fe6dffeb64b9", "level": "error", "message": {"text": "FastAPI POST `admin_family_rollback_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1728"}, "properties": {"repobilityId": "200d5ee11841b650", "scanner": "scanner-primary", "fingerprint": "0cf4fe6dffeb64b9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1728}}}]}, {"ruleId": "scanner-35198f51a864d4f1", "level": "error", "message": {"text": "FastAPI POST `admin_family_delete_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1753"}, "properties": {"repobilityId": "c6866879e0343279", "scanner": "scanner-primary", "fingerprint": "35198f51a864d4f1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1753}}}]}, {"ruleId": "scanner-1a528d83154b5417", "level": "error", "message": {"text": "FastAPI POST `admin_family_copy_to_global_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1778"}, "properties": {"repobilityId": "6ae8cef8e10033e7", "scanner": "scanner-primary", "fingerprint": "1a528d83154b5417", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1778}}}]}, {"ruleId": "scanner-f3aa6b650ebdaf31", "level": "error", "message": {"text": "FastAPI POST `admin_family_copy_to_family_post` without auth dependency \u2014 server/app/routers/admin_pages.py:1807"}, "properties": {"repobilityId": "f61905dfde38c907", "scanner": "scanner-primary", "fingerprint": "f3aa6b650ebdaf31", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_pages.py"}, "region": {"startLine": 1807}}}]}, {"ruleId": "scanner-c1ca8b0999d62ccc", "level": "error", "message": {"text": "FastAPI POST `post_oauth_bind_email_request_code` without auth dependency \u2014 server/app/routers/parent_pages.py:256"}, "properties": {"repobilityId": "b17fbfa522c28bba", "scanner": "scanner-primary", "fingerprint": "c1ca8b0999d62ccc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_pages.py"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-918b39debb4c9b4d", "level": "error", "message": {"text": "FastAPI POST `post_oauth_bind_email_verify_code` without auth dependency \u2014 server/app/routers/parent_pages.py:299"}, "properties": {"repobilityId": "54a9acc021c20f2a", "scanner": "scanner-primary", "fingerprint": "918b39debb4c9b4d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_pages.py"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-6379b5b6a4ea3240", "level": "error", "message": {"text": "FastAPI POST `post_request_code_form` without auth dependency \u2014 server/app/routers/parent_pages.py:421"}, "properties": {"repobilityId": "dc4988fcc4175e08", "scanner": "scanner-primary", "fingerprint": "6379b5b6a4ea3240", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_pages.py"}, "region": {"startLine": 421}}}]}, {"ruleId": "scanner-33c3aaddc0a3bed0", "level": "error", "message": {"text": "FastAPI POST `post_verify_code_form` without auth dependency \u2014 server/app/routers/parent_pages.py:448"}, "properties": {"repobilityId": "5a933fb094023c42", "scanner": "scanner-primary", "fingerprint": "33c3aaddc0a3bed0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_pages.py"}, "region": {"startLine": 448}}}]}, {"ruleId": "scanner-e90bee85a2ccf075", "level": "error", "message": {"text": "FastAPI POST `post_password_login_form` without auth dependency \u2014 server/app/routers/parent_pages.py:527"}, "properties": {"repobilityId": "dce60ab11f746ee0", "scanner": "scanner-primary", "fingerprint": "e90bee85a2ccf075", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_pages.py"}, "region": {"startLine": 527}}}]}, {"ruleId": "scanner-e9c54e12f5adf699", "level": "error", "message": {"text": "FastAPI POST `post_logout_form` without auth dependency \u2014 server/app/routers/parent_pages.py:590"}, "properties": {"repobilityId": "29cc804762aa368c", "scanner": "scanner-primary", "fingerprint": "e9c54e12f5adf699", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_pages.py"}, "region": {"startLine": 590}}}]}, {"ruleId": "scanner-32231ebd63f47cad", "level": "error", "message": {"text": "FastAPI POST `extract_pending` without auth dependency \u2014 server/app/routers/admin_cron.py:166"}, "properties": {"repobilityId": "60b46704230eb791", "scanner": "scanner-primary", "fingerprint": "32231ebd63f47cad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_cron.py"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-46cef1c7bff1a4f3", "level": "error", "message": {"text": "FastAPI POST `create_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:223"}, "properties": {"repobilityId": "e69534cd91701f74", "scanner": "scanner-primary", "fingerprint": "46cef1c7bff1a4f3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-46732b6d93a825c1", "level": "error", "message": {"text": "FastAPI POST `update_pack_metadata_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:245"}, "properties": {"repobilityId": "7ecfbd204bba5001", "scanner": "scanner-primary", "fingerprint": "46732b6d93a825c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-6b5e504727f9fa93", "level": "error", "message": {"text": "FastAPI POST `generate_pack_story_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:290"}, "properties": {"repobilityId": "c55fcc80115895a6", "scanner": "scanner-primary", "fingerprint": "6b5e504727f9fa93", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-47fccc03d1a957c9", "level": "error", "message": {"text": "FastAPI POST `generate_pack_cover_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:335"}, "properties": {"repobilityId": "9078e6911475b1b7", "scanner": "scanner-primary", "fingerprint": "47fccc03d1a957c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-8e9060d5d1944f8b", "level": "error", "message": {"text": "FastAPI POST `delete_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:375"}, "properties": {"repobilityId": "6c659193ba699165", "scanner": "scanner-primary", "fingerprint": "8e9060d5d1944f8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-297b5fb0a3b55207", "level": "error", "message": {"text": "FastAPI POST `import_image_submit` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:424"}, "properties": {"repobilityId": "03bafdfc532eb428", "scanner": "scanner-primary", "fingerprint": "297b5fb0a3b55207", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 424}}}]}, {"ruleId": "scanner-249eaa4dee83ade8", "level": "error", "message": {"text": "FastAPI POST `publish_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:516"}, "properties": {"repobilityId": "f91d0dd8a2fe69e4", "scanner": "scanner-primary", "fingerprint": "249eaa4dee83ade8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 516}}}]}, {"ruleId": "scanner-e559ed7715280c47", "level": "error", "message": {"text": "FastAPI POST `rollback_pack_page` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:562"}, "properties": {"repobilityId": "ffa9764cdc4370e6", "scanner": "scanner-primary", "fingerprint": "e559ed7715280c47", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 562}}}]}, {"ruleId": "scanner-2293d5aafdd6adb8", "level": "error", "message": {"text": "FastAPI POST `draft_add_custom_word` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:588"}, "properties": {"repobilityId": "1a754758f09d76db", "scanner": "scanner-primary", "fingerprint": "2293d5aafdd6adb8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 588}}}]}, {"ruleId": "scanner-c7279a5947291cec", "level": "error", "message": {"text": "FastAPI POST `draft_delete_word` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:654"}, "properties": {"repobilityId": "b642655e9ce55100", "scanner": "scanner-primary", "fingerprint": "c7279a5947291cec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 654}}}]}, {"ruleId": "scanner-bc2068797272f8b0", "level": "error", "message": {"text": "FastAPI POST `draft_batch_delete_words` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:677"}, "properties": {"repobilityId": "a2549c8358935129", "scanner": "scanner-primary", "fingerprint": "bc2068797272f8b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 677}}}]}, {"ruleId": "scanner-7470aa749ce5e5d4", "level": "error", "message": {"text": "FastAPI POST `draft_split_words` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:708"}, "properties": {"repobilityId": "5b3413f42725be29", "scanner": "scanner-primary", "fingerprint": "7470aa749ce5e5d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 708}}}]}, {"ruleId": "scanner-1e28faac202f89b2", "level": "error", "message": {"text": "FastAPI POST `draft_batch_json` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:761"}, "properties": {"repobilityId": "8226c498f2574e15", "scanner": "scanner-primary", "fingerprint": "1e28faac202f89b2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 761}}}]}, {"ruleId": "scanner-ed7eeca86c14e434", "level": "error", "message": {"text": "FastAPI POST `draft_edit_submit` without auth dependency \u2014 server/app/routers/parent_packs_pages.py:852"}, "properties": {"repobilityId": "3c97a3afe089556f", "scanner": "scanner-primary", "fingerprint": "ed7eeca86c14e434", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_packs_pages.py"}, "region": {"startLine": 852}}}]}, {"ruleId": "scanner-534b171ab3e5f279", "level": "error", "message": {"text": "FastAPI POST `import_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:79"}, "properties": {"repobilityId": "6d8d74cfbe3c3405", "scanner": "scanner-primary", "fingerprint": "534b171ab3e5f279", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/family_lessons.py"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-2ac599e287cc5d7a", "level": "error", "message": {"text": "FastAPI PATCH `patch_lesson_draft` without auth dependency \u2014 server/app/routers/family_lessons.py:192"}, "properties": {"repobilityId": "ef61ba1d38faef9d", "scanner": "scanner-primary", "fingerprint": "2ac599e287cc5d7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/family_lessons.py"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-d2591ba9b7e9779f", "level": "error", "message": {"text": "FastAPI PUT `patch_lesson_draft` without auth dependency \u2014 server/app/routers/family_lessons.py:193"}, "properties": {"repobilityId": "34b766cede37139f", "scanner": "scanner-primary", "fingerprint": "d2591ba9b7e9779f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/family_lessons.py"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-a9dd90a48bb847d2", "level": "error", "message": {"text": "FastAPI POST `approve_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:206"}, "properties": {"repobilityId": "961017f13112b78f", "scanner": "scanner-primary", "fingerprint": "a9dd90a48bb847d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/family_lessons.py"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-ec1ca36fef57aca7", "level": "error", "message": {"text": "FastAPI POST `reject_lesson` without auth dependency \u2014 server/app/routers/family_lessons.py:258"}, "properties": {"repobilityId": "c1e3820d3af44664", "scanner": "scanner-primary", "fingerprint": "ec1ca36fef57aca7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/family_lessons.py"}, "region": {"startLine": 258}}}]}, {"ruleId": "scanner-a8144a29989bde33", "level": "error", "message": {"text": "FastAPI POST `generate_distractors_endpoint` without auth dependency \u2014 server/app/routers/admin_drafts.py:120"}, "properties": {"repobilityId": "053007efc8c5fff5", "scanner": "scanner-primary", "fingerprint": "a8144a29989bde33", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_drafts.py"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-df7d85686d6cd456", "level": "error", "message": {"text": "FastAPI POST `generate_example_endpoint` without auth dependency \u2014 server/app/routers/admin_drafts.py:130"}, "properties": {"repobilityId": "3b1197104e50bad8", "scanner": "scanner-primary", "fingerprint": "df7d85686d6cd456", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_drafts.py"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-84a69f14a42f3d6d", "level": "error", "message": {"text": "FastAPI PATCH `patch_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:208"}, "properties": {"repobilityId": "424f4456824afd7b", "scanner": "scanner-primary", "fingerprint": "84a69f14a42f3d6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_drafts.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-8260e255f4acd5dd", "level": "error", "message": {"text": "FastAPI POST `approve_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:220"}, "properties": {"repobilityId": "d279a20dd777ce2d", "scanner": "scanner-primary", "fingerprint": "8260e255f4acd5dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_drafts.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-c829dc9d93d8c9e7", "level": "error", "message": {"text": "FastAPI POST `reject_draft` without auth dependency \u2014 server/app/routers/admin_drafts.py:249"}, "properties": {"repobilityId": "e06def3c48c6b8cb", "scanner": "scanner-primary", "fingerprint": "c829dc9d93d8c9e7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_drafts.py"}, "region": {"startLine": 249}}}]}, {"ruleId": "scanner-e10541c1da8b26fa", "level": "error", "message": {"text": "FastAPI POST `create_category` without auth dependency \u2014 server/app/routers/admin_categories.py:60"}, "properties": {"repobilityId": "5dd1bdd57f8433cf", "scanner": "scanner-primary", "fingerprint": "e10541c1da8b26fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_categories.py"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-29eda9dc5a447f12", "level": "error", "message": {"text": "FastAPI PUT `update_category` without auth dependency \u2014 server/app/routers/admin_categories.py:83"}, "properties": {"repobilityId": "35b3086267774c44", "scanner": "scanner-primary", "fingerprint": "29eda9dc5a447f12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_categories.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-66bc3ed6d01e46b7", "level": "error", "message": {"text": "FastAPI DELETE `delete_category` without auth dependency \u2014 server/app/routers/admin_categories.py:103"}, "properties": {"repobilityId": "628a9657f650f5f1", "scanner": "scanner-primary", "fingerprint": "66bc3ed6d01e46b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_categories.py"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-0acf9eae732115e0", "level": "error", "message": {"text": "FastAPI POST `upload_illustration` without auth dependency \u2014 server/app/routers/admin_assets.py:51"}, "properties": {"repobilityId": "426697b696d4bb66", "scanner": "scanner-primary", "fingerprint": "0acf9eae732115e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_assets.py"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-f7ddf9263cd6efe1", "level": "error", "message": {"text": "FastAPI DELETE `delete_illustration` without auth dependency \u2014 server/app/routers/admin_assets.py:92"}, "properties": {"repobilityId": "9ca5e81bf7e2f17d", "scanner": "scanner-primary", "fingerprint": "f7ddf9263cd6efe1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_assets.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-a02bd38c02bcc499", "level": "error", "message": {"text": "FastAPI POST `upload_audio` without auth dependency \u2014 server/app/routers/admin_assets.py:108"}, "properties": {"repobilityId": "7b4ef22d29a0da99", "scanner": "scanner-primary", "fingerprint": "a02bd38c02bcc499", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_assets.py"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-0df0b82718e297bf", "level": "error", "message": {"text": "FastAPI DELETE `delete_audio` without auth dependency \u2014 server/app/routers/admin_assets.py:145"}, "properties": {"repobilityId": "ef370a869698c14f", "scanner": "scanner-primary", "fingerprint": "0df0b82718e297bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_assets.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-e3ba7fa99b53335f", "level": "error", "message": {"text": "FastAPI POST `publish_pack_endpoint` without auth dependency \u2014 server/app/routers/admin_packs.py:88"}, "properties": {"repobilityId": "98ed3d4ba0413308", "scanner": "scanner-primary", "fingerprint": "e3ba7fa99b53335f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_packs.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-f83ed71d3ebf89e1", "level": "error", "message": {"text": "FastAPI POST `rollback_pack_endpoint` without auth dependency \u2014 server/app/routers/admin_packs.py:105"}, "properties": {"repobilityId": "6dea85dfdc1b83db", "scanner": "scanner-primary", "fingerprint": "f83ed71d3ebf89e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_packs.py"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-9b2819204c6945ec", "level": "error", "message": {"text": "FastAPI POST `sync_word_stats` without auth dependency \u2014 server/app/routers/child_word_stats.py:40"}, "properties": {"repobilityId": "5d66b8b6a4ef4f66", "scanner": "scanner-primary", "fingerprint": "9b2819204c6945ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/child_word_stats.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-91474a2578756279", "level": "error", "message": {"text": "FastAPI PUT `put_self_profile` without auth dependency \u2014 server/app/routers/child_profile.py:34"}, "properties": {"repobilityId": "ac841ee3dfa617d2", "scanner": "scanner-primary", "fingerprint": "91474a2578756279", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/child_profile.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-909742074c87310b", "level": "error", "message": {"text": "FastAPI POST `create_word` without auth dependency \u2014 server/app/routers/admin_words.py:98"}, "properties": {"repobilityId": "191b4c8893761aac", "scanner": "scanner-primary", "fingerprint": "909742074c87310b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_words.py"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-1e25d5ce50065906", "level": "error", "message": {"text": "FastAPI PUT `update_word` without auth dependency \u2014 server/app/routers/admin_words.py:125"}, "properties": {"repobilityId": "664601ef98009200", "scanner": "scanner-primary", "fingerprint": "1e25d5ce50065906", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_words.py"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-deae5bcff814d6cc", "level": "error", "message": {"text": "FastAPI DELETE `soft_delete_word` without auth dependency \u2014 server/app/routers/admin_words.py:144"}, "properties": {"repobilityId": "516a50af94014b5b", "scanner": "scanner-primary", "fingerprint": "deae5bcff814d6cc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_words.py"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-67cdfd8cfebec748", "level": "error", "message": {"text": "FastAPI POST `scan_words` without auth dependency \u2014 server/app/routers/admin_llm.py:31"}, "properties": {"repobilityId": "b520e8bd7cb02c95", "scanner": "scanner-primary", "fingerprint": "67cdfd8cfebec748", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/admin_llm.py"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-41a1592aa6eac631", "level": "error", "message": {"text": "FastAPI POST `post_password_login` without auth dependency \u2014 server/app/routers/parent_auth.py:68"}, "properties": {"repobilityId": "3b3baac3deed39fe", "scanner": "scanner-primary", "fingerprint": "41a1592aa6eac631", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_auth.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-9f4d7b0762de0a76", "level": "error", "message": {"text": "FastAPI POST `post_request_code` without auth dependency \u2014 server/app/routers/parent_auth.py:114"}, "properties": {"repobilityId": "fa5514c593238a6a", "scanner": "scanner-primary", "fingerprint": "9f4d7b0762de0a76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_auth.py"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-34333360cf9279d6", "level": "error", "message": {"text": "FastAPI POST `post_verify_code` without auth dependency \u2014 server/app/routers/parent_auth.py:146"}, "properties": {"repobilityId": "a64f8eec84fa52a4", "scanner": "scanner-primary", "fingerprint": "34333360cf9279d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_auth.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-e6d43174873d7f2d", "level": "error", "message": {"text": "FastAPI POST `post_logout` without auth dependency \u2014 server/app/routers/parent_auth.py:224"}, "properties": {"repobilityId": "cee365ec657216f6", "scanner": "scanner-primary", "fingerprint": "e6d43174873d7f2d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/parent_auth.py"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-4b4fbdfcf5e67616", "level": "error", "message": {"text": "FastAPI POST `sync_checkins` without auth dependency \u2014 server/app/routers/child_checkins.py:20"}, "properties": {"repobilityId": "88bada05c4ad7950", "scanner": "scanner-primary", "fingerprint": "4b4fbdfcf5e67616", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/child_checkins.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-6536f5fa1e9fab18", "level": "error", "message": {"text": "FastAPI POST `sync_custom` without auth dependency \u2014 server/app/routers/child_wishlist.py:89"}, "properties": {"repobilityId": "d59bbb4fb5422ff1", "scanner": "scanner-primary", "fingerprint": "6536f5fa1e9fab18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/child_wishlist.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-2998e6d9ee7da625", "level": "error", "message": {"text": "FastAPI POST `submit_redemption` without auth dependency \u2014 server/app/routers/child_wishlist.py:110"}, "properties": {"repobilityId": "9ec0babd7cc26815", "scanner": "scanner-primary", "fingerprint": "2998e6d9ee7da625", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/child_wishlist.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-1576fa491f69cfab", "level": "error", "message": {"text": "FastAPI POST `post_unbind` without auth dependency \u2014 server/app/routers/child_wishlist.py:185"}, "properties": {"repobilityId": "44cf06f8fa2297f3", "scanner": "scanner-primary", "fingerprint": "1576fa491f69cfab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routers/child_wishlist.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-5dcc1118d953c6b2", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/public/health"}, "properties": {"repobilityId": "a5ed5cb34cee91c3", "scanner": "scanner-primary", "fingerprint": "5dcc1118d953c6b2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2504727ec901d96a", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/public/packs/latest.json"}, "properties": {"repobilityId": "0f918899491139e1", "scanner": "scanner-primary", "fingerprint": "2504727ec901d96a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4d528a10f4c85bf", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/public/global-packs/latest.json"}, "properties": {"repobilityId": "a590e5c25ce4bf5c", "scanner": "scanner-primary", "fingerprint": "f4d528a10f4c85bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb9507f87ba515ba", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/admin/stats"}, "properties": {"repobilityId": "1b9d9babb80478e3", "scanner": "scanner-primary", "fingerprint": "cb9507f87ba515ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7d4d725cd9ebff8b", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/admin/packs/publish"}, "properties": {"repobilityId": "56fea8d25e4a196d", "scanner": "scanner-primary", "fingerprint": "7d4d725cd9ebff8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0ac5a2d7025b0f4a", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/lesson-drafts"}, "properties": {"repobilityId": "93165243ebc4c4b2", "scanner": "scanner-primary", "fingerprint": "0ac5a2d7025b0f4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-73a3c748a9a68e19", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/lesson-drafts/{draft_id}"}, "properties": {"repobilityId": "0d753fc9bc241ba3", "scanner": "scanner-primary", "fingerprint": "73a3c748a9a68e19", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4473ed7091330700", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/v1/family/{family_id}/lesson-drafts/{draft_id}"}, "properties": {"repobilityId": "f6686002ebc3794e", "scanner": "scanner-primary", "fingerprint": "4473ed7091330700", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84c94297915793ae", "level": "note", "message": {"text": "Unused endpoint: PUT /api/v1/family/{family_id}/lesson-drafts/{draft_id}"}, "properties": {"repobilityId": "088088f5bfbf3347", "scanner": "scanner-primary", "fingerprint": "84c94297915793ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f48a852b082f6d56", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/approve"}, "properties": {"repobilityId": "6d9cbf182e641afa", "scanner": "scanner-primary", "fingerprint": "f48a852b082f6d56", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6bc5e43958e4efff", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/lesson-drafts/{draft_id}/reject"}, "properties": {"repobilityId": "31f07be022239244", "scanner": "scanner-primary", "fingerprint": "6bc5e43958e4efff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-08873464ace25055", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/lessons/import"}, "properties": {"repobilityId": "c0ed33f2fbabdb87", "scanner": "scanner-primary", "fingerprint": "08873464ace25055", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40d0c2bbb5abf440", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/public/pair/redeem"}, "properties": {"repobilityId": "9166c6f3173cd5af", "scanner": "scanner-primary", "fingerprint": "40d0c2bbb5abf440", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-358c97faf54a7428", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/unbind"}, "properties": {"repobilityId": "137b713fdddcfb03", "scanner": "scanner-primary", "fingerprint": "358c97faf54a7428", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aa00a848a43771b5", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/me"}, "properties": {"repobilityId": "1219aeedac6dae40", "scanner": "scanner-primary", "fingerprint": "aa00a848a43771b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d1059ef46d1cd94", "level": "note", "message": {"text": "Unused endpoint: PUT /api/v1/family/{family_id}/profile"}, "properties": {"repobilityId": "8ba11119fc37dda3", "scanner": "scanner-primary", "fingerprint": "6d1059ef46d1cd94", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-48d5a02ca6b18e76", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/_/family-packs/latest.json"}, "properties": {"repobilityId": "3fbed73188855d1d", "scanner": "scanner-primary", "fingerprint": "48d5a02ca6b18e76", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a944a23e581eb73e", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/family-packs/latest.json"}, "properties": {"repobilityId": "c3856f05b777ef12", "scanner": "scanner-primary", "fingerprint": "a944a23e581eb73e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f00e730c04b7d5a", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/_/packs/latest.json"}, "properties": {"repobilityId": "4d16f6c81b4542fc", "scanner": "scanner-primary", "fingerprint": "2f00e730c04b7d5a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dcf2ae10791aa255", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/packs/latest.json"}, "properties": {"repobilityId": "8475ea91b7f16327", "scanner": "scanner-primary", "fingerprint": "dcf2ae10791aa255", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4dcabcbe58829ad0", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/word-stats/sync"}, "properties": {"repobilityId": "0dae4f18afd8ca63", "scanner": "scanner-primary", "fingerprint": "4dcabcbe58829ad0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-56179ff0955aa703", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/word-stats"}, "properties": {"repobilityId": "c9921f16ff4a2ff0", "scanner": "scanner-primary", "fingerprint": "56179ff0955aa703", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6541ef69a343bf8e", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/wishlist"}, "properties": {"repobilityId": "6e2fa2913a9bcd34", "scanner": "scanner-primary", "fingerprint": "6541ef69a343bf8e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fed968798097e3d9", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/wishlist/sync-custom"}, "properties": {"repobilityId": "68a1178af92f3a3d", "scanner": "scanner-primary", "fingerprint": "fed968798097e3d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d9ef6dfd360c690", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/family/{family_id}/redemption-requests"}, "properties": {"repobilityId": "b39eec12f42b9191", "scanner": "scanner-primary", "fingerprint": "1d9ef6dfd360c690", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-96903479db3cc4f6", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/redemption-requests"}, "properties": {"repobilityId": "ee118ce49d4d9caf", "scanner": "scanner-primary", "fingerprint": "96903479db3cc4f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ac764716e266b8b", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/family/{family_id}/redemption-requests/poll"}, "properties": {"repobilityId": "d1b63200c9ad9bf7", "scanner": "scanner-primary", "fingerprint": "3ac764716e266b8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d0943a91e562197", "level": "note", "message": {"text": "Unused endpoint: GET /__mock_state__"}, "properties": {"repobilityId": "4de701f9727adad3", "scanner": "scanner-primary", "fingerprint": "5d0943a91e562197", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "b11a5816f563a5ae", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a4dfcad3eb1618a", "level": "note", "message": {"text": "Unused endpoint: GET /login"}, "properties": {"repobilityId": "717a7a05d213b70e", "scanner": "scanner-primary", "fingerprint": "6a4dfcad3eb1618a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "c2609e0ee8a12bd5", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "f92617e599ddb90d", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f7be24c1900c442", "level": "note", "message": {"text": "Unused endpoint: GET /system-config"}, "properties": {"repobilityId": "ca87ba8955435d87", "scanner": "scanner-primary", "fingerprint": "5f7be24c1900c442", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd97e13821048de4", "level": "note", "message": {"text": "Unused endpoint: POST /system-config/llm-provider"}, "properties": {"repobilityId": "77b3888bc7079ee1", "scanner": "scanner-primary", "fingerprint": "fd97e13821048de4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2464d60cfd2ce421", "level": "note", "message": {"text": "Unused endpoint: POST /system-config/llm-provider/test"}, "properties": {"repobilityId": "e7aefd4aead88c3c", "scanner": "scanner-primary", "fingerprint": "2464d60cfd2ce421", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ebd37eaf190e484", "level": "note", "message": {"text": "Unused endpoint: POST /system-config/image-provider"}, "properties": {"repobilityId": "2ee84ea1da859035", "scanner": "scanner-primary", "fingerprint": "3ebd37eaf190e484", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cecaea219123c22e", "level": "note", "message": {"text": "Unused endpoint: POST /system-config/image-provider/test"}, "properties": {"repobilityId": "dede9154f29a2794", "scanner": "scanner-primary", "fingerprint": "cecaea219123c22e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5766b6a628042997", "level": "note", "message": {"text": "Unused endpoint: GET /feedback"}, "properties": {"repobilityId": "39971e57013bb37d", "scanner": "scanner-primary", "fingerprint": "5766b6a628042997", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-23e18080df98a228", "level": "note", "message": {"text": "Unused endpoint: POST /feedback/{feedback_id}/reply"}, "properties": {"repobilityId": "497c8dd4919cc921", "scanner": "scanner-primary", "fingerprint": "23e18080df98a228", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47e5d1e70de3e24e", "level": "note", "message": {"text": "Unused endpoint: POST /feedback/{feedback_id}/delete"}, "properties": {"repobilityId": "5fa834a242372b9c", "scanner": "scanner-primary", "fingerprint": "47e5d1e70de3e24e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86c100f235135108", "level": "note", "message": {"text": "Unused endpoint: GET /parents"}, "properties": {"repobilityId": "b6f3af5c2280c4c1", "scanner": "scanner-primary", "fingerprint": "86c100f235135108", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d375c34119c44f61", "level": "note", "message": {"text": "Unused endpoint: GET /parents/{username}"}, "properties": {"repobilityId": "71605066076ab573", "scanner": "scanner-primary", "fingerprint": "d375c34119c44f61", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b88a0bd30ec2bdb", "level": "note", "message": {"text": "Unused endpoint: POST /parents/{username}/suspend"}, "properties": {"repobilityId": "928b652ab27b1229", "scanner": "scanner-primary", "fingerprint": "5b88a0bd30ec2bdb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18a7a37c2b006039", "level": "note", "message": {"text": "Unused endpoint: POST /parents/{username}/restore"}, "properties": {"repobilityId": "f523d6e086a17fb3", "scanner": "scanner-primary", "fingerprint": "18a7a37c2b006039", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8ebe817d16c5e42", "level": "note", "message": {"text": "Unused endpoint: GET /devices"}, "properties": {"repobilityId": "0c8f796dbcb22f0a", "scanner": "scanner-primary", "fingerprint": "e8ebe817d16c5e42", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d2f6bf2a18ca3ddb", "level": "note", "message": {"text": "Unused endpoint: GET /devices/{binding_id}/revoke"}, "properties": {"repobilityId": "d72938e18bce3de4", "scanner": "scanner-primary", "fingerprint": "d2f6bf2a18ca3ddb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-154f2a3bf3cdf962", "level": "note", "message": {"text": "Unused endpoint: POST /devices/{binding_id}/revoke"}, "properties": {"repobilityId": "42d2ecd11533e1f4", "scanner": "scanner-primary", "fingerprint": "154f2a3bf3cdf962", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3d7229359bb04def", "level": "note", "message": {"text": "Unused endpoint: GET /devices/{binding_id}/restore"}, "properties": {"repobilityId": "8a294bb990b440fa", "scanner": "scanner-primary", "fingerprint": "3d7229359bb04def", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81c03f43896de832", "level": "note", "message": {"text": "Unused endpoint: POST /devices/{binding_id}/restore"}, "properties": {"repobilityId": "e7a7d02e172de25c", "scanner": "scanner-primary", "fingerprint": "81c03f43896de832", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e035e9b9454ddf1", "level": "note", "message": {"text": "Unused endpoint: GET /global-packs"}, "properties": {"repobilityId": "6c3231c63bbbd79e", "scanner": "scanner-primary", "fingerprint": "5e035e9b9454ddf1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}