{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3237af9760ae6fa8", "name": "Stray `console.log` in TS/JS \u2014 test-server.js:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test-server.js:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5ad38404cf445c2", "name": "Stray `console.log` in TS/JS \u2014 TaxiZonesMapbox.tsx:363", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 TaxiZonesMapbox.tsx:363"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb017f6315732d7e", "name": "Stray `console.log` in TS/JS \u2014 server.js:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "1 tests / 10 src (ratio 0.10)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 17 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d77d7af64e07637", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:194", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:194"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e047ab7af03962f", "name": "7 env vars used in code but missing from .env.example", "shortDescription": {"text": "7 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AIRTABLE_API_KEY`, `AIRTABLE_BASE_ID`, `ANTHROPIC_API_KEY`, `API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY`, `VITE_MAPBOX_API_KEY`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af64882ffdbff66e", "name": "Dangling fetch: POST https://api.groq.com/openai/v1/chat/completions (server.js:353)", "shortDescription": {"text": "Dangling fetch: POST https://api.groq.com/openai/v1/chat/completions (server.js:353)"}, "fullDescription": {"text": "`server.js:353` calls `POST https://api.groq.com/openai/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.groq.com/openai/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`test-server.js` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`test-server.js` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ef982ea085b4bab", "name": "Unused endpoint: GET /api/config-check", "shortDescription": {"text": "Unused endpoint: GET /api/config-check"}, "fullDescription": {"text": "`server.js` declares `GET /api/config-check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb452fbfb454d20", "name": "Unused endpoint: USE /api/auth", "shortDescription": {"text": "Unused endpoint: USE /api/auth"}, "fullDescription": {"text": "`server.js` declares `USE /api/auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb4c4c0768c5dc0d", "name": "Unused endpoint: USE /api/user-auth", "shortDescription": {"text": "Unused endpoint: USE /api/user-auth"}, "fullDescription": {"text": "`server.js` declares `USE /api/user-auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f085ca2797a0bd08", "name": "Unused endpoint: USE /api/firebase-auth", "shortDescription": {"text": "Unused endpoint: USE /api/firebase-auth"}, "fullDescription": {"text": "`server.js` declares `USE /api/firebase-auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-326b6b59840a168e", "name": "Unused endpoint: USE /api/validate-admin-pin", "shortDescription": {"text": "Unused endpoint: USE /api/validate-admin-pin"}, "fullDescription": {"text": "`server.js` declares `USE /api/validate-admin-pin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c26a891155c272", "name": "Unused endpoint: USE /api/debug", "shortDescription": {"text": "Unused endpoint: USE /api/debug"}, "fullDescription": {"text": "`server.js` declares `USE /api/debug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10484ff622717d30", "name": "Unused endpoint: USE /api/services", "shortDescription": {"text": "Unused endpoint: USE /api/services"}, "fullDescription": {"text": "`server.js` declares `USE /api/services` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e00c38787cd62388", "name": "Unused endpoint: USE /api/reservations", "shortDescription": {"text": "Unused endpoint: USE /api/reservations"}, "fullDescription": {"text": "`server.js` declares `USE /api/reservations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b296f10b62d44cd9", "name": "Unused endpoint: USE /api/availability-requests", "shortDescription": {"text": "Unused endpoint: USE /api/availability-requests"}, "fullDescription": {"text": "`server.js` declares `USE /api/availability-requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98dcf9f66ef48060", "name": "Unused endpoint: USE /api/directory", "shortDescription": {"text": "Unused endpoint: USE /api/directory"}, "fullDescription": {"text": "`server.js` declares `USE /api/directory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-403675e9bbb444e5", "name": "Unused endpoint: USE /api/chatbot", "shortDescription": {"text": "Unused endpoint: USE /api/chatbot"}, "fullDescription": {"text": "`server.js` declares `USE /api/chatbot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5069272b56da87a", "name": "Unused endpoint: USE /api/taxis", "shortDescription": {"text": "Unused endpoint: USE /api/taxis"}, "fullDescription": {"text": "`server.js` declares `USE /api/taxis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9a44316f986a28", "name": "Unused endpoint: USE /api/taxi-zones", "shortDescription": {"text": "Unused endpoint: USE /api/taxi-zones"}, "fullDescription": {"text": "`server.js` declares `USE /api/taxi-zones` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6330b0c4a0a152d3", "name": "Unused endpoint: USE /api/tasks", "shortDescription": {"text": "Unused endpoint: USE /api/tasks"}, "fullDescription": {"text": "`server.js` declares `USE /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7dbcf047b5d4d80", "name": "Unused endpoint: USE /api/system", "shortDescription": {"text": "Unused endpoint: USE /api/system"}, "fullDescription": {"text": "`server.js` declares `USE /api/system` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3001e3baa5fcb10a", "name": "Unused endpoint: USE /api/accommodations", "shortDescription": {"text": "Unused endpoint: USE /api/accommodations"}, "fullDescription": {"text": "`server.js` declares `USE /api/accommodations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85128c45d8cba0ff", "name": "Unused endpoint: USE /api/agent", "shortDescription": {"text": "Unused endpoint: USE /api/agent"}, "fullDescription": {"text": "`server.js` declares `USE /api/agent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba2c62d86f730a18", "name": "Unused endpoint: USE /api/quotations", "shortDescription": {"text": "Unused endpoint: USE /api/quotations"}, "fullDescription": {"text": "`server.js` declares `USE /api/quotations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f5b33b7880c9be9", "name": "Unused endpoint: USE /api/cowork", "shortDescription": {"text": "Unused endpoint: USE /api/cowork"}, "fullDescription": {"text": "`server.js` declares `USE /api/cowork` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d73ccf163920bd14", "name": "Unused endpoint: USE /api/storage", "shortDescription": {"text": "Unused endpoint: USE /api/storage"}, "fullDescription": {"text": "`server.js` declares `USE /api/storage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c48eeaff10415a8f", "name": "Unused endpoint: ALL /agencias/api/proxy.php", "shortDescription": {"text": "Unused endpoint: ALL /agencias/api/proxy.php"}, "fullDescription": {"text": "`server.js` declares `ALL /agencias/api/proxy.php` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ad6da5476b01cc4", "name": "Unused endpoint: USE /agencias", "shortDescription": {"text": "Unused endpoint: USE /agencias"}, "fullDescription": {"text": "`server.js` declares `USE /agencias` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3a15827f4596395", "name": "Unused endpoint: USE /cotizacion", "shortDescription": {"text": "Unused endpoint: USE /cotizacion"}, "fullDescription": {"text": "`server.js` declares `USE /cotizacion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85b7a94dbd027bd6", "name": "Unused endpoint: USE /voucher", "shortDescription": {"text": "Unused endpoint: USE /voucher"}, "fullDescription": {"text": "`server.js` declares `USE /voucher` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8242ba07247d2f8", "name": "Unused endpoint: USE /api/payments", "shortDescription": {"text": "Unused endpoint: USE /api/payments"}, "fullDescription": {"text": "`server.js` declares `USE /api/payments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-600dd4446558a94c", "name": "Unused endpoint: USE /pagar", "shortDescription": {"text": "Unused endpoint: USE /pagar"}, "fullDescription": {"text": "`server.js` declares `USE /pagar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6054ddc620b8f5d1", "name": "Unused endpoint: GET /api/proxy-image", "shortDescription": {"text": "Unused endpoint: GET /api/proxy-image"}, "fullDescription": {"text": "`server.js` declares `GET /api/proxy-image` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5deac614037b912", "name": "Unused endpoint: USE /api/leads", "shortDescription": {"text": "Unused endpoint: USE /api/leads"}, "fullDescription": {"text": "`server.js` declares `USE /api/leads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c96f83828d0e1e4f", "name": "Unused endpoint: USE /api/agentes", "shortDescription": {"text": "Unused endpoint: USE /api/agentes"}, "fullDescription": {"text": "`server.js` declares `USE /api/agentes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0cdfc54d1b370bd", "name": "Unused endpoint: USE /api/admin/users", "shortDescription": {"text": "Unused endpoint: USE /api/admin/users"}, "fullDescription": {"text": "`server.js` declares `USE /api/admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e839c7e0bafe913", "name": "Unused endpoint: USE /hub", "shortDescription": {"text": "Unused endpoint: USE /hub"}, "fullDescription": {"text": "`server.js` declares `USE /hub` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd86b206ca4843db", "name": "Unused endpoint: GET /cotizar", "shortDescription": {"text": "Unused endpoint: GET /cotizar"}, "fullDescription": {"text": "`server.js` declares `GET /cotizar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6535b27b74e1c94", "name": "Unused endpoint: GET /registro-alojamiento", "shortDescription": {"text": "Unused endpoint: GET /registro-alojamiento"}, "fullDescription": {"text": "`server.js` declares `GET /registro-alojamiento` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a9d5d28b74195de", "name": "Unused endpoint: USE /disponibilidad-admin", "shortDescription": {"text": "Unused endpoint: USE /disponibilidad-admin"}, "fullDescription": {"text": "`server.js` declares `USE /disponibilidad-admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c2eca859a80155d", "name": "Unused endpoint: USE /api/disponibilidad", "shortDescription": {"text": "Unused endpoint: USE /api/disponibilidad"}, "fullDescription": {"text": "`server.js` declares `USE /api/disponibilidad` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5312239b77f4334", "name": "Unused endpoint: GET /disponibilidad-propietario", "shortDescription": {"text": "Unused endpoint: GET /disponibilidad-propietario"}, "fullDescription": {"text": "`server.js` declares `GET /disponibilidad-propietario` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3e55a1e258581c7", "name": "Unused endpoint: GET /aliado/:slug", "shortDescription": {"text": "Unused endpoint: GET /aliado/:slug"}, "fullDescription": {"text": "`server.js` declares `GET /aliado/:slug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f699c6eea9c4f6eb", "name": "Unused endpoint: POST /api/ai/chat", "shortDescription": {"text": "Unused endpoint: POST /api/ai/chat"}, "fullDescription": {"text": "`server.js` declares `POST /api/ai/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/29551"}, "properties": {"repository": "skystephens/GuanaGo-App-v2", "repoUrl": "https://github.com/skystephens/GuanaGo-App-v2", "branch": "main"}, "results": [{"ruleId": "scanner-3237af9760ae6fa8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test-server.js:20"}, "properties": {"repobilityId": "ea99a0ffce6c0efa", "scanner": "scanner-primary", "fingerprint": "3237af9760ae6fa8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e5ad38404cf445c2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 TaxiZonesMapbox.tsx:363"}, "properties": {"repobilityId": "d6f51c70d432521c", "scanner": "scanner-primary", "fingerprint": "e5ad38404cf445c2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cb017f6315732d7e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:49"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "cb017f6315732d7e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "59776374a8c5e8f3", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5f862bb960383a06", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "37e7b469201365f8", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-7d77d7af64e07637", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:194"}, "properties": {"repobilityId": "4ac2bd9dfd2ae43a", "scanner": "scanner-primary", "fingerprint": "7d77d7af64e07637", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8e047ab7af03962f", "level": "note", "message": {"text": "7 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5a0455f6498c27ad", "scanner": "scanner-primary", "fingerprint": "8e047ab7af03962f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-af64882ffdbff66e", "level": "error", "message": {"text": "Dangling fetch: POST https://api.groq.com/openai/v1/chat/completions (server.js:353)"}, "properties": {"repobilityId": "774a808daa3305d1", "scanner": "scanner-primary", "fingerprint": "af64882ffdbff66e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "e209c0d142c74434", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "620ed086f51a147c", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4ef982ea085b4bab", "level": "note", "message": {"text": "Unused endpoint: GET /api/config-check"}, "properties": {"repobilityId": "c33bc7316a9443b7", "scanner": "scanner-primary", "fingerprint": "4ef982ea085b4bab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eb452fbfb454d20", "level": "note", "message": {"text": "Unused endpoint: USE /api/auth"}, "properties": {"repobilityId": "166e9dd94854ec87", "scanner": "scanner-primary", "fingerprint": "6eb452fbfb454d20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb4c4c0768c5dc0d", "level": "note", "message": {"text": "Unused endpoint: USE /api/user-auth"}, "properties": {"repobilityId": "7eeb266d2fec448e", "scanner": "scanner-primary", "fingerprint": "eb4c4c0768c5dc0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f085ca2797a0bd08", "level": "note", "message": {"text": "Unused endpoint: USE /api/firebase-auth"}, "properties": {"repobilityId": "6bed8fdabf5386ed", "scanner": "scanner-primary", "fingerprint": "f085ca2797a0bd08", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-326b6b59840a168e", "level": "note", "message": {"text": "Unused endpoint: USE /api/validate-admin-pin"}, "properties": {"repobilityId": "83129b1373c5fbba", "scanner": "scanner-primary", "fingerprint": "326b6b59840a168e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-46c26a891155c272", "level": "note", "message": {"text": "Unused endpoint: USE /api/debug"}, "properties": {"repobilityId": "c7c1b076fc65d563", "scanner": "scanner-primary", "fingerprint": "46c26a891155c272", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10484ff622717d30", "level": "note", "message": {"text": "Unused endpoint: USE /api/services"}, "properties": {"repobilityId": "58627ffbeb31ec8a", "scanner": "scanner-primary", "fingerprint": "10484ff622717d30", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e00c38787cd62388", "level": "note", "message": {"text": "Unused endpoint: USE /api/reservations"}, "properties": {"repobilityId": "5fc9869a812c0458", "scanner": "scanner-primary", "fingerprint": "e00c38787cd62388", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b296f10b62d44cd9", "level": "note", "message": {"text": "Unused endpoint: USE /api/availability-requests"}, "properties": {"repobilityId": "b1fcdf32ed3aa9ba", "scanner": "scanner-primary", "fingerprint": "b296f10b62d44cd9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98dcf9f66ef48060", "level": "note", "message": {"text": "Unused endpoint: USE /api/directory"}, "properties": {"repobilityId": "150738c34392da65", "scanner": "scanner-primary", "fingerprint": "98dcf9f66ef48060", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-403675e9bbb444e5", "level": "note", "message": {"text": "Unused endpoint: USE /api/chatbot"}, "properties": {"repobilityId": "b4286af283c579b9", "scanner": "scanner-primary", "fingerprint": "403675e9bbb444e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5069272b56da87a", "level": "note", "message": {"text": "Unused endpoint: USE /api/taxis"}, "properties": {"repobilityId": "cd7faa2d2e00b4b6", "scanner": "scanner-primary", "fingerprint": "b5069272b56da87a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb9a44316f986a28", "level": "note", "message": {"text": "Unused endpoint: USE /api/taxi-zones"}, "properties": {"repobilityId": "363329a2023bb3ea", "scanner": "scanner-primary", "fingerprint": "cb9a44316f986a28", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6330b0c4a0a152d3", "level": "note", "message": {"text": "Unused endpoint: USE /api/tasks"}, "properties": {"repobilityId": "aae2bda89c806ad0", "scanner": "scanner-primary", "fingerprint": "6330b0c4a0a152d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b7dbcf047b5d4d80", "level": "note", "message": {"text": "Unused endpoint: USE /api/system"}, "properties": {"repobilityId": "75547828afc39dde", "scanner": "scanner-primary", "fingerprint": "b7dbcf047b5d4d80", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3001e3baa5fcb10a", "level": "note", "message": {"text": "Unused endpoint: USE /api/accommodations"}, "properties": {"repobilityId": "93aec6ddd740f679", "scanner": "scanner-primary", "fingerprint": "3001e3baa5fcb10a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85128c45d8cba0ff", "level": "note", "message": {"text": "Unused endpoint: USE /api/agent"}, "properties": {"repobilityId": "c6551288603ef7ad", "scanner": "scanner-primary", "fingerprint": "85128c45d8cba0ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba2c62d86f730a18", "level": "note", "message": {"text": "Unused endpoint: USE /api/quotations"}, "properties": {"repobilityId": "3ec51b64c49bd1a7", "scanner": "scanner-primary", "fingerprint": "ba2c62d86f730a18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f5b33b7880c9be9", "level": "note", "message": {"text": "Unused endpoint: USE /api/cowork"}, "properties": {"repobilityId": "76b8cfe731eeeec3", "scanner": "scanner-primary", "fingerprint": "1f5b33b7880c9be9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d73ccf163920bd14", "level": "note", "message": {"text": "Unused endpoint: USE /api/storage"}, "properties": {"repobilityId": "030043d4a7a5b35d", "scanner": "scanner-primary", "fingerprint": "d73ccf163920bd14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c48eeaff10415a8f", "level": "note", "message": {"text": "Unused endpoint: ALL /agencias/api/proxy.php"}, "properties": {"repobilityId": "93754ecd488883b3", "scanner": "scanner-primary", "fingerprint": "c48eeaff10415a8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1ad6da5476b01cc4", "level": "note", "message": {"text": "Unused endpoint: USE /agencias"}, "properties": {"repobilityId": "6badb2e12c6df293", "scanner": "scanner-primary", "fingerprint": "1ad6da5476b01cc4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3a15827f4596395", "level": "note", "message": {"text": "Unused endpoint: USE /cotizacion"}, "properties": {"repobilityId": "f4ce6d86a2654f41", "scanner": "scanner-primary", "fingerprint": "a3a15827f4596395", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85b7a94dbd027bd6", "level": "note", "message": {"text": "Unused endpoint: USE /voucher"}, "properties": {"repobilityId": "3d2242eebeb8b1b8", "scanner": "scanner-primary", "fingerprint": "85b7a94dbd027bd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f8242ba07247d2f8", "level": "note", "message": {"text": "Unused endpoint: USE /api/payments"}, "properties": {"repobilityId": "b8f2a251c3be45eb", "scanner": "scanner-primary", "fingerprint": "f8242ba07247d2f8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-600dd4446558a94c", "level": "note", "message": {"text": "Unused endpoint: USE /pagar"}, "properties": {"repobilityId": "c028793369311806", "scanner": "scanner-primary", "fingerprint": "600dd4446558a94c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6054ddc620b8f5d1", "level": "note", "message": {"text": "Unused endpoint: GET /api/proxy-image"}, "properties": {"repobilityId": "6f10419fd65454ad", "scanner": "scanner-primary", "fingerprint": "6054ddc620b8f5d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5deac614037b912", "level": "note", "message": {"text": "Unused endpoint: USE /api/leads"}, "properties": {"repobilityId": "49fe0df95c80e17d", "scanner": "scanner-primary", "fingerprint": "c5deac614037b912", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c96f83828d0e1e4f", "level": "note", "message": {"text": "Unused endpoint: USE /api/agentes"}, "properties": {"repobilityId": "68d59d7203acdd87", "scanner": "scanner-primary", "fingerprint": "c96f83828d0e1e4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0cdfc54d1b370bd", "level": "note", "message": {"text": "Unused endpoint: USE /api/admin/users"}, "properties": {"repobilityId": "eae7639467c6f884", "scanner": "scanner-primary", "fingerprint": "e0cdfc54d1b370bd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e839c7e0bafe913", "level": "note", "message": {"text": "Unused endpoint: USE /hub"}, "properties": {"repobilityId": "0754d9d86c798bbe", "scanner": "scanner-primary", "fingerprint": "3e839c7e0bafe913", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd86b206ca4843db", "level": "note", "message": {"text": "Unused endpoint: GET /cotizar"}, "properties": {"repobilityId": "c714afb20bda1e83", "scanner": "scanner-primary", "fingerprint": "bd86b206ca4843db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6535b27b74e1c94", "level": "note", "message": {"text": "Unused endpoint: GET /registro-alojamiento"}, "properties": {"repobilityId": "8acb8eb1c1a2b2a5", "scanner": "scanner-primary", "fingerprint": "a6535b27b74e1c94", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a9d5d28b74195de", "level": "note", "message": {"text": "Unused endpoint: USE /disponibilidad-admin"}, "properties": {"repobilityId": "6bcfe8874d35a0b7", "scanner": "scanner-primary", "fingerprint": "3a9d5d28b74195de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c2eca859a80155d", "level": "note", "message": {"text": "Unused endpoint: USE /api/disponibilidad"}, "properties": {"repobilityId": "6e84ca8117800928", "scanner": "scanner-primary", "fingerprint": "4c2eca859a80155d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f5312239b77f4334", "level": "note", "message": {"text": "Unused endpoint: GET /disponibilidad-propietario"}, "properties": {"repobilityId": "c548b325e780ccc2", "scanner": "scanner-primary", "fingerprint": "f5312239b77f4334", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3e55a1e258581c7", "level": "note", "message": {"text": "Unused endpoint: GET /aliado/:slug"}, "properties": {"repobilityId": "f1ba1d4ee1ab2db0", "scanner": "scanner-primary", "fingerprint": "a3e55a1e258581c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f699c6eea9c4f6eb", "level": "note", "message": {"text": "Unused endpoint: POST /api/ai/chat"}, "properties": {"repobilityId": "a2cc22ade2708be0", "scanner": "scanner-primary", "fingerprint": "f699c6eea9c4f6eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}