{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-364ed0c78b26853a", "name": "Possibly dead Python function: can_transition", "shortDescription": {"text": "Possibly dead Python function: can_transition"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a68f887b493ad5b3", "name": "Possibly dead Python function: create_audit_event", "shortDescription": {"text": "Possibly dead Python function: create_audit_event"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6eaba1d1de46287", "name": "Possibly dead Python function: to_dict", "shortDescription": {"text": "Possibly dead Python function: to_dict"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-409324134e95b805", "name": "Possibly dead Python function: do_run_migrations", "shortDescription": {"text": "Possibly dead Python function: do_run_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6137e5f6547bcdef", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3197688d53fa1198", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0219f8a27c24f45b", "name": "Possibly dead Python function: file_size", "shortDescription": {"text": "Possibly dead Python function: file_size"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-714c31ca9f474ae6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68641db48c98915f", "name": "Very large file: scripts/gen_all_part2.py (2911 lines)", "shortDescription": {"text": "Very large file: scripts/gen_all_part2.py (2911 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "30 tests / 139 src (ratio 0.22)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 72 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 38 placeholder/mock markers across 17 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f5d5c3d05ce5dd4", "name": "Commented-code block (6 lines) in mobile/app/__tests__/diagnostic.test.tsx:42", "shortDescription": {"text": "Commented-code block (6 lines) in mobile/app/__tests__/diagnostic.test.tsx:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d51cfcea25cfaac", "name": "FastAPI POST `create_new_contract` without auth dependency \u2014 backend/app/modules/learning_contract/router.py:21", "shortDescription": {"text": "FastAPI POST `create_new_contract` without auth dependency \u2014 backend/app/modules/learning_contract/router.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-247c67a1a9fe1e6b", "name": "FastAPI POST `decide` without auth dependency \u2014 backend/app/modules/policy_engine/router.py:14", "shortDescription": {"text": "FastAPI POST `decide` without auth dependency \u2014 backend/app/modules/policy_engine/router.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f69a5d05a3f0c4d4", "name": "FastAPI POST `create_audit_event` without auth dependency \u2014 backend/app/modules/audit/router.py:14", "shortDescription": {"text": "FastAPI POST `create_audit_event` without auth dependency \u2014 backend/app/modules/audit/router.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91665d8f29004a35", "name": "FastAPI POST `create_mastery_evidence` without auth dependency \u2014 backend/app/modules/mastery/router.py:14", "shortDescription": {"text": "FastAPI POST `create_mastery_evidence` without auth dependency \u2014 backend/app/modules/mastery/router.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2f57917ee1c44281", "name": "FastAPI POST `validate_analysis` without auth dependency \u2014 backend/app/modules/linguistic_validation/router.py:13", "shortDescription": {"text": "FastAPI POST `validate_analysis` without auth dependency \u2014 backend/app/modules/linguistic_validation/router.py:13"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-07909a5836263e97", "name": "FastAPI POST `validate_pedagogical_endpoint` without auth dependency \u2014 backend/app/modules/pedagogical_validation/router", "shortDescription": {"text": "FastAPI POST `validate_pedagogical_endpoint` without auth dependency \u2014 backend/app/modules/pedagogical_validation/router.py:15"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3972fad1f7628bc", "name": "FastAPI POST `create_profile` without auth dependency \u2014 backend/app/modules/learner_profile/router.py:14", "shortDescription": {"text": "FastAPI POST `create_profile` without auth dependency \u2014 backend/app/modules/learner_profile/router.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92ae6e5fbc57f324", "name": "FastAPI POST `create_diagnostic_session` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:26", "shortDescription": {"text": "FastAPI POST `create_diagnostic_session` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:26"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-622ee446d1fa07fc", "name": "FastAPI POST `submit_diagnostic_response` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:39", "shortDescription": {"text": "FastAPI POST `submit_diagnostic_response` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:39"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ad6169a2bdea337", "name": "FastAPI POST `complete_diagnostic_session` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:60", "shortDescription": {"text": "FastAPI POST `complete_diagnostic_session` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:60"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2676fdeb3dca68c9", "name": "FastAPI POST `submit_text` without auth dependency \u2014 backend/app/modules/submission/router.py:14", "shortDescription": {"text": "FastAPI POST `submit_text` without auth dependency \u2014 backend/app/modules/submission/router.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3caaff26daeead6a", "name": "FastAPI POST `analyze_text` without auth dependency \u2014 backend/app/modules/ai_gateway/router.py:15", "shortDescription": {"text": "FastAPI POST `analyze_text` without auth dependency \u2014 backend/app/modules/ai_gateway/router.py:15"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3375fee933ba24f8", "name": "FastAPI POST `start_lesson_session` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:26", "shortDescription": {"text": "FastAPI POST `start_lesson_session` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:26"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-29fa747daac244a3", "name": "FastAPI POST `submit_learner_text` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:62", "shortDescription": {"text": "FastAPI POST `submit_learner_text` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:62"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-780bdd2c78e303ec", "name": "FastAPI POST `process_lesson` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:90", "shortDescription": {"text": "FastAPI POST `process_lesson` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:90"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a436691337284d03", "name": "Unused endpoint: GET /api/v1/health", "shortDescription": {"text": "Unused endpoint: GET /api/v1/health"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/v1/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-959e83c0a87139d8", "name": "Unused endpoint: GET /current", "shortDescription": {"text": "Unused endpoint: GET /current"}, "fullDescription": {"text": "`backend/app/modules/learning_contract/router.py` declares `GET /current` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a1ef9b15f9d12b5", "name": "Unused endpoint: POST /current", "shortDescription": {"text": "Unused endpoint: POST /current"}, "fullDescription": {"text": "`backend/app/modules/learning_contract/router.py` declares `POST /current` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-050023c4cc2f9d01", "name": "Unused endpoint: POST /decide", "shortDescription": {"text": "Unused endpoint: POST /decide"}, "fullDescription": {"text": "`backend/app/modules/policy_engine/router.py` declares `POST /decide` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-150a51bfa1c53963", "name": "Unused endpoint: POST /events", "shortDescription": {"text": "Unused endpoint: POST /events"}, "fullDescription": {"text": "`backend/app/modules/audit/router.py` declares `POST /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43269e4e79c2e69e", "name": "Unused endpoint: GET /events", "shortDescription": {"text": "Unused endpoint: GET /events"}, "fullDescription": {"text": "`backend/app/modules/audit/router.py` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed4d9f3ade145f33", "name": "Unused endpoint: POST /evidence", "shortDescription": {"text": "Unused endpoint: POST /evidence"}, "fullDescription": {"text": "`backend/app/modules/mastery/router.py` declares `POST /evidence` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2595b39638e5c045", "name": "Unused endpoint: GET /profile", "shortDescription": {"text": "Unused endpoint: GET /profile"}, "fullDescription": {"text": "`backend/app/modules/mastery/router.py` declares `GET /profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34c0472a1f1fafe5", "name": "Unused endpoint: POST /validate", "shortDescription": {"text": "Unused endpoint: POST /validate"}, "fullDescription": {"text": "`backend/app/modules/linguistic_validation/router.py` declares `POST /validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`backend/app/modules/identity/router.py` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`backend/app/modules/identity/router.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`backend/app/modules/identity/router.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`backend/app/modules/learner_profile/router.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92efb2dc9205e7a4", "name": "Unused endpoint: POST /sessions", "shortDescription": {"text": "Unused endpoint: POST /sessions"}, "fullDescription": {"text": "`backend/app/modules/diagnostics/router.py` declares `POST /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a2f462a06e9bd0d", "name": "Unused endpoint: POST /sessions/{session_id}/responses", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/responses"}, "fullDescription": {"text": "`backend/app/modules/diagnostics/router.py` declares `POST /sessions/{session_id}/responses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6813389afcecd6", "name": "Unused endpoint: POST /sessions/{session_id}/complete", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/complete"}, "fullDescription": {"text": "`backend/app/modules/diagnostics/router.py` declares `POST /sessions/{session_id}/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41c23ec3b2c0e166", "name": "Unused endpoint: GET /sessions/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}"}, "fullDescription": {"text": "`backend/app/modules/diagnostics/router.py` declares `GET /sessions/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49f84db9d3d1f0d7", "name": "Unused endpoint: GET /{submission_id}", "shortDescription": {"text": "Unused endpoint: GET /{submission_id}"}, "fullDescription": {"text": "`backend/app/modules/submission/router.py` declares `GET /{submission_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c61e6f199d7b25e4", "name": "Unused endpoint: GET /audit-events", "shortDescription": {"text": "Unused endpoint: GET /audit-events"}, "fullDescription": {"text": "`backend/app/modules/operator/router.py` declares `GET /audit-events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fca11d494725d7c3", "name": "Unused endpoint: POST /analyze", "shortDescription": {"text": "Unused endpoint: POST /analyze"}, "fullDescription": {"text": "`backend/app/modules/ai_gateway/router.py` declares `POST /analyze` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af24049c13127ae7", "name": "Unused endpoint: GET /{session_id}", "shortDescription": {"text": "Unused endpoint: GET /{session_id}"}, "fullDescription": {"text": "`backend/app/modules/lesson_engine/router.py` declares `GET /{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f592082cd71bd0ba", "name": "Unused endpoint: POST /{session_id}/submissions", "shortDescription": {"text": "Unused endpoint: POST /{session_id}/submissions"}, "fullDescription": {"text": "`backend/app/modules/lesson_engine/router.py` declares `POST /{session_id}/submissions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be380bc6e1580236", "name": "Unused endpoint: POST /{session_id}/process", "shortDescription": {"text": "Unused endpoint: POST /{session_id}/process"}, "fullDescription": {"text": "`backend/app/modules/lesson_engine/router.py` declares `POST /{session_id}/process` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19982"}, "properties": {"repository": "solomonczyk/LANGUAGE-LEARNING-APP", "repoUrl": "https://github.com/solomonczyk/LANGUAGE-LEARNING-APP", "branch": "main"}, "results": [{"ruleId": "scanner-364ed0c78b26853a", "level": "note", "message": {"text": "Possibly dead Python function: can_transition"}, "properties": {"repobilityId": "3b99e06d9a56054f", "scanner": "scanner-primary", "fingerprint": "364ed0c78b26853a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/shared/state_machine.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a68f887b493ad5b3", "level": "note", "message": {"text": "Possibly dead Python function: create_audit_event"}, "properties": {"repobilityId": "05b6480a55a7f3c2", "scanner": "scanner-primary", "fingerprint": "a68f887b493ad5b3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/shared/audit.py:9"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6eaba1d1de46287", "level": "note", "message": {"text": "Possibly dead Python function: to_dict"}, "properties": {"repobilityId": "017f31ed997ca27d", "scanner": "scanner-primary", "fingerprint": "e6eaba1d1de46287", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/shared/exceptions/domain.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-409324134e95b805", "level": "note", "message": {"text": "Possibly dead Python function: do_run_migrations"}, "properties": {"repobilityId": "087acb17722cfd2f", "scanner": "scanner-primary", "fingerprint": "409324134e95b805", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/env.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6137e5f6547bcdef", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "6137e5f6547bcdef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/001_initial_schema.py:19"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3197688d53fa1198", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "3197688d53fa1198", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/001_initial_schema.py:271"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0219f8a27c24f45b", "level": "note", "message": {"text": "Possibly dead Python function: file_size"}, "properties": {"repobilityId": "502d9490cbaa3095", "scanner": "scanner-primary", "fingerprint": "0219f8a27c24f45b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "documents/language_learning_app/language_learning_app_master_product_package_002d/validation/validate_master_product_package_002d.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-714c31ca9f474ae6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "f614a1e41f331b37", "scanner": "scanner-primary", "fingerprint": "714c31ca9f474ae6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-68641db48c98915f", "level": "note", "message": {"text": "Very large file: scripts/gen_all_part2.py (2911 lines)"}, "properties": {"repobilityId": "00b91d9152410c1b", "scanner": "scanner-primary", "fingerprint": "68641db48c98915f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "c08dc302c69de298", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "b3b1a7cf858a7833", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b98071da34647796", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6c261e46fa68503f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "22c8231e478519c0", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "87a9d218b4b04fef", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "6dc2f129bb32fc28", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "2131bae3f112463d", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3f5d5c3d05ce5dd4", "level": "none", "message": {"text": "Commented-code block (6 lines) in mobile/app/__tests__/diagnostic.test.tsx:42"}, "properties": {"repobilityId": "55a2c6d648cd80a0", "scanner": "scanner-primary", "fingerprint": "3f5d5c3d05ce5dd4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d51cfcea25cfaac", "level": "error", "message": {"text": "FastAPI POST `create_new_contract` without auth dependency \u2014 backend/app/modules/learning_contract/router.py:21"}, "properties": {"repobilityId": "ede5f027625ee923", "scanner": "scanner-primary", "fingerprint": "3d51cfcea25cfaac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/learning_contract/router.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-247c67a1a9fe1e6b", "level": "error", "message": {"text": "FastAPI POST `decide` without auth dependency \u2014 backend/app/modules/policy_engine/router.py:14"}, "properties": {"repobilityId": "d8ce60d008ab842b", "scanner": "scanner-primary", "fingerprint": "247c67a1a9fe1e6b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/policy_engine/router.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-f69a5d05a3f0c4d4", "level": "error", "message": {"text": "FastAPI POST `create_audit_event` without auth dependency \u2014 backend/app/modules/audit/router.py:14"}, "properties": {"repobilityId": "f777e43632386e0d", "scanner": "scanner-primary", "fingerprint": "f69a5d05a3f0c4d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/audit/router.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-91665d8f29004a35", "level": "error", "message": {"text": "FastAPI POST `create_mastery_evidence` without auth dependency \u2014 backend/app/modules/mastery/router.py:14"}, "properties": {"repobilityId": "b9058aa838fb4d1c", "scanner": "scanner-primary", "fingerprint": "91665d8f29004a35", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/mastery/router.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-2f57917ee1c44281", "level": "error", "message": {"text": "FastAPI POST `validate_analysis` without auth dependency \u2014 backend/app/modules/linguistic_validation/router.py:13"}, "properties": {"repobilityId": "f18d5e8c8d6685d2", "scanner": "scanner-primary", "fingerprint": "2f57917ee1c44281", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/linguistic_validation/router.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-07909a5836263e97", "level": "error", "message": {"text": "FastAPI POST `validate_pedagogical_endpoint` without auth dependency \u2014 backend/app/modules/pedagogical_validation/router.py:15"}, "properties": {"repobilityId": "83c0507547130b07", "scanner": "scanner-primary", "fingerprint": "07909a5836263e97", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/pedagogical_validation/router.py"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-c3972fad1f7628bc", "level": "error", "message": {"text": "FastAPI POST `create_profile` without auth dependency \u2014 backend/app/modules/learner_profile/router.py:14"}, "properties": {"repobilityId": "529f015abdd44e15", "scanner": "scanner-primary", "fingerprint": "c3972fad1f7628bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/learner_profile/router.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-92ae6e5fbc57f324", "level": "error", "message": {"text": "FastAPI POST `create_diagnostic_session` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:26"}, "properties": {"repobilityId": "687a5c2f27febdbe", "scanner": "scanner-primary", "fingerprint": "92ae6e5fbc57f324", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/diagnostics/router.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-622ee446d1fa07fc", "level": "error", "message": {"text": "FastAPI POST `submit_diagnostic_response` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:39"}, "properties": {"repobilityId": "6dcd5e574d5c0590", "scanner": "scanner-primary", "fingerprint": "622ee446d1fa07fc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/diagnostics/router.py"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-4ad6169a2bdea337", "level": "error", "message": {"text": "FastAPI POST `complete_diagnostic_session` without auth dependency \u2014 backend/app/modules/diagnostics/router.py:60"}, "properties": {"repobilityId": "a93ee9afec88ae6c", "scanner": "scanner-primary", "fingerprint": "4ad6169a2bdea337", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/diagnostics/router.py"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-2676fdeb3dca68c9", "level": "error", "message": {"text": "FastAPI POST `submit_text` without auth dependency \u2014 backend/app/modules/submission/router.py:14"}, "properties": {"repobilityId": "8e5256d5a9184bfb", "scanner": "scanner-primary", "fingerprint": "2676fdeb3dca68c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/submission/router.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-3caaff26daeead6a", "level": "error", "message": {"text": "FastAPI POST `analyze_text` without auth dependency \u2014 backend/app/modules/ai_gateway/router.py:15"}, "properties": {"repobilityId": "19a8d6cb36c84bcf", "scanner": "scanner-primary", "fingerprint": "3caaff26daeead6a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/ai_gateway/router.py"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-3375fee933ba24f8", "level": "error", "message": {"text": "FastAPI POST `start_lesson_session` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:26"}, "properties": {"repobilityId": "7a1fd718673bd9f3", "scanner": "scanner-primary", "fingerprint": "3375fee933ba24f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/lesson_engine/router.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-29fa747daac244a3", "level": "error", "message": {"text": "FastAPI POST `submit_learner_text` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:62"}, "properties": {"repobilityId": "7df3157adbcb0cca", "scanner": "scanner-primary", "fingerprint": "29fa747daac244a3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/lesson_engine/router.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-780bdd2c78e303ec", "level": "error", "message": {"text": "FastAPI POST `process_lesson` without auth dependency \u2014 backend/app/modules/lesson_engine/router.py:90"}, "properties": {"repobilityId": "8b24e040efa73785", "scanner": "scanner-primary", "fingerprint": "780bdd2c78e303ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/modules/lesson_engine/router.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-a436691337284d03", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/health"}, "properties": {"repobilityId": "61760f003b0ac26a", "scanner": "scanner-primary", "fingerprint": "a436691337284d03", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-959e83c0a87139d8", "level": "note", "message": {"text": "Unused endpoint: GET /current"}, "properties": {"repobilityId": "233e843b5f803e43", "scanner": "scanner-primary", "fingerprint": "959e83c0a87139d8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a1ef9b15f9d12b5", "level": "note", "message": {"text": "Unused endpoint: POST /current"}, "properties": {"repobilityId": "8339b4848caf9d95", "scanner": "scanner-primary", "fingerprint": "9a1ef9b15f9d12b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-050023c4cc2f9d01", "level": "note", "message": {"text": "Unused endpoint: POST /decide"}, "properties": {"repobilityId": "bc18439c1f37ede0", "scanner": "scanner-primary", "fingerprint": "050023c4cc2f9d01", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-150a51bfa1c53963", "level": "note", "message": {"text": "Unused endpoint: POST /events"}, "properties": {"repobilityId": "09b5eee880e0c215", "scanner": "scanner-primary", "fingerprint": "150a51bfa1c53963", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43269e4e79c2e69e", "level": "note", "message": {"text": "Unused endpoint: GET /events"}, "properties": {"repobilityId": "491e530ebe5432bb", "scanner": "scanner-primary", "fingerprint": "43269e4e79c2e69e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed4d9f3ade145f33", "level": "note", "message": {"text": "Unused endpoint: POST /evidence"}, "properties": {"repobilityId": "1fa40e8e5854dd90", "scanner": "scanner-primary", "fingerprint": "ed4d9f3ade145f33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2595b39638e5c045", "level": "note", "message": {"text": "Unused endpoint: GET /profile"}, "properties": {"repobilityId": "f0821a0a1451a82b", "scanner": "scanner-primary", "fingerprint": "2595b39638e5c045", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34c0472a1f1fafe5", "level": "note", "message": {"text": "Unused endpoint: POST /validate"}, "properties": {"repobilityId": "2bc8f5eaa4c1ac08", "scanner": "scanner-primary", "fingerprint": "34c0472a1f1fafe5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "be7d2f86a4e14500", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "7c9309803a2c0a08", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "a94563ba01faac93", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "d7e2c4537cd2ef69", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92efb2dc9205e7a4", "level": "note", "message": {"text": "Unused endpoint: POST /sessions"}, "properties": {"repobilityId": "8bbd24eb9ef1f9ea", "scanner": "scanner-primary", "fingerprint": "92efb2dc9205e7a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a2f462a06e9bd0d", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/responses"}, "properties": {"repobilityId": "ba1cebb57a2e55e9", "scanner": "scanner-primary", "fingerprint": "2a2f462a06e9bd0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a6813389afcecd6", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/complete"}, "properties": {"repobilityId": "9824070de8de8f15", "scanner": "scanner-primary", "fingerprint": "1a6813389afcecd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41c23ec3b2c0e166", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}"}, "properties": {"repobilityId": "863ce2f0b5307bc2", "scanner": "scanner-primary", "fingerprint": "41c23ec3b2c0e166", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49f84db9d3d1f0d7", "level": "note", "message": {"text": "Unused endpoint: GET /{submission_id}"}, "properties": {"repobilityId": "6d62c18ae7875577", "scanner": "scanner-primary", "fingerprint": "49f84db9d3d1f0d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c61e6f199d7b25e4", "level": "note", "message": {"text": "Unused endpoint: GET /audit-events"}, "properties": {"repobilityId": "2ef178389aa62753", "scanner": "scanner-primary", "fingerprint": "c61e6f199d7b25e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fca11d494725d7c3", "level": "note", "message": {"text": "Unused endpoint: POST /analyze"}, "properties": {"repobilityId": "a62da50fa175890b", "scanner": "scanner-primary", "fingerprint": "fca11d494725d7c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af24049c13127ae7", "level": "note", "message": {"text": "Unused endpoint: GET /{session_id}"}, "properties": {"repobilityId": "bbed14ad6c2474fd", "scanner": "scanner-primary", "fingerprint": "af24049c13127ae7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f592082cd71bd0ba", "level": "note", "message": {"text": "Unused endpoint: POST /{session_id}/submissions"}, "properties": {"repobilityId": "190001829d985caf", "scanner": "scanner-primary", "fingerprint": "f592082cd71bd0ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be380bc6e1580236", "level": "note", "message": {"text": "Unused endpoint: POST /{session_id}/process"}, "properties": {"repobilityId": "e864496a195700a0", "scanner": "scanner-primary", "fingerprint": "be380bc6e1580236", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}