Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

turer73/claude-server

https://github.com/turer73/claude-server · scanned 2026-06-16 00:43 UTC (2 months, 1 week ago)

281 raw signals (113 security + 168 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 172 actionable findings from 2 signal sources. 296 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
55.2
/100
Security checks
55
8 findings
System graph
55
100.0% cov · 164 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 50 Medium 31 Low 74 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 8 System graph 164 Crowd 0 Layer: Quality 39 Security 52 Software 10 Network 17 Hardware 2 Frontend 1 Cicd 1 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 55.2/100 with 100.0% coverage. It contains 3651 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 168 findings — concentrated in security (51), api (50), quality (35). Risk profile is high: 0 critical, 47 high, 28 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 156 of 172 actionable findings. 468 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Practices conf 0.82 10 occurrences Foundry mined mock as real or placeholder: turer73/claude-server
Graph query export: Mock, sample, placeholder, or self-attested behavior treated as real Query id: mock_as_real_or_placeholder Query type: motif_query Intent: Hard negatives for fake completeness and missing real data paths. Motif: mock_as_real_or_placeholder Training usage: hard_negative Graph gol…
10 occurrences
repo-level (10 hits)
critical Security checks security auth conf 0.78 25 occurrences Foundry mined security auth guardrail gaps: turer73/claude-server
Graph query export: Security/auth changes without enough guardrails Query id: security_auth_guardrail_gaps Query type: motif_query Intent: Assumption-check security/auth examples requiring stronger tests or CI. Motif: security_auth_without_guardrails Training usage: assumption_check Graph gold labe…
25 occurrences
repo-level (25 hits)
high Security checks quality Practices conf 0.84 34 occurrences Foundry mined bad chains: turer73/claude-server
Comment chain pattern product: bad_chains Repo: turer73/claude-server Thread: turer73/claude-server#9 Outcome: not_resolved_or_not_observed Thread label: thread_has_human_issue_and_fix_context Source graph label: source_backed_multi_signal_graph Reasons: source_graph_has_real_artifacts, source_grap…
34 occurrences
repo-level (34 hits)
high Security checks quality Quality conf 0.76 10 occurrences Foundry mined schema ui api mismatch: turer73/claude-server
Graph query export: Schema, UI, and API mismatch Query id: schema_ui_api_mismatch Query type: motif_query Intent: Assumption-check examples for data-path consistency across layers. Motif: schema_ui_api_mismatch Training usage: assumption_check Graph gold label: supported_by_high_confidence_link Rep…
10 occurrences
repo-level (10 hits)
high Security checks quality Testing conf 0.78 29 occurrences Foundry mined test ci gap after feedback: turer73/claude-server
Graph query export: Feedback exposes missing tests or CI Query id: test_ci_gap_after_feedback Query type: motif_query Intent: Hard negatives for feedback/fix chains without adequate guardrails. Motif: test_ci_gap_after_feedback Training usage: hard_negative Graph gold label: supported_by_high_confi…
29 occurrences
repo-level (29 hits)
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: CLAUDE.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
CLAUDE.md:67 SecretsClaude instruction
high System graph security auth conf 1.00 FastAPI DELETE `deactivate_memory` without auth dependency — app/api/memory.py:466
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:466 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `deactivate_memory` without auth dependency — extensions/polymem/src/polymem/routes/memories.py:76
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/memories.py:76 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_device_project` without auth dependency — extensions/polymem/src/polymem/routes/devices.py:125
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/devices.py:125 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_device` without auth dependency — extensions/polymem/src/polymem/routes/devices.py:76
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/devices.py:76 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_session` without auth dependency — extensions/polymem/src/polymem/routes/sessions.py:83
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/sessions.py:83 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_task_log` without auth dependency — app/api/memory.py:607
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:607 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `approve_and_schedule` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:200
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:200 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `archive_stale` without auth dependency — app/api/memory.py:1180
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:1180 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `ask` without auth dependency — app/api/rag.py:280
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/rag.py:280 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `check_comments_and_notify` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:463
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:463 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_discovery` without auth dependency — app/api/memory.py:672
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:672 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_memory` without auth dependency — app/api/memory.py:401
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:401 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_memory` without auth dependency — extensions/polymem/src/polymem/routes/memories.py:47
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/memories.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_note` without auth dependency — app/api/memory.py:957
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:957 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_session` without auth dependency — app/api/memory.py:514
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:514 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_session` without auth dependency — extensions/polymem/src/polymem/routes/sessions.py:59
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/sessions.py:59 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_task_log` without auth dependency — app/api/memory.py:576
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:576 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `feedback_generate` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:353
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:353 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate_week_auto` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:315
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:315 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:113
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:113 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `publish_scheduled` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:192
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:192 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `publish` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:186
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:186 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `quality_gate` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:306
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:306 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `quality_gate` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:307
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:307 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `receive_violations` without auth dependency — app/api/csp.py:47
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/csp.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `refresh_screenshots` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:454
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:454 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `research_ask` without auth dependency — app/api/research.py:402
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/research.py:402 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `research_run` without auth dependency — app/api/research.py:557
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/research.py:557 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `resolve_violation` without auth dependency — app/api/csp.py:139
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/csp.py:139 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `retry_spawn_failure` without auth dependency — app/api/memory.py:1230
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:1230 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `run_scan` without auth dependency — app/api/security.py:110
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/security.py:110 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `search` without auth dependency — app/api/rag.py:235
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/rag.py:235 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `smart_approve` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:393
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:393 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `take_screenshots` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:446
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:446 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `telegram_update` without auth dependency — app/api/telegram_bot.py:390
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/telegram_bot.py:390 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `token_refresh` without auth dependency — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:100
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:100 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `upsert_device_project` without auth dependency — extensions/polymem/src/polymem/routes/devices.py:98
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/devices.py:98 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `mark_note_read` without auth dependency — app/api/memory.py:1012
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:1012 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `mark_note_unread` without auth dependency — app/api/memory.py:1023
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:1023 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `mark_read` without auth dependency — extensions/polymem/src/polymem/routes/memories.py:88
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/memories.py:88 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `resolve_discovery` without auth dependency — app/api/memory.py:766
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:766 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `resolve_finding` without auth dependency — app/api/security.py:220
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/security.py:220 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_discovery` without auth dependency — app/api/memory.py:739
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:739 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_memory` without auth dependency — app/api/memory.py:445
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/memory.py:445 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_memory` without auth dependency — extensions/polymem/src/polymem/routes/memories.py:61
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
extensions/polymem/src/polymem/routes/memories.py:61 securityAuth fastapi unauth mutation
high System graph security security conf 1.00 Insecure pattern 'exec_used' in CLAUDE.md:83
Found a known-risky pattern (exec_used). Review and replace if possible.
CLAUDE.md:83 Exec used
medium Security checks quality Practices conf 0.62 73 occurrences Foundry mined assumption checks: turer73/claude-server
Comment chain pattern product: assumption_checks Repo: turer73/claude-server Thread: turer73/claude-server#99 Outcome: ambiguous_needs_more_evidence Thread label: thread_has_human_issue_and_fix_context Source graph label: source_backed_multi_signal_graph Reasons: source_graph_has_real_artifacts, so…
73 occurrences
repo-level (73 hits)
medium Security checks quality maintenance conf 0.70 73 occurrences Foundry mined blueprint gap alignment: turer73/claude-server
Graph query export: Human feedback aligned with blueprint or architecture gaps Query id: blueprint_gap_alignment Query type: motif_query Intent: Curriculum-gap examples connecting issue threads to helicopter-view gaps. Motif: blueprint_gap_alignment Training usage: curriculum_gap Graph gold label: …
73 occurrences
repo-level (73 hits)
medium Security checks quality Practices conf 0.70 46 occurrences Foundry mined unresolved feedback: turer73/claude-server
Graph query export: Human feedback without linked fix evidence Query id: unresolved_feedback Query type: motif_query Intent: Negative/unresolved examples that should not be hallucinated into fixes. Motif: unlinked_feedback_needs_evidence Training usage: negative_or_unresolved Graph gold label: weak…
46 occurrences
repo-level (46 hits)
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
codecov/codecov-action@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/ci.yml:78 CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in app/claude_ui/index.html:147
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
app/claude_ui/index.html:147 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in app/dashboard/index.html:653
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
app/dashboard/index.html:653 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in app/claude_ui/index.html:112
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
app/claude_ui/index.html:112 Local storage auth token
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in app/dashboard/index.html:694
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
app/dashboard/index.html:694 Local storage auth token
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — app/api/research.py:215
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — infra/panola-social-patches/patches/PSOC-20260531-02-async-rotation/webhook_server.py:154
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/content-editor.py:406
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/handoff.py:177
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/rag_index_bilge.py:176
`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph network Security conf 1.00 Privileged port 10 in use
Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/social-weekly-generate.sh Ports
medium System graph network Security conf 1.00 Privileged port 11 in use
Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/social-auto-approve.sh Ports
medium System graph network Security conf 1.00 Privileged port 15 in use
Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
scripts/memory-triage.sh Ports
medium System graph network Security conf 1.00 Privileged port 18 in use
Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/backup-monitor.sh Ports
medium System graph network Security conf 1.00 Privileged port 19 in use
Port 19 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
scripts/klipper-cron-wrap.sh Ports
medium System graph network Security conf 1.00 Privileged port 2 in use
Port 2 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/pull-vps-backup.sh Ports
medium System graph network Security conf 1.00 Privileged port 23 in use
Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/social-renderhane-balance-alert.sh Ports
medium System graph network Security conf 1.00 Privileged port 239 in use
Port 239 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/bilge-arena-failover.sh Ports
medium System graph network Security conf 1.00 Privileged port 3 in use
Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/pull-vps-backup.sh Ports
medium System graph network Security conf 1.00 Privileged port 30 in use
Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
scripts/memory-triage.sh Ports
medium System graph network Security conf 1.00 Privileged port 4 in use
Port 4 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/pull-vps-backup.sh Ports
medium System graph network Security conf 1.00 Privileged port 45 in use
Port 45 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/ad-advisor.sh Ports
medium System graph network Security conf 1.00 Privileged port 49 in use
Port 49 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
scripts/klipper-event.sh Ports
medium System graph network Security conf 1.00 Privileged port 517 in use
Port 517 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
scripts/klipper-cron-wrap.sh Ports
medium System graph network Security conf 1.00 Privileged port 55 in use
Port 55 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/pull-vps-backup.sh Ports
medium System graph network Security conf 1.00 Privileged port 6 in use
Port 6 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
automation/autonomous-daily-summary.sh Ports
low System graph quality Integrity conf 1.00 68 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `ADSENSE_CLAUDE_TIMEOUT`, `ADSENSE_MIN_HOME_CHARS`, `ADSENSE_MIN_PAGES`, `ADSENSE_STATE_FILE`, `AD_CLAUDE_TIMEOUT`, `AD_DAYS`, `AD_LOWCTR_MAX`, `AD_MIN_IMP_LOWCTR` + 60 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn…
config drift
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 355 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 2 occurrences Docker base image is tag-pinned but not digest-pinned: python:3.11-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
lines 2, 9
Dockerfile:2, 9 (2 hits)
containersPinned dependencies
low System graph quality Integrity conf 1.00 4 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: scripts/rag_index_project.py:embed, scripts/rag_index_bilge_code.py:embed This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
4 occurrences
repo-level (4 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in app/api/backup.py:22
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in app/api/webhooks.py:114
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in app/core/backup_manager.py:42
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `fts_old` in tests/test_research.py:517
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `restore_backup` in tests/test_security_batch2.py:48
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_create_backup` in tests/test_backup.py:23
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: claude_then_aya
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/api/research.py:259
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_banner
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/hooks/cosession.py:307
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_check
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/handoff.py:246
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_end
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/hooks/cosession.py:481
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_estimate
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/handoff.py:116
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_prune
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/hooks/cosession.py:497
low System graph software Dead code conf 1.00 Possibly dead Python function: cmd_wait
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/handoff.py:220
low System graph software Dead code conf 1.00 Possibly dead Python function: verify_key
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/api/memory.py:27
low System graph software Dead code conf 1.00 Possibly dead Python function: verify_key
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/api/dispatch.py:20
low System graph software Dead code conf 1.00 Possibly dead Python function: verify_pentest_key
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/api/security.py:42
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: ANY /{service}/{path:path}
`app/api/webops.py` declares `ANY /{service}/{path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /delete
`app/api/backup.py` declares `DELETE /delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /projects/{name}
`app/api/deploy.py` declares `DELETE /projects/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /alerts
`app/api/devops.py` declares `GET /alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /alerts/history
`app/api/devops.py` declares `GET /alerts/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/v1/health
`app/main.py` declares `GET /api/v1/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /audit
`app/api/projects.py` declares `GET /audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /claude
`app/main.py` declares `GET /claude` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /connections
`app/api/network.py` declares `GET /connections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /dashboard
`app/main.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /git/diff
`app/api/dev.py` declares `GET /git/diff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /git/log
`app/api/dev.py` declares `GET /git/log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /git/status
`app/api/dev.py` declares `GET /git/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /governor
`app/api/kernel.py` declares `GET /governor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /interfaces
`app/api/network.py` declares `GET /interfaces` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /list
`app/api/backup.py` declares `GET /list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /me
`app/api/auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /memory/context
`app/api/deploy.py` declares `GET /memory/context` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /playbooks
`app/api/devops.py` declares `GET /playbooks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /projects
`app/api/deploy.py` declares `GET /projects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /projects/{name}
`app/api/deploy.py` declares `GET /projects/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /ready
`app/main.py` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /remediation/log
`app/api/devops.py` declares `GET /remediation/log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /services
`app/api/webops.py` declares `GET /services` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sessions
`app/api/claude_code.py` declares `GET /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /ui
`app/api/claude_code.py` declares `GET /ui` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /vps/latest
`app/api/devops.py` declares `GET /vps/latest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /vps/metrics/history
`app/api/devops.py` declares `GET /vps/metrics/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /workspace/notes
`app/api/deploy.py` declares `GET /workspace/notes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /workspace/notes/{name}
`app/api/deploy.py` declares `GET /workspace/notes/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /alerts/check
`app/api/monitoring.py` declares `POST /alerts/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /create
`app/api/backup.py` declares `POST /create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /deploy/{project}
`app/api/vps.py` declares `POST /deploy/{project}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /dns
`app/api/network.py` declares `POST /dns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /exec
`app/api/vps.py` declares `POST /exec` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /fix
`app/api/ci.py` declares `POST /fix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /git/commit
`app/api/dev.py` declares `POST /git/commit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /projects/register
`app/api/deploy.py` declares `POST /projects/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /projects/{name}/deploy
`app/api/deploy.py` declares `POST /projects/{name}/deploy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /remediate/force
`app/api/devops.py` declares `POST /remediate/force` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /request
`app/api/network.py` declares `POST /request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /restore
`app/api/backup.py` declares `POST /restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /run
`app/api/claude_code.py` declares `POST /run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /run-all
`app/api/ci.py` declares `POST /run-all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /self
`app/api/deploy.py` declares `POST /self` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sync
`app/api/projects.py` declares `POST /sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /test
`app/api/ci.py` declares `POST /test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /token
`app/api/auth.py` declares `POST /token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /workspace/notes
`app/api/deploy.py` declares `POST /workspace/notes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /governor
`app/api/kernel.py` declares `PUT /governor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: app/api/memory.py (1434 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: app/core/devops_agent.py (1220 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/8b7e1269-d7df-4812-835c-01ec4fae8473/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/8b7e1269-d7df-4812-835c-01ec4fae8473/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.