{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a547c316b44b21ae", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/CartDrawer.tsx:762", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/CartDrawer.tsx:762"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4ed24b1cc60c7e94", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/BulkOrderForm.tsx:180", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/BulkOrderForm.tsx:180"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f487586b76d9672a", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/PremiumSections.tsx:684", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/PremiumSections.tsx:684"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90f5167bd48cc7aa", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/CustomerExperience.tsx:344", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/CustomerExperience.tsx:344"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31a6a9aba8204f1f", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/MatchaMoments.tsx:177", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/MatchaMoments.tsx:177"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cf54f874aadf83cf", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/page.tsx:17", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/page.tsx:17"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-285998434833a334", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-vs-coffee/page.tsx:55", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-vs-coffee/page.tsx:55"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1c5280567b1e22f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-vs-green-tea/page.tsx:42", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-vs-green-tea/page.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d84a05e15ee4d13b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/how-to-make-matcha/page.tsx:43", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/how-to-make-matcha/page.tsx:43"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8e8ccf4d2a0b62c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/buy-matcha-india/page.tsx:44", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/buy-matcha-india/page.tsx:44"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d295df28e3caaa35", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/subscription/page.tsx:43", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/subscription/page.tsx:43"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58ca08382fd95697", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-latte-recipe/page.tsx:43", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-latte-recipe/page.tsx:43"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f4f3476305463eb", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/ceremonial-matcha/page.tsx:42", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/ceremonial-matcha/page.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4eb59c9f493e868e", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-for-focus/page.tsx:43", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-for-focus/page.tsx:43"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-923944528966ea53", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/reviews/page.tsx:18", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/reviews/page.tsx:18"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb6f3cb6d0d0c354", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-weight-loss/page.tsx:43", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-weight-loss/page.tsx:43"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c622daccfc1e6a5", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/japanese-tea-rituals/page.tsx:42", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/japanese-tea-rituals/page.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2aa344c263baf209", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/recipes/page.tsx:31", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/recipes/page.tsx:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d990c8366c779818", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx:87", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx:87"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4fd473a68f71da9", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/subscribe/page.tsx:31", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/subscribe/page.tsx:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-746a883fd8adeca4", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-benefits/page.tsx:42", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-benefits/page.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d68c9cd791e7d4ff", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/rituals/daily-focus/page.tsx:42", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/rituals/daily-focus/page.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11e4f8d0b61b0c1d", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/shop/page.tsx:31", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/shop/page.tsx:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24beab63034f56a5", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/story/page.tsx:31", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/story/page.tsx:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c12ea9c2d69abc3", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/bulk-orders/page.tsx:31", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/bulk-orders/page.tsx:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea57755d80fce5af", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-guide/page.tsx:58", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-guide/page.tsx:58"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee5392aa76e2d413", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/layout.tsx:94", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/layout.tsx:94"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-38155f9813be1113", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/orders/[id]/page.tsx:191", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/orders/[id]/page.tsx:191"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e30e9414a63462c", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/popup-messages/page.tsx:205", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/popup-messages/page.tsx:205"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f951480022eb722b", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/products/page.tsx:391", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/products/page.tsx:391"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18b82fac9ffbdc90", "name": "Stray `console.log` in TS/JS \u2014 tests/global.setup.ts:75", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/global.setup.ts:75"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebc3508857760d7b", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65efbf423e638988", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d2a6283f9ebab24", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f9a221a2dd635a3", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/page.tsx:17", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/page.tsx:17"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-142081a301b9238a", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-vs-coffee/page.tsx:55", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-vs-coffee/page.tsx:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bafebb8c686bafb", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-vs-green-tea/page.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-vs-green-tea/page.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d258d421cf2be1f8", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/how-to-make-matcha/page.tsx:43", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/how-to-make-matcha/page.tsx:43"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed2467bf3e6fb56f", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/buy-matcha-india/page.tsx:44", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/buy-matcha-india/page.tsx:44"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a94663a8925fc88", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/subscription/page.tsx:43", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/subscription/page.tsx:43"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6d358d24cb31731", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-latte-recipe/page.tsx:43", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-latte-recipe/page.tsx:43"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a26b6d2558230199", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/ceremonial-matcha/page.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/ceremonial-matcha/page.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0734fca9acf0c71b", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-for-focus/page.tsx:43", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-for-focus/page.tsx:43"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cfc16ce6b46b6cd", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/reviews/page.tsx:18", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/reviews/page.tsx:18"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15ae878ea9d274a6", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-weight-loss/page.tsx:43", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-weight-loss/page.tsx:43"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b4afbdd1e7aaa50", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/japanese-tea-rituals/page.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/japanese-tea-rituals/page.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3411ff8a12f04f2", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/recipes/page.tsx:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/recipes/page.tsx:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad0841fbed7f265e", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx:87", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx:87"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0350b802abc04290", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/subscribe/page.tsx:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/subscribe/page.tsx:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66850cd74f16aaf0", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-benefits/page.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-benefits/page.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e41762b80cf6d07", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/rituals/daily-focus/page.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/rituals/daily-focus/page.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a909648bb0a868ce", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/shop/page.tsx:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/shop/page.tsx:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9555e0aca8555bd", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/story/page.tsx:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/story/page.tsx:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af65ad15519790d8", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/bulk-orders/page.tsx:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/bulk-orders/page.tsx:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8053945372e2feb0", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-guide/page.tsx:58", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-guide/page.tsx:58"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-656f371c39e217c3", "name": "Insecure pattern 'local_storage_auth_token' in frontend/customer/src/context/AuthContext.tsx:59", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/customer/src/context/AuthContext.tsx:59"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bee08d29caf1bf0a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/admin/src/context/AuthContext.tsx:52", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/admin/src/context/AuthContext.tsx:52"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-922ed9565b78a549", "name": "Very large file: frontend/customer/src/components/CartDrawer.tsx (1254 lines)", "shortDescription": {"text": "Very large file: frontend/customer/src/components/CartDrawer.tsx (1254 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f03f887ca488fceb", "name": "Very large file: frontend/customer/src/components/PremiumSections.tsx (2425 lines)", "shortDescription": {"text": "Very large file: frontend/customer/src/components/PremiumSections.tsx (2425 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e743d18982723974", "name": "Very large file: frontend/customer/src/components/CustomerExperience.tsx (1369 lines)", "shortDescription": {"text": "Very large file: frontend/customer/src/components/CustomerExperience.tsx (1369 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "20 test file(s) for 285 source file(s) (ratio 0.07). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 170 placeholder/mock markers across 32 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e9139b9d5cdb3f84", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/CartDrawer.tsx:279", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/CartDrawer.tsx:279"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7091b22c8cd58306", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/PremiumSections.tsx:1231", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/PremiumSections.tsx:1231"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4e601a59339d050", "name": "Legacy-named symbol `suko_popup_seen_v1` in frontend/customer/src/components/EmailPopup.tsx:11", "shortDescription": {"text": "Legacy-named symbol `suko_popup_seen_v1` in frontend/customer/src/components/EmailPopup.tsx:11"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f34c675ceddf41e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/MatchaMoments.tsx:65", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/MatchaMoments.tsx:65"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9058cd266c37c9cd", "name": "Legacy-named symbol `suko_cart_v1` in frontend/customer/src/context/CartContext.tsx:5", "shortDescription": {"text": "Legacy-named symbol `suko_cart_v1` in frontend/customer/src/context/CartContext.tsx:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c3601298ac5c754", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/admin/src/app/(protected)/recipes/page.tsx:153", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/admin/src/app/(protected)/recipes/page.tsx:153"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88b884b9f40af884", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/admin/src/app/(protected)/products/page.tsx:234", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/admin/src/app/(protected)/products/page.tsx:234"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e60071e2a349b848", "name": "Legacy-named symbol `suko_cart_v1` in tests/customer/checkout.spec.ts:37", "shortDescription": {"text": "Legacy-named symbol `suko_cart_v1` in tests/customer/checkout.spec.ts:37"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0b5e7cb1208a7cd", "name": "13 env vars used in code but missing from .env.example", "shortDescription": {"text": "13 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CI`, `CORS_ORIGINS`, `DELHIVERY_BASE_URL`, `DELHIVERY_PICKUP_LOCATION`, `DELHIVERY_TOKEN`, `DELHIVERY_WAREHOUSE_ADDRESS`, `DELHIVERY_WAREHOUSE_CITY`, `DELHIVERY_WAREHOUSE_NAME` + 5 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f481de87213d191e", "name": "Dangling fetch: GET https://api.postalpincode.in/pincode/${pin} (frontend/customer/src/components/CartDrawer.tsx:279)", "shortDescription": {"text": "Dangling fetch: GET https://api.postalpincode.in/pincode/${pin} (frontend/customer/src/components/CartDrawer.tsx:279)"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx:279` calls `GET https://api.postalpincode.in/pincode/${pin}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.postalpincode.in/pincode/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d847f3c681259917", "name": "Dangling fetch: GET https://nominatim.openstreetmap.org/reverse?lat=${coords.latitude}&lon=${coords.longitude}&format=js", "shortDescription": {"text": "Dangling fetch: GET https://nominatim.openstreetmap.org/reverse?lat=${coords.latitude}&lon=${coords.longitude}&format=jsonv2&addressdetails=1&zoom=18 (frontend/customer/src/components/CartDrawer.tsx:472)"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx:472` calls `GET https://nominatim.openstreetmap.org/reverse?lat=${coords.latitude}&lon=${coords.longitude}&format=jsonv2&addressdetails=1&zoom=18` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/nominatim.openstreetmap.org/reverse`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7afac5fca50f1df7", "name": "Unused endpoint: POST /coupons/validate", "shortDescription": {"text": "Unused endpoint: POST /coupons/validate"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx` declares `POST /coupons/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6385cd0e163a390f", "name": "Unused endpoint: POST /checkout", "shortDescription": {"text": "Unused endpoint: POST /checkout"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx` declares `POST /checkout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6944a3c31294f3a0", "name": "Unused endpoint: POST /payments/verify", "shortDescription": {"text": "Unused endpoint: POST /payments/verify"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx` declares `POST /payments/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3cc37d951d5c216", "name": "Unused endpoint: POST /matcha-finder/events", "shortDescription": {"text": "Unused endpoint: POST /matcha-finder/events"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx` declares `POST /matcha-finder/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0578faf02c604a46", "name": "Unused endpoint: POST /subscriptions", "shortDescription": {"text": "Unused endpoint: POST /subscriptions"}, "fullDescription": {"text": "`frontend/customer/src/components/CartDrawer.tsx` declares `POST /subscriptions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9b23ce801190f80", "name": "Unused endpoint: POST /bulk-orders", "shortDescription": {"text": "Unused endpoint: POST /bulk-orders"}, "fullDescription": {"text": "`frontend/customer/src/components/BulkOrderForm.tsx` declares `POST /bulk-orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49ebdd6f803d023e", "name": "Unused endpoint: POST /reviews", "shortDescription": {"text": "Unused endpoint: POST /reviews"}, "fullDescription": {"text": "`frontend/customer/src/components/PremiumSections.tsx` declares `POST /reviews` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5da9aa5ee4a0635c", "name": "Unused endpoint: POST /moments", "shortDescription": {"text": "Unused endpoint: POST /moments"}, "fullDescription": {"text": "`frontend/customer/src/components/PremiumSections.tsx` declares `POST /moments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e79039ad8da0927c", "name": "Unused endpoint: POST /reminders", "shortDescription": {"text": "Unused endpoint: POST /reminders"}, "fullDescription": {"text": "`frontend/customer/src/components/PremiumSections.tsx` declares `POST /reminders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2fe5b92648ca462", "name": "Unused endpoint: POST /auth/forgot-password", "shortDescription": {"text": "Unused endpoint: POST /auth/forgot-password"}, "fullDescription": {"text": "`frontend/customer/src/components/AuthModal.tsx` declares `POST /auth/forgot-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccadf58fea366726", "name": "Unused endpoint: POST /auth/verify-email", "shortDescription": {"text": "Unused endpoint: POST /auth/verify-email"}, "fullDescription": {"text": "`frontend/customer/src/components/AuthModal.tsx` declares `POST /auth/verify-email` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff5660488b9ce2ca", "name": "Unused endpoint: POST /auth/resend-verification", "shortDescription": {"text": "Unused endpoint: POST /auth/resend-verification"}, "fullDescription": {"text": "`frontend/customer/src/components/AuthModal.tsx` declares `POST /auth/resend-verification` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e02b004f1763361", "name": "Unused endpoint: POST /email-signup", "shortDescription": {"text": "Unused endpoint: POST /email-signup"}, "fullDescription": {"text": "`frontend/customer/src/components/EmailPopup.tsx` declares `POST /email-signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-deb8df763a50c73a", "name": "Unused endpoint: POST /auth/reset-password", "shortDescription": {"text": "Unused endpoint: POST /auth/reset-password"}, "fullDescription": {"text": "`frontend/customer/src/app/auth/reset-password/page.tsx` declares `POST /auth/reset-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fdbacfe9430a6ed", "name": "Unused endpoint: POST /auth/login", "shortDescription": {"text": "Unused endpoint: POST /auth/login"}, "fullDescription": {"text": "`frontend/customer/src/context/AuthContext.tsx` declares `POST /auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8292c0931391749a", "name": "Unused endpoint: POST /auth/register", "shortDescription": {"text": "Unused endpoint: POST /auth/register"}, "fullDescription": {"text": "`frontend/customer/src/context/AuthContext.tsx` declares `POST /auth/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac42422b23e45104", "name": "Unused endpoint: GET /auth/me", "shortDescription": {"text": "Unused endpoint: GET /auth/me"}, "fullDescription": {"text": "`frontend/customer/src/context/AuthContext.tsx` declares `GET /auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d931a3c5303f26ad", "name": "Unused endpoint: POST /admin/setup/forgot-password", "shortDescription": {"text": "Unused endpoint: POST /admin/setup/forgot-password"}, "fullDescription": {"text": "`frontend/admin/src/app/login/page.tsx` declares `POST /admin/setup/forgot-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9252acc452949e93", "name": "Unused endpoint: POST /admin/shipping/schedule-pickup", "shortDescription": {"text": "Unused endpoint: POST /admin/shipping/schedule-pickup"}, "fullDescription": {"text": "`frontend/admin/src/app/(protected)/shipping/page.tsx` declares `POST /admin/shipping/schedule-pickup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f46b53ccd2e4b62", "name": "Unused endpoint: POST /admin/setup", "shortDescription": {"text": "Unused endpoint: POST /admin/setup"}, "fullDescription": {"text": "`frontend/admin/src/app/setup/page.tsx` declares `POST /admin/setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ec1e702837cb525", "name": "Unused endpoint: GET /users/profile", "shortDescription": {"text": "Unused endpoint: GET /users/profile"}, "fullDescription": {"text": "`backend/src/modules/users/users.controller.ts` declares `GET /users/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c7d57ce82505f0b", "name": "Unused endpoint: PUT /users/profile", "shortDescription": {"text": "Unused endpoint: PUT /users/profile"}, "fullDescription": {"text": "`backend/src/modules/users/users.controller.ts` declares `PUT /users/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe95f49a50492dde", "name": "Unused endpoint: GET /users/addresses", "shortDescription": {"text": "Unused endpoint: GET /users/addresses"}, "fullDescription": {"text": "`backend/src/modules/users/users.controller.ts` declares `GET /users/addresses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b036f31f7a701ba5", "name": "Unused endpoint: POST /users/addresses", "shortDescription": {"text": "Unused endpoint: POST /users/addresses"}, "fullDescription": {"text": "`backend/src/modules/users/users.controller.ts` declares `POST /users/addresses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-149275828ac3ee59", "name": "Unused endpoint: PUT /users/addresses/:id/default", "shortDescription": {"text": "Unused endpoint: PUT /users/addresses/:id/default"}, "fullDescription": {"text": "`backend/src/modules/users/users.controller.ts` declares `PUT /users/addresses/:id/default` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c395ce6ee1f865b7", "name": "Unused endpoint: DELETE /users/addresses/:id", "shortDescription": {"text": "Unused endpoint: DELETE /users/addresses/:id"}, "fullDescription": {"text": "`backend/src/modules/users/users.controller.ts` declares `DELETE /users/addresses/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9350031e84a881c0", "name": "Unused endpoint: POST /orders/create", "shortDescription": {"text": "Unused endpoint: POST /orders/create"}, "fullDescription": {"text": "`backend/src/modules/orders/orders.controller.ts` declares `POST /orders/create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0469dbf43c1a9621", "name": "Unused endpoint: GET /orders/:id", "shortDescription": {"text": "Unused endpoint: GET /orders/:id"}, "fullDescription": {"text": "`backend/src/modules/orders/orders.controller.ts` declares `GET /orders/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3829ad58eb373d9e", "name": "Unused endpoint: DELETE /orders/:id/cancel", "shortDescription": {"text": "Unused endpoint: DELETE /orders/:id/cancel"}, "fullDescription": {"text": "`backend/src/modules/orders/orders.controller.ts` declares `DELETE /orders/:id/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a4d2697fca0bbd4", "name": "Unused endpoint: GET /matcha-finder/config", "shortDescription": {"text": "Unused endpoint: GET /matcha-finder/config"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `GET /matcha-finder/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e669ea566e741de", "name": "Unused endpoint: POST /matcha-finder/recommend", "shortDescription": {"text": "Unused endpoint: POST /matcha-finder/recommend"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `POST /matcha-finder/recommend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2397f6240c85bf73", "name": "Unused endpoint: GET /matcha-finder/goals", "shortDescription": {"text": "Unused endpoint: GET /matcha-finder/goals"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `GET /matcha-finder/goals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14cc84640b3fda14", "name": "Unused endpoint: POST /matcha-finder/goals", "shortDescription": {"text": "Unused endpoint: POST /matcha-finder/goals"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `POST /matcha-finder/goals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-220dbce907ade45b", "name": "Unused endpoint: PATCH /matcha-finder/goals/:id", "shortDescription": {"text": "Unused endpoint: PATCH /matcha-finder/goals/:id"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `PATCH /matcha-finder/goals/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bcd77e618d4d8f09", "name": "Unused endpoint: DELETE /matcha-finder/goals/:id", "shortDescription": {"text": "Unused endpoint: DELETE /matcha-finder/goals/:id"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `DELETE /matcha-finder/goals/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75900fb01dad5ddf", "name": "Unused endpoint: GET /matcha-finder/experience-rules", "shortDescription": {"text": "Unused endpoint: GET /matcha-finder/experience-rules"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `GET /matcha-finder/experience-rules` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2a4ea39f345da8b", "name": "Unused endpoint: PUT /matcha-finder/experience-rules", "shortDescription": {"text": "Unused endpoint: PUT /matcha-finder/experience-rules"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `PUT /matcha-finder/experience-rules` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a040e5ff0d24d798", "name": "Unused endpoint: GET /matcha-finder/stats", "shortDescription": {"text": "Unused endpoint: GET /matcha-finder/stats"}, "fullDescription": {"text": "`backend/src/modules/matcha-finder/matcha-finder.controller.ts` declares `GET /matcha-finder/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9f0c712241895d", "name": "Unused endpoint: GET /auth/google", "shortDescription": {"text": "Unused endpoint: GET /auth/google"}, "fullDescription": {"text": "`backend/src/modules/auth/auth.controller.ts` declares `GET /auth/google` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-392dcbd9c0e4ed85", "name": "Unused endpoint: GET /auth/google/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/google/callback"}, "fullDescription": {"text": "`backend/src/modules/auth/auth.controller.ts` declares `GET /auth/google/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eec5e71edccf67e6", "name": "Unused endpoint: PATCH /popup-messages/:id", "shortDescription": {"text": "Unused endpoint: PATCH /popup-messages/:id"}, "fullDescription": {"text": "`backend/src/modules/popup-messages/popup-messages.controller.ts` declares `PATCH /popup-messages/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d558ff839e109f", "name": "Unused endpoint: DELETE /popup-messages/:id", "shortDescription": {"text": "Unused endpoint: DELETE /popup-messages/:id"}, "fullDescription": {"text": "`backend/src/modules/popup-messages/popup-messages.controller.ts` declares `DELETE /popup-messages/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c420fe1a53f3321", "name": "Unused endpoint: GET /reviews/admin", "shortDescription": {"text": "Unused endpoint: GET /reviews/admin"}, "fullDescription": {"text": "`backend/src/modules/reviews/reviews.controller.ts` declares `GET /reviews/admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed01ced8b2dec57f", "name": "Unused endpoint: DELETE /reviews/:id", "shortDescription": {"text": "Unused endpoint: DELETE /reviews/:id"}, "fullDescription": {"text": "`backend/src/modules/reviews/reviews.controller.ts` declares `DELETE /reviews/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d712350888cba552", "name": "Unused endpoint: PATCH /coupons/:id/toggle", "shortDescription": {"text": "Unused endpoint: PATCH /coupons/:id/toggle"}, "fullDescription": {"text": "`backend/src/modules/coupons/coupons.controller.ts` declares `PATCH /coupons/:id/toggle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e09ebef6b04391e3", "name": "Unused endpoint: POST /cart/add", "shortDescription": {"text": "Unused endpoint: POST /cart/add"}, "fullDescription": {"text": "`backend/src/modules/cart/cart.controller.ts` declares `POST /cart/add` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-488bb76718edd6e2", "name": "Unused endpoint: PUT /cart/item/:id", "shortDescription": {"text": "Unused endpoint: PUT /cart/item/:id"}, "fullDescription": {"text": "`backend/src/modules/cart/cart.controller.ts` declares `PUT /cart/item/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a77668d7b57029b", "name": "Unused endpoint: DELETE /cart/item/:id", "shortDescription": {"text": "Unused endpoint: DELETE /cart/item/:id"}, "fullDescription": {"text": "`backend/src/modules/cart/cart.controller.ts` declares `DELETE /cart/item/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd177e32709a5c96", "name": "Unused endpoint: DELETE /cart/clear", "shortDescription": {"text": "Unused endpoint: DELETE /cart/clear"}, "fullDescription": {"text": "`backend/src/modules/cart/cart.controller.ts` declares `DELETE /cart/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7745a2225a878dd2", "name": "Unused endpoint: PATCH /recipes/:id", "shortDescription": {"text": "Unused endpoint: PATCH /recipes/:id"}, "fullDescription": {"text": "`backend/src/modules/recipes/recipes.controller.ts` declares `PATCH /recipes/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22155"}, "properties": {"repository": "verdeamokomatcha-code/sukomatcha", "repoUrl": "https://github.com/verdeamokomatcha-code/sukomatcha", "branch": "main"}, "results": [{"ruleId": "scanner-a547c316b44b21ae", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/CartDrawer.tsx:762"}, "properties": {"repobilityId": "e1888930dc044920", "scanner": "scanner-primary", "fingerprint": "a547c316b44b21ae", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4ed24b1cc60c7e94", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/BulkOrderForm.tsx:180"}, "properties": {"repobilityId": "9d83e7f0f3c06050", "scanner": "scanner-primary", "fingerprint": "4ed24b1cc60c7e94", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f487586b76d9672a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/PremiumSections.tsx:684"}, "properties": {"repobilityId": "7b932fe3e8c264c7", "scanner": "scanner-primary", "fingerprint": "f487586b76d9672a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-90f5167bd48cc7aa", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/CustomerExperience.tsx:344"}, "properties": {"repobilityId": "688ea2274b7ed6a4", "scanner": "scanner-primary", "fingerprint": "90f5167bd48cc7aa", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-31a6a9aba8204f1f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/customer/src/components/MatchaMoments.tsx:177"}, "properties": {"repobilityId": "84addb465b47fc0f", "scanner": "scanner-primary", "fingerprint": "31a6a9aba8204f1f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cf54f874aadf83cf", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/page.tsx:17"}, "properties": {"repobilityId": "973d74ad8e5f0b0a", "scanner": "scanner-primary", "fingerprint": "cf54f874aadf83cf", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-285998434833a334", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-vs-coffee/page.tsx:55"}, "properties": {"repobilityId": "df8b398bdc777382", "scanner": "scanner-primary", "fingerprint": "285998434833a334", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e1c5280567b1e22f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-vs-green-tea/page.tsx:42"}, "properties": {"repobilityId": "0b02585faeb625a1", "scanner": "scanner-primary", "fingerprint": "e1c5280567b1e22f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d84a05e15ee4d13b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/how-to-make-matcha/page.tsx:43"}, "properties": {"repobilityId": "b1980eeba35eaaa0", "scanner": "scanner-primary", "fingerprint": "d84a05e15ee4d13b", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-c8e8ccf4d2a0b62c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/buy-matcha-india/page.tsx:44"}, "properties": {"repobilityId": "5f987a93dc5bdfd9", "scanner": "scanner-primary", "fingerprint": "c8e8ccf4d2a0b62c", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d295df28e3caaa35", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/subscription/page.tsx:43"}, "properties": {"repobilityId": "9e783e72043c61d7", "scanner": "scanner-primary", "fingerprint": "d295df28e3caaa35", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-58ca08382fd95697", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-latte-recipe/page.tsx:43"}, "properties": {"repobilityId": "f9bbb44f96f5a396", "scanner": "scanner-primary", "fingerprint": "58ca08382fd95697", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-7f4f3476305463eb", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/ceremonial-matcha/page.tsx:42"}, "properties": {"repobilityId": "31e492fc6bc47ba2", "scanner": "scanner-primary", "fingerprint": "7f4f3476305463eb", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-4eb59c9f493e868e", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-for-focus/page.tsx:43"}, "properties": {"repobilityId": "4a9a319ea3d2813a", "scanner": "scanner-primary", "fingerprint": "4eb59c9f493e868e", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-923944528966ea53", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/reviews/page.tsx:18"}, "properties": {"repobilityId": "a582d44071e388ae", "scanner": "scanner-primary", "fingerprint": "923944528966ea53", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-bb6f3cb6d0d0c354", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-weight-loss/page.tsx:43"}, "properties": {"repobilityId": "15d985856fda3723", "scanner": "scanner-primary", "fingerprint": "bb6f3cb6d0d0c354", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-9c622daccfc1e6a5", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/japanese-tea-rituals/page.tsx:42"}, "properties": {"repobilityId": "6e7aebd79acfef68", "scanner": "scanner-primary", "fingerprint": "9c622daccfc1e6a5", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2aa344c263baf209", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/recipes/page.tsx:31"}, "properties": {"repobilityId": "e2a6d2a1dbf489cb", "scanner": "scanner-primary", "fingerprint": "2aa344c263baf209", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d990c8366c779818", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx:87"}, "properties": {"repobilityId": "b31505466d048944", "scanner": "scanner-primary", "fingerprint": "d990c8366c779818", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e4fd473a68f71da9", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/subscribe/page.tsx:31"}, "properties": {"repobilityId": "282d97178b5f3d78", "scanner": "scanner-primary", "fingerprint": "e4fd473a68f71da9", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-746a883fd8adeca4", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-benefits/page.tsx:42"}, "properties": {"repobilityId": "aa5ff8e270d624ee", "scanner": "scanner-primary", "fingerprint": "746a883fd8adeca4", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d68c9cd791e7d4ff", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/rituals/daily-focus/page.tsx:42"}, "properties": {"repobilityId": "4ec48818b8c57855", "scanner": "scanner-primary", "fingerprint": "d68c9cd791e7d4ff", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-11e4f8d0b61b0c1d", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/shop/page.tsx:31"}, "properties": {"repobilityId": "47b49e12ce15b2da", "scanner": "scanner-primary", "fingerprint": "11e4f8d0b61b0c1d", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-24beab63034f56a5", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/story/page.tsx:31"}, "properties": {"repobilityId": "0697a5ec5d954087", "scanner": "scanner-primary", "fingerprint": "24beab63034f56a5", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-8c12ea9c2d69abc3", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/bulk-orders/page.tsx:31"}, "properties": {"repobilityId": "c7b3aaa47ead470a", "scanner": "scanner-primary", "fingerprint": "8c12ea9c2d69abc3", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-ea57755d80fce5af", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/customer/src/app/matcha-guide/page.tsx:58"}, "properties": {"repobilityId": "b3e6267ad32ceb02", "scanner": "scanner-primary", "fingerprint": "ea57755d80fce5af", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-ee5392aa76e2d413", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/layout.tsx:94"}, "properties": {"repobilityId": "fee1ed9af5710ac2", "scanner": "scanner-primary", "fingerprint": "ee5392aa76e2d413", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-38155f9813be1113", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/orders/[id]/page.tsx:191"}, "properties": {"repobilityId": "1cd9342e6fea7b62", "scanner": "scanner-primary", "fingerprint": "38155f9813be1113", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3e30e9414a63462c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/popup-messages/page.tsx:205"}, "properties": {"repobilityId": "98a329df1b8fd6ce", "scanner": "scanner-primary", "fingerprint": "3e30e9414a63462c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f951480022eb722b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/admin/src/app/(protected)/products/page.tsx:391"}, "properties": {"repobilityId": "dd6c70235614953b", "scanner": "scanner-primary", "fingerprint": "f951480022eb722b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-18b82fac9ffbdc90", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/global.setup.ts:75"}, "properties": {"repobilityId": "217a38a1bc826384", "scanner": "scanner-primary", "fingerprint": "18b82fac9ffbdc90", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ebc3508857760d7b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "c4c2ca13532ea308", "scanner": "scanner-primary", "fingerprint": "ebc3508857760d7b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-ebc3508857760d7b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "d9ce2a1add61be06", "scanner": "scanner-primary", "fingerprint": "ebc3508857760d7b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-ebc3508857760d7b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "d213155e20284114", "scanner": "scanner-primary", "fingerprint": "ebc3508857760d7b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/Dockerfile"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-65efbf423e638988", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "dd74ff56eb0a0b33", "scanner": "scanner-primary", "fingerprint": "65efbf423e638988", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/admin/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-65efbf423e638988", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "325ab34e566826d4", "scanner": "scanner-primary", "fingerprint": "65efbf423e638988", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/admin/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-65efbf423e638988", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "b6dc5245363dcfd7", "scanner": "scanner-primary", "fingerprint": "65efbf423e638988", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/admin/Dockerfile"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-3d2a6283f9ebab24", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "ace41ead39f68968", "scanner": "scanner-primary", "fingerprint": "3d2a6283f9ebab24", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-3d2a6283f9ebab24", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "2d0753c87ac4a35c", "scanner": "scanner-primary", "fingerprint": "3d2a6283f9ebab24", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-3f9a221a2dd635a3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/page.tsx:17"}, "properties": {"repobilityId": "6d6210ada6f3ac5b", "scanner": "scanner-primary", "fingerprint": "3f9a221a2dd635a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/page.tsx"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-142081a301b9238a", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-vs-coffee/page.tsx:55"}, "properties": {"repobilityId": "9df79c3603891415", "scanner": "scanner-primary", "fingerprint": "142081a301b9238a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-vs-coffee/page.tsx"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-1bafebb8c686bafb", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-vs-green-tea/page.tsx:42"}, "properties": {"repobilityId": "7311e7e1e0c9b719", "scanner": "scanner-primary", "fingerprint": "1bafebb8c686bafb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-vs-green-tea/page.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-d258d421cf2be1f8", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/how-to-make-matcha/page.tsx:43"}, "properties": {"repobilityId": "9c28bd8c02a290a6", "scanner": "scanner-primary", "fingerprint": "d258d421cf2be1f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/how-to-make-matcha/page.tsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-ed2467bf3e6fb56f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/buy-matcha-india/page.tsx:44"}, "properties": {"repobilityId": "c58e57827290e348", "scanner": "scanner-primary", "fingerprint": "ed2467bf3e6fb56f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/buy-matcha-india/page.tsx"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-3a94663a8925fc88", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/subscription/page.tsx:43"}, "properties": {"repobilityId": "69755f80728988e9", "scanner": "scanner-primary", "fingerprint": "3a94663a8925fc88", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/subscription/page.tsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-e6d358d24cb31731", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-latte-recipe/page.tsx:43"}, "properties": {"repobilityId": "ba7d3e6c6074bd79", "scanner": "scanner-primary", "fingerprint": "e6d358d24cb31731", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-latte-recipe/page.tsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-a26b6d2558230199", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/ceremonial-matcha/page.tsx:42"}, "properties": {"repobilityId": "98c64c4fb53390f2", "scanner": "scanner-primary", "fingerprint": "a26b6d2558230199", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/ceremonial-matcha/page.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-0734fca9acf0c71b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-for-focus/page.tsx:43"}, "properties": {"repobilityId": "482c35be75a3f621", "scanner": "scanner-primary", "fingerprint": "0734fca9acf0c71b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-for-focus/page.tsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-9cfc16ce6b46b6cd", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/reviews/page.tsx:18"}, "properties": {"repobilityId": "9778acc2624df919", "scanner": "scanner-primary", "fingerprint": "9cfc16ce6b46b6cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/reviews/page.tsx"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-15ae878ea9d274a6", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-weight-loss/page.tsx:43"}, "properties": {"repobilityId": "251f070880e36edb", "scanner": "scanner-primary", "fingerprint": "15ae878ea9d274a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-weight-loss/page.tsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-1b4afbdd1e7aaa50", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/japanese-tea-rituals/page.tsx:42"}, "properties": {"repobilityId": "b7249d1b7e8ecbfc", "scanner": "scanner-primary", "fingerprint": "1b4afbdd1e7aaa50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/japanese-tea-rituals/page.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-a3411ff8a12f04f2", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/recipes/page.tsx:31"}, "properties": {"repobilityId": "302d7e5387b58bdc", "scanner": "scanner-primary", "fingerprint": "a3411ff8a12f04f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/recipes/page.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-ad0841fbed7f265e", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx:87"}, "properties": {"repobilityId": "274a082f1e3a81a0", "scanner": "scanner-primary", "fingerprint": "ad0841fbed7f265e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/how-to-identify-fake-matcha/page.tsx"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-0350b802abc04290", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/subscribe/page.tsx:31"}, "properties": {"repobilityId": "4285bf7a56eb3fa8", "scanner": "scanner-primary", "fingerprint": "0350b802abc04290", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/subscribe/page.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-66850cd74f16aaf0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-benefits/page.tsx:42"}, "properties": {"repobilityId": "818d3b30635adf28", "scanner": "scanner-primary", "fingerprint": "66850cd74f16aaf0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-benefits/page.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-5e41762b80cf6d07", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/rituals/daily-focus/page.tsx:42"}, "properties": {"repobilityId": "c3ce1dd35f9505a0", "scanner": "scanner-primary", "fingerprint": "5e41762b80cf6d07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/rituals/daily-focus/page.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-a909648bb0a868ce", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/shop/page.tsx:31"}, "properties": {"repobilityId": "a048aca9ed230dba", "scanner": "scanner-primary", "fingerprint": "a909648bb0a868ce", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/shop/page.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-b9555e0aca8555bd", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/story/page.tsx:31"}, "properties": {"repobilityId": "ae05a61b71a64791", "scanner": "scanner-primary", "fingerprint": "b9555e0aca8555bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/story/page.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-af65ad15519790d8", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/bulk-orders/page.tsx:31"}, "properties": {"repobilityId": "c8c2705f305f14c7", "scanner": "scanner-primary", "fingerprint": "af65ad15519790d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/bulk-orders/page.tsx"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-8053945372e2feb0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/customer/src/app/matcha-guide/page.tsx:58"}, "properties": {"repobilityId": "7ee68c15ac16befd", "scanner": "scanner-primary", "fingerprint": "8053945372e2feb0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/app/matcha-guide/page.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-656f371c39e217c3", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/customer/src/context/AuthContext.tsx:59"}, "properties": {"repobilityId": "06270506845dea0a", "scanner": "scanner-primary", "fingerprint": "656f371c39e217c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/customer/src/context/AuthContext.tsx"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-bee08d29caf1bf0a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/admin/src/context/AuthContext.tsx:52"}, "properties": {"repobilityId": "3889e67d7ec9357b", "scanner": "scanner-primary", "fingerprint": "bee08d29caf1bf0a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/admin/src/context/AuthContext.tsx"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-922ed9565b78a549", "level": "note", "message": {"text": "Very large file: frontend/customer/src/components/CartDrawer.tsx (1254 lines)"}, "properties": {"repobilityId": "08ef42d4b0927e74", "scanner": "scanner-primary", "fingerprint": "922ed9565b78a549", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f03f887ca488fceb", "level": "note", "message": {"text": "Very large file: frontend/customer/src/components/PremiumSections.tsx (2425 lines)"}, "properties": {"repobilityId": "685ae3a80252858c", "scanner": "scanner-primary", "fingerprint": "f03f887ca488fceb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e743d18982723974", "level": "note", "message": {"text": "Very large file: frontend/customer/src/components/CustomerExperience.tsx (1369 lines)"}, "properties": {"repobilityId": "4253241e92503e3e", "scanner": "scanner-primary", "fingerprint": "e743d18982723974", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "b3b69fec4ef4a598", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d9670c13b608021a", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "59a7860d7d12b458", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "8aee7c2f12d6dd4a", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "4f8024dc7a3ac5ae", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6551264e7e62bda4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e9139b9d5cdb3f84", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/CartDrawer.tsx:279"}, "properties": {"repobilityId": "7aec51a2a83a7b67", "scanner": "scanner-primary", "fingerprint": "e9139b9d5cdb3f84", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7091b22c8cd58306", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/PremiumSections.tsx:1231"}, "properties": {"repobilityId": "0a67cee6f0996fbe", "scanner": "scanner-primary", "fingerprint": "7091b22c8cd58306", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e4e601a59339d050", "level": "note", "message": {"text": "Legacy-named symbol `suko_popup_seen_v1` in frontend/customer/src/components/EmailPopup.tsx:11"}, "properties": {"repobilityId": "2617ff558ac94cc3", "scanner": "scanner-primary", "fingerprint": "e4e601a59339d050", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8f34c675ceddf41e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/customer/src/components/MatchaMoments.tsx:65"}, "properties": {"repobilityId": "ef2669c750952871", "scanner": "scanner-primary", "fingerprint": "8f34c675ceddf41e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9058cd266c37c9cd", "level": "note", "message": {"text": "Legacy-named symbol `suko_cart_v1` in frontend/customer/src/context/CartContext.tsx:5"}, "properties": {"repobilityId": "bf750528da327371", "scanner": "scanner-primary", "fingerprint": "9058cd266c37c9cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7c3601298ac5c754", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/admin/src/app/(protected)/recipes/page.tsx:153"}, "properties": {"repobilityId": "7b92bd316a141f9a", "scanner": "scanner-primary", "fingerprint": "7c3601298ac5c754", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-88b884b9f40af884", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/admin/src/app/(protected)/products/page.tsx:234"}, "properties": {"repobilityId": "b4590c0c326addb4", "scanner": "scanner-primary", "fingerprint": "88b884b9f40af884", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e60071e2a349b848", "level": "note", "message": {"text": "Legacy-named symbol `suko_cart_v1` in tests/customer/checkout.spec.ts:37"}, "properties": {"repobilityId": "035bcd6a6867f183", "scanner": "scanner-primary", "fingerprint": "e60071e2a349b848", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b0b5e7cb1208a7cd", "level": "note", "message": {"text": "13 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "2737b8666c1f7eeb", "scanner": "scanner-primary", "fingerprint": "b0b5e7cb1208a7cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-f481de87213d191e", "level": "error", "message": {"text": "Dangling fetch: GET https://api.postalpincode.in/pincode/${pin} (frontend/customer/src/components/CartDrawer.tsx:279)"}, "properties": {"repobilityId": "a6cf20fbae1be358", "scanner": "scanner-primary", "fingerprint": "f481de87213d191e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d847f3c681259917", "level": "error", "message": {"text": "Dangling fetch: GET https://nominatim.openstreetmap.org/reverse?lat=${coords.latitude}&lon=${coords.longitude}&format=jsonv2&addressdetails=1&zoom=18 (frontend/customer/src/components/CartDrawer.tsx:472)"}, "properties": {"repobilityId": "38b24dd0020f267f", "scanner": "scanner-primary", "fingerprint": "d847f3c681259917", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7afac5fca50f1df7", "level": "note", "message": {"text": "Unused endpoint: POST /coupons/validate"}, "properties": {"repobilityId": "08e28590b4c72536", "scanner": "scanner-primary", "fingerprint": "7afac5fca50f1df7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6385cd0e163a390f", "level": "note", "message": {"text": "Unused endpoint: POST /checkout"}, "properties": {"repobilityId": "9c4e70e5c2d4300e", "scanner": "scanner-primary", "fingerprint": "6385cd0e163a390f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6944a3c31294f3a0", "level": "note", "message": {"text": "Unused endpoint: POST /payments/verify"}, "properties": {"repobilityId": "8aaaa6f60d13d068", "scanner": "scanner-primary", "fingerprint": "6944a3c31294f3a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3cc37d951d5c216", "level": "note", "message": {"text": "Unused endpoint: POST /matcha-finder/events"}, "properties": {"repobilityId": "428be3ce5e88b31b", "scanner": "scanner-primary", "fingerprint": "c3cc37d951d5c216", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0578faf02c604a46", "level": "note", "message": {"text": "Unused endpoint: POST /subscriptions"}, "properties": {"repobilityId": "4d5eb3a89f5d222f", "scanner": "scanner-primary", "fingerprint": "0578faf02c604a46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9b23ce801190f80", "level": "note", "message": {"text": "Unused endpoint: POST /bulk-orders"}, "properties": {"repobilityId": "0d573ff190f5bdec", "scanner": "scanner-primary", "fingerprint": "e9b23ce801190f80", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49ebdd6f803d023e", "level": "note", "message": {"text": "Unused endpoint: POST /reviews"}, "properties": {"repobilityId": "7876c29ca5cc82aa", "scanner": "scanner-primary", "fingerprint": "49ebdd6f803d023e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5da9aa5ee4a0635c", "level": "note", "message": {"text": "Unused endpoint: POST /moments"}, "properties": {"repobilityId": "120db0ecbc6f4302", "scanner": "scanner-primary", "fingerprint": "5da9aa5ee4a0635c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e79039ad8da0927c", "level": "note", "message": {"text": "Unused endpoint: POST /reminders"}, "properties": {"repobilityId": "53f77f32e2122fb9", "scanner": "scanner-primary", "fingerprint": "e79039ad8da0927c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2fe5b92648ca462", "level": "note", "message": {"text": "Unused endpoint: POST /auth/forgot-password"}, "properties": {"repobilityId": "e88e977626239560", "scanner": "scanner-primary", "fingerprint": "e2fe5b92648ca462", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ccadf58fea366726", "level": "note", "message": {"text": "Unused endpoint: POST /auth/verify-email"}, "properties": {"repobilityId": "69ee09812a7d0e7d", "scanner": "scanner-primary", "fingerprint": "ccadf58fea366726", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ff5660488b9ce2ca", "level": "note", "message": {"text": "Unused endpoint: POST /auth/resend-verification"}, "properties": {"repobilityId": "0947e2db39272c22", "scanner": "scanner-primary", "fingerprint": "ff5660488b9ce2ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e02b004f1763361", "level": "note", "message": {"text": "Unused endpoint: POST /email-signup"}, "properties": {"repobilityId": "567f870a830e93d4", "scanner": "scanner-primary", "fingerprint": "1e02b004f1763361", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-deb8df763a50c73a", "level": "note", "message": {"text": "Unused endpoint: POST /auth/reset-password"}, "properties": {"repobilityId": "ae620e855220781c", "scanner": "scanner-primary", "fingerprint": "deb8df763a50c73a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8fdbacfe9430a6ed", "level": "note", "message": {"text": "Unused endpoint: POST /auth/login"}, "properties": {"repobilityId": "68ac6badeddb394c", "scanner": "scanner-primary", "fingerprint": "8fdbacfe9430a6ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8292c0931391749a", "level": "note", "message": {"text": "Unused endpoint: POST /auth/register"}, "properties": {"repobilityId": "d9471dabb5be4fcb", "scanner": "scanner-primary", "fingerprint": "8292c0931391749a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac42422b23e45104", "level": "note", "message": {"text": "Unused endpoint: GET /auth/me"}, "properties": {"repobilityId": "0dc46207e4ee4cb0", "scanner": "scanner-primary", "fingerprint": "ac42422b23e45104", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d931a3c5303f26ad", "level": "note", "message": {"text": "Unused endpoint: POST /admin/setup/forgot-password"}, "properties": {"repobilityId": "ffdf6ebcf137a4b0", "scanner": "scanner-primary", "fingerprint": "d931a3c5303f26ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9252acc452949e93", "level": "note", "message": {"text": "Unused endpoint: POST /admin/shipping/schedule-pickup"}, "properties": {"repobilityId": "dfcc117d9fb7f28d", "scanner": "scanner-primary", "fingerprint": "9252acc452949e93", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f46b53ccd2e4b62", "level": "note", "message": {"text": "Unused endpoint: POST /admin/setup"}, "properties": {"repobilityId": "ce5d760dd0bcba05", "scanner": "scanner-primary", "fingerprint": "6f46b53ccd2e4b62", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ec1e702837cb525", "level": "note", "message": {"text": "Unused endpoint: GET /users/profile"}, "properties": {"repobilityId": "2791c969c018e5d2", "scanner": "scanner-primary", "fingerprint": "8ec1e702837cb525", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c7d57ce82505f0b", "level": "note", "message": {"text": "Unused endpoint: PUT /users/profile"}, "properties": {"repobilityId": "97c45d2e7b1c39db", "scanner": "scanner-primary", "fingerprint": "8c7d57ce82505f0b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fe95f49a50492dde", "level": "note", "message": {"text": "Unused endpoint: GET /users/addresses"}, "properties": {"repobilityId": "d5e52e8ae02408a2", "scanner": "scanner-primary", "fingerprint": "fe95f49a50492dde", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b036f31f7a701ba5", "level": "note", "message": {"text": "Unused endpoint: POST /users/addresses"}, "properties": {"repobilityId": "e4a7983000efe344", "scanner": "scanner-primary", "fingerprint": "b036f31f7a701ba5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-149275828ac3ee59", "level": "note", "message": {"text": "Unused endpoint: PUT /users/addresses/:id/default"}, "properties": {"repobilityId": "09eb45346a774b6e", "scanner": "scanner-primary", "fingerprint": "149275828ac3ee59", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c395ce6ee1f865b7", "level": "note", "message": {"text": "Unused endpoint: DELETE /users/addresses/:id"}, "properties": {"repobilityId": "9ccab6e024e3c69b", "scanner": "scanner-primary", "fingerprint": "c395ce6ee1f865b7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9350031e84a881c0", "level": "note", "message": {"text": "Unused endpoint: POST /orders/create"}, "properties": {"repobilityId": "e4d45f7f40f23343", "scanner": "scanner-primary", "fingerprint": "9350031e84a881c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0469dbf43c1a9621", "level": "note", "message": {"text": "Unused endpoint: GET /orders/:id"}, "properties": {"repobilityId": "876190aab0770ee9", "scanner": "scanner-primary", "fingerprint": "0469dbf43c1a9621", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3829ad58eb373d9e", "level": "note", "message": {"text": "Unused endpoint: DELETE /orders/:id/cancel"}, "properties": {"repobilityId": "78eadcf76b5e62a8", "scanner": "scanner-primary", "fingerprint": "3829ad58eb373d9e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a4d2697fca0bbd4", "level": "note", "message": {"text": "Unused endpoint: GET /matcha-finder/config"}, "properties": {"repobilityId": "ab16cae8a3355d74", "scanner": "scanner-primary", "fingerprint": "3a4d2697fca0bbd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e669ea566e741de", "level": "note", "message": {"text": "Unused endpoint: POST /matcha-finder/recommend"}, "properties": {"repobilityId": "ce3d1111d5031b8c", "scanner": "scanner-primary", "fingerprint": "2e669ea566e741de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2397f6240c85bf73", "level": "note", "message": {"text": "Unused endpoint: GET /matcha-finder/goals"}, "properties": {"repobilityId": "d5708bb1cfa0753a", "scanner": "scanner-primary", "fingerprint": "2397f6240c85bf73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14cc84640b3fda14", "level": "note", "message": {"text": "Unused endpoint: POST /matcha-finder/goals"}, "properties": {"repobilityId": "e6c2336eac8cfa5e", "scanner": "scanner-primary", "fingerprint": "14cc84640b3fda14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-220dbce907ade45b", "level": "note", "message": {"text": "Unused endpoint: PATCH /matcha-finder/goals/:id"}, "properties": {"repobilityId": "879c43012857fdca", "scanner": "scanner-primary", "fingerprint": "220dbce907ade45b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bcd77e618d4d8f09", "level": "note", "message": {"text": "Unused endpoint: DELETE /matcha-finder/goals/:id"}, "properties": {"repobilityId": "6a39c8a92a4c25ee", "scanner": "scanner-primary", "fingerprint": "bcd77e618d4d8f09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-75900fb01dad5ddf", "level": "note", "message": {"text": "Unused endpoint: GET /matcha-finder/experience-rules"}, "properties": {"repobilityId": "3b93349dc731f5b2", "scanner": "scanner-primary", "fingerprint": "75900fb01dad5ddf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d2a4ea39f345da8b", "level": "note", "message": {"text": "Unused endpoint: PUT /matcha-finder/experience-rules"}, "properties": {"repobilityId": "13b30f29b25feb9f", "scanner": "scanner-primary", "fingerprint": "d2a4ea39f345da8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a040e5ff0d24d798", "level": "note", "message": {"text": "Unused endpoint: GET /matcha-finder/stats"}, "properties": {"repobilityId": "f375363ab8047776", "scanner": "scanner-primary", "fingerprint": "a040e5ff0d24d798", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e9f0c712241895d", "level": "note", "message": {"text": "Unused endpoint: GET /auth/google"}, "properties": {"repobilityId": "17fd1eff97ff432e", "scanner": "scanner-primary", "fingerprint": "2e9f0c712241895d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-392dcbd9c0e4ed85", "level": "note", "message": {"text": "Unused endpoint: GET /auth/google/callback"}, "properties": {"repobilityId": "3b11a7cd03b9f274", "scanner": "scanner-primary", "fingerprint": "392dcbd9c0e4ed85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eec5e71edccf67e6", "level": "note", "message": {"text": "Unused endpoint: PATCH /popup-messages/:id"}, "properties": {"repobilityId": "b3fec312d9821b2d", "scanner": "scanner-primary", "fingerprint": "eec5e71edccf67e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00d558ff839e109f", "level": "note", "message": {"text": "Unused endpoint: DELETE /popup-messages/:id"}, "properties": {"repobilityId": "962b82acedb5a8a6", "scanner": "scanner-primary", "fingerprint": "00d558ff839e109f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c420fe1a53f3321", "level": "note", "message": {"text": "Unused endpoint: GET /reviews/admin"}, "properties": {"repobilityId": "54c8d24cad2925c5", "scanner": "scanner-primary", "fingerprint": "9c420fe1a53f3321", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed01ced8b2dec57f", "level": "note", "message": {"text": "Unused endpoint: DELETE /reviews/:id"}, "properties": {"repobilityId": "053098e8c44b6ba5", "scanner": "scanner-primary", "fingerprint": "ed01ced8b2dec57f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d712350888cba552", "level": "note", "message": {"text": "Unused endpoint: PATCH /coupons/:id/toggle"}, "properties": {"repobilityId": "9374adcae8b3255e", "scanner": "scanner-primary", "fingerprint": "d712350888cba552", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e09ebef6b04391e3", "level": "note", "message": {"text": "Unused endpoint: POST /cart/add"}, "properties": {"repobilityId": "190264bb20819e60", "scanner": "scanner-primary", "fingerprint": "e09ebef6b04391e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-488bb76718edd6e2", "level": "note", "message": {"text": "Unused endpoint: PUT /cart/item/:id"}, "properties": {"repobilityId": "15eda3c9fd4599d8", "scanner": "scanner-primary", "fingerprint": "488bb76718edd6e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a77668d7b57029b", "level": "note", "message": {"text": "Unused endpoint: DELETE /cart/item/:id"}, "properties": {"repobilityId": "f748d8af4ef001bb", "scanner": "scanner-primary", "fingerprint": "1a77668d7b57029b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd177e32709a5c96", "level": "note", "message": {"text": "Unused endpoint: DELETE /cart/clear"}, "properties": {"repobilityId": "b231683023f2b16f", "scanner": "scanner-primary", "fingerprint": "cd177e32709a5c96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7745a2225a878dd2", "level": "note", "message": {"text": "Unused endpoint: PATCH /recipes/:id"}, "properties": {"repobilityId": "b483a3466a18519d", "scanner": "scanner-primary", "fingerprint": "7745a2225a878dd2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}