Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

selmanays/nodrat

https://github.com/selmanays/nodrat · scanned 2026-06-16 00:07 UTC (2 months, 2 weeks ago)

430 raw signals (212 security + 218 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 199 actionable findings from 2 signal sources. 489 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
54.1
/100
Security checks
54
8 findings
System graph
54
100.0% cov · 191 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: layer: api × excluding tests × Reset all
Severity: Critical 2 High 16 Medium 17 Low 91 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 8 System graph 191 Crowd 0 Layer: Quality 90 Security 16 Software 20 Frontend 16 Hardware 3 Cicd 4 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 54.1/100 with 100.0% coverage. It contains 5438 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 218 findings — concentrated in quality (90), api (50), software (24). Risk profile is high: 0 critical, 13 high, 14 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 50 of 199 actionable findings. 688 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /app/me
`apps/api/app/api/app_me.py` declares `DELETE /app/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /app/me/consent/model-improvement
`apps/api/app/api/app_me.py` declares `DELETE /app/me/consent/model-improvement` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /research/conversations/{conversation_id}
`apps/api/app/api/app_research.py` declares `DELETE /research/conversations/{conversation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`apps/api/app/modules/legal/routes.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/clusters
`apps/api/app/api/admin_clusters.py` declares `GET /admin/clusters` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/clusters/users/{user_id}
`apps/api/app/api/admin_clusters.py` declares `GET /admin/clusters/users/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/benchmark/history
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/benchmark/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/benchmark/status
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/benchmark/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/cache-telemetry
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/cache-telemetry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/citation-stats
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/citation-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/health
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/ner-stats
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/ner-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/pipeline-comparison
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/pipeline-comparison` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/raptor/clusters
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/raptor/clusters` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/rerank-stats
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/rerank-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/rag/ttft-stats
`apps/api/app/api/admin_rag.py` declares `GET /admin/rag/ttft-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/trends
`apps/api/app/api/admin_trends.py` declares `GET /admin/trends` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /app/me
`apps/api/app/api/app_me.py` declares `GET /app/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /app/me/consent/model-improvement
`apps/api/app/api/app_me.py` declares `GET /app/me/consent/model-improvement` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /app/me/export
`apps/api/app/api/app_me.py` declares `GET /app/me/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /app/me/pmf-survey/eligibility
`apps/api/app/api/app_me.py` declares `GET /app/me/pmf-survey/eligibility` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /app/me/research-history
`apps/api/app/api/app_me.py` declares `GET /app/me/research-history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /app/me/research-interests
`apps/api/app/api/app_me.py` declares `GET /app/me/research-interests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /failed
`apps/api/app/modules/ops/admin/queue.py` declares `GET /failed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /hourly
`apps/api/app/modules/ops/admin/dashboard.py` declares `GET /hourly` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /overview
`apps/api/app/modules/ops/admin/queue.py` declares `GET /overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /provider-calls
`apps/api/app/modules/ops/admin/dashboard.py` declares `GET /provider-calls` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /research/conversations
`apps/api/app/api/app_research.py` declares `GET /research/conversations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /research/conversations/{conversation_id}
`apps/api/app/api/app_research.py` declares `GET /research/conversations/{conversation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{ticket_id}
`apps/api/app/modules/legal/routes.py` declares `GET /{ticket_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /app/me
`apps/api/app/api/app_me.py` declares `PATCH /app/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /research/conversations/{conversation_id}
`apps/api/app/api/app_research.py` declares `PATCH /research/conversations/{conversation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting w…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{ticket_id}
`apps/api/app/modules/legal/routes.py` declares `PATCH /{ticket_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /abuse
`apps/api/app/modules/legal/routes.py` declares `POST /abuse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/rag/backfill-country
`apps/api/app/api/admin_rag.py` declares `POST /admin/rag/backfill-country` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/rag/backfill-missing-chunks
`apps/api/app/api/admin_rag.py` declares `POST /admin/rag/backfill-missing-chunks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/rag/benchmark/run
`apps/api/app/api/admin_rag.py` declares `POST /admin/rag/benchmark/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/rag/inspect-query
`apps/api/app/api/admin_rag.py` declares `POST /admin/rag/inspect-query` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/rag/raptor/trigger
`apps/api/app/api/admin_rag.py` declares `POST /admin/rag/raptor/trigger` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /app/me/consent/model-improvement
`apps/api/app/api/app_me.py` declares `POST /app/me/consent/model-improvement` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /app/me/pmf-survey
`apps/api/app/api/app_me.py` declares `POST /app/me/pmf-survey` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /copyright
`apps/api/app/modules/legal/routes.py` declares `POST /copyright` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /failed/bulk-retry
`apps/api/app/modules/ops/admin/queue.py` declares `POST /failed/bulk-retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /jobs/{failed_id}/retry
`apps/api/app/modules/ops/admin/queue.py` declares `POST /jobs/{failed_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /privacy-request
`apps/api/app/modules/legal/routes.py` declares `POST /privacy-request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /research/conversations
`apps/api/app/api/app_research.py` declares `POST /research/conversations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /research/conversations/{conversation_id}/messages
`apps/api/app/api/app_research_stream.py` declares `POST /research/conversations/{conversation_id}/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing o…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /research/messages/{message_id}/action
`apps/api/app/api/app_research.py` declares `POST /research/messages/{message_id}/action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who c…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /research/messages/{message_id}/flag-halu
`apps/api/app/api/app_research.py` declares `POST /research/messages/{message_id}/flag-halu` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting wh…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /takedown
`apps/api/app/modules/legal/routes.py` declares `POST /takedown` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/8c725f15-903f-4dbf-aec1-64ace71eeeec/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/8c725f15-903f-4dbf-aec1-64ace71eeeec/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.