{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-770fab9f941c12f4", "name": "Possibly dead Python function: format_context_for_prompt", "shortDescription": {"text": "Possibly dead Python function: format_context_for_prompt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-009e9c5670184ad3", "name": "Possibly dead Python function: create_system_prompt", "shortDescription": {"text": "Possibly dead Python function: create_system_prompt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4769109138412ffa", "name": "Possibly dead Python function: is_off_topic_response", "shortDescription": {"text": "Possibly dead Python function: is_off_topic_response"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b65e6f2f0dcec8d2", "name": "Possibly dead Python function: is_question_on_topic", "shortDescription": {"text": "Possibly dead Python function: is_question_on_topic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56a5f931d3218d7e", "name": "Possibly dead Python function: format_source_citation", "shortDescription": {"text": "Possibly dead Python function: format_source_citation"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd006b3f3b02b34a", "name": "Insecure pattern 'cors_wildcard' in backend/app/main_openai.py:239", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in backend/app/main_openai.py:239"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 21 source file(s) (ratio 0.10). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/integrations/traceai.py:wrapped, backend/app/integrations/traceai.py:wrapped, backend/app/integrations/traceai.py:wrapped\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/services/validation_agent.py:to_dict, backend/app/services/validation_agent.py:to_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73c0842f61ca72e2", "name": "FastAPI POST `initialize_endpoint` without auth dependency \u2014 backend/app/main_openai.py:250", "shortDescription": {"text": "FastAPI POST `initialize_endpoint` without auth dependency \u2014 backend/app/main_openai.py:250"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94666e18a4c72a34", "name": "FastAPI POST `chat_endpoint` without auth dependency \u2014 backend/app/main_openai.py:282", "shortDescription": {"text": "FastAPI POST `chat_endpoint` without auth dependency \u2014 backend/app/main_openai.py:282"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b678593aab32334", "name": "FastAPI POST `analyze_query_endpoint` without auth dependency \u2014 backend/app/main_openai.py:476", "shortDescription": {"text": "FastAPI POST `analyze_query_endpoint` without auth dependency \u2014 backend/app/main_openai.py:476"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2da5b9635b24474a", "name": "FastAPI POST `stepback_demo_endpoint` without auth dependency \u2014 backend/app/main_openai.py:562", "shortDescription": {"text": "FastAPI POST `stepback_demo_endpoint` without auth dependency \u2014 backend/app/main_openai.py:562"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-16f1a6c6fb272a52", "name": "FastAPI POST `followup_endpoint` without auth dependency \u2014 backend/app/main_openai.py:612", "shortDescription": {"text": "FastAPI POST `followup_endpoint` without auth dependency \u2014 backend/app/main_openai.py:612"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15c3bd8ce1351d36", "name": "Unused endpoint: POST /initialize", "shortDescription": {"text": "Unused endpoint: POST /initialize"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `POST /initialize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff8da5fbc19c76d", "name": "Unused endpoint: POST /chat", "shortDescription": {"text": "Unused endpoint: POST /chat"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `POST /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-091277b5858d03a5", "name": "Unused endpoint: POST /analyze-query", "shortDescription": {"text": "Unused endpoint: POST /analyze-query"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `POST /analyze-query` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ae978fc01a1b96c", "name": "Unused endpoint: POST /stepback-demo", "shortDescription": {"text": "Unused endpoint: POST /stepback-demo"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `POST /stepback-demo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c2ed6647653bc3f", "name": "Unused endpoint: POST /followup", "shortDescription": {"text": "Unused endpoint: POST /followup"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `POST /followup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90ad477295819900", "name": "Unused endpoint: GET /quick-questions", "shortDescription": {"text": "Unused endpoint: GET /quick-questions"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `GET /quick-questions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/app/main_openai.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20530"}, "properties": {"repository": "SuperNova-W/DialysisCare", "repoUrl": "https://github.com/SuperNova-W/DialysisCare", "branch": "main"}, "results": [{"ruleId": "scanner-770fab9f941c12f4", "level": "note", "message": {"text": "Possibly dead Python function: format_context_for_prompt"}, "properties": {"repobilityId": "b237615b8b23ba83", "scanner": "scanner-primary", "fingerprint": "770fab9f941c12f4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/utils/openai_utils.py:223"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-009e9c5670184ad3", "level": "note", "message": {"text": "Possibly dead Python function: create_system_prompt"}, "properties": {"repobilityId": "7a73ed2085244caf", "scanner": "scanner-primary", "fingerprint": "009e9c5670184ad3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/utils/openai_utils.py:256"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4769109138412ffa", "level": "note", "message": {"text": "Possibly dead Python function: is_off_topic_response"}, "properties": {"repobilityId": "036b75cdc2748a31", "scanner": "scanner-primary", "fingerprint": "4769109138412ffa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/utils/prompt_guard.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b65e6f2f0dcec8d2", "level": "note", "message": {"text": "Possibly dead Python function: is_question_on_topic"}, "properties": {"repobilityId": "0d47929ff1fed001", "scanner": "scanner-primary", "fingerprint": "b65e6f2f0dcec8d2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/utils/prompt_guard.py:240"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56a5f931d3218d7e", "level": "note", "message": {"text": "Possibly dead Python function: format_source_citation"}, "properties": {"repobilityId": "fdf3b9e265f48a80", "scanner": "scanner-primary", "fingerprint": "56a5f931d3218d7e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/utils/metadata_manager.py:299"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "653a62baa87c8090", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-dd006b3f3b02b34a", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in backend/app/main_openai.py:239"}, "properties": {"repobilityId": "32568841cad8b972", "scanner": "scanner-primary", "fingerprint": "dd006b3f3b02b34a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main_openai.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "61076603136b2537", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "afaa4a11d6d4f473", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "7740c7c0d2ab3423", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "b476cce303faf2a6", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "92e8bd322c813c9e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "59cfe2c6e46035cb", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "39c66a219ad8397f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5b0d2193c944fb4e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-73c0842f61ca72e2", "level": "error", "message": {"text": "FastAPI POST `initialize_endpoint` without auth dependency \u2014 backend/app/main_openai.py:250"}, "properties": {"repobilityId": "a4cd4c576eae6b7d", "scanner": "scanner-primary", "fingerprint": "73c0842f61ca72e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main_openai.py"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-94666e18a4c72a34", "level": "error", "message": {"text": "FastAPI POST `chat_endpoint` without auth dependency \u2014 backend/app/main_openai.py:282"}, "properties": {"repobilityId": "360446fb01cc7a6a", "scanner": "scanner-primary", "fingerprint": "94666e18a4c72a34", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main_openai.py"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-8b678593aab32334", "level": "error", "message": {"text": "FastAPI POST `analyze_query_endpoint` without auth dependency \u2014 backend/app/main_openai.py:476"}, "properties": {"repobilityId": "41b23707319961dc", "scanner": "scanner-primary", "fingerprint": "8b678593aab32334", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main_openai.py"}, "region": {"startLine": 476}}}]}, {"ruleId": "scanner-2da5b9635b24474a", "level": "error", "message": {"text": "FastAPI POST `stepback_demo_endpoint` without auth dependency \u2014 backend/app/main_openai.py:562"}, "properties": {"repobilityId": "f8f1b7f51a93ed0e", "scanner": "scanner-primary", "fingerprint": "2da5b9635b24474a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main_openai.py"}, "region": {"startLine": 562}}}]}, {"ruleId": "scanner-16f1a6c6fb272a52", "level": "error", "message": {"text": "FastAPI POST `followup_endpoint` without auth dependency \u2014 backend/app/main_openai.py:612"}, "properties": {"repobilityId": "b3c64cdfcdd2a18c", "scanner": "scanner-primary", "fingerprint": "16f1a6c6fb272a52", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main_openai.py"}, "region": {"startLine": 612}}}]}, {"ruleId": "scanner-15c3bd8ce1351d36", "level": "note", "message": {"text": "Unused endpoint: POST /initialize"}, "properties": {"repobilityId": "1eb39dbaea2579d7", "scanner": "scanner-primary", "fingerprint": "15c3bd8ce1351d36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cff8da5fbc19c76d", "level": "note", "message": {"text": "Unused endpoint: POST /chat"}, "properties": {"repobilityId": "7a6c0b86dff88a7a", "scanner": "scanner-primary", "fingerprint": "cff8da5fbc19c76d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-091277b5858d03a5", "level": "note", "message": {"text": "Unused endpoint: POST /analyze-query"}, "properties": {"repobilityId": "0b06620c48d87139", "scanner": "scanner-primary", "fingerprint": "091277b5858d03a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ae978fc01a1b96c", "level": "note", "message": {"text": "Unused endpoint: POST /stepback-demo"}, "properties": {"repobilityId": "2dff348bc3c2a906", "scanner": "scanner-primary", "fingerprint": "9ae978fc01a1b96c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c2ed6647653bc3f", "level": "note", "message": {"text": "Unused endpoint: POST /followup"}, "properties": {"repobilityId": "0fd323c8babba33f", "scanner": "scanner-primary", "fingerprint": "4c2ed6647653bc3f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-90ad477295819900", "level": "note", "message": {"text": "Unused endpoint: GET /quick-questions"}, "properties": {"repobilityId": "9cc7ad5d2898ddb5", "scanner": "scanner-primary", "fingerprint": "90ad477295819900", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "797442a2c80df593", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}