Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

TylorSTYLE/ChunChuGwan

https://github.com/TylorSTYLE/ChunChuGwan · scanned 2026-06-16 00:44 UTC (2 months, 1 week ago)

146 raw signals (0 security + 146 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 125 actionable findings from 1 signal source. 21 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
55.3
/100
Security checks
55
0 findings
System graph
55
100.0% cov · 125 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 1 High 51 Medium 3 Low 64 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 125 Crowd 0 Layer: Software 2 Hardware 2 Frontend 1 Security 52 Cicd 4 Quality 14 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 55.3/100 with 100.0% coverage. It contains 1826 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 146 findings — concentrated in security (52), api (50), quality (28). Risk profile is high: 1 critical, 51 high, 9 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 119 of 125 actionable findings. 146 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Secrets conf 1.00 Possible secret in README.md
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
README.md:198
high System graph security auth conf 1.00 FastAPI POST `api_archive` without auth dependency — chunchugwan/web/api_routes.py:167
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/api_routes.py:167 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `api_keys_create` without auth dependency — chunchugwan/web/system_routes.py:661
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:661 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `api_keys_delete` without auth dependency — chunchugwan/web/system_routes.py:701
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:701 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `archive_new` without auth dependency — chunchugwan/web/app.py:1486
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1486 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `change_display_name` without auth dependency — chunchugwan/web/auth_routes.py:539
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:539 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `change_language` without auth dependency — chunchugwan/web/auth_routes.py:515
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:515 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `change_password` without auth dependency — chunchugwan/web/auth_routes.py:556
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:556 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `change_timezone` without auth dependency — chunchugwan/web/auth_routes.py:527
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:527 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `crawl_cancel` without auth dependency — chunchugwan/web/app.py:1709
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1709 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `crawl_page_retry` without auth dependency — chunchugwan/web/app.py:1734
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1734 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `crawl_retry` without auth dependency — chunchugwan/web/app.py:1720
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1720 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `crawl_schedule_delete` without auth dependency — chunchugwan/web/app.py:1827
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1827 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `crawl_schedule_next_run` without auth dependency — chunchugwan/web/app.py:1795
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1795 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `crawl_schedule_set` without auth dependency — chunchugwan/web/app.py:1767
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1767 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `invite_accept` without auth dependency — chunchugwan/web/auth_routes.py:789
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:789 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `log_retry` without auth dependency — chunchugwan/web/app.py:1560
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1560 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `network_tags_create` without auth dependency — chunchugwan/web/system_routes.py:308
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:308 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `network_tags_delete` without auth dependency — chunchugwan/web/system_routes.py:339
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:339 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `page_delete` without auth dependency — chunchugwan/web/app.py:1595
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1595 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `passkey_delete` without auth dependency — chunchugwan/web/auth_routes.py:455
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:455 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `passkey_login_options` without auth dependency — chunchugwan/web/auth_routes.py:284
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:284 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `passkey_login` without auth dependency — chunchugwan/web/auth_routes.py:301
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:301 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `passkey_register_options` without auth dependency — chunchugwan/web/auth_routes.py:411
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:411 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `passkey_register` without auth dependency — chunchugwan/web/auth_routes.py:428
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:428 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `rearchive` without auth dependency — chunchugwan/web/app.py:1540
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1540 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `schedule_delete` without auth dependency — chunchugwan/web/app.py:856
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:856 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `schedule_next_run` without auth dependency — chunchugwan/web/app.py:816
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:816 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `schedule_set` without auth dependency — chunchugwan/web/app.py:788
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:788 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `setup` without auth dependency — chunchugwan/web/auth_routes.py:133
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:133 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `site_crawl_failed_retry` without auth dependency — chunchugwan/web/app.py:528
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:528 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `site_delete` without auth dependency — chunchugwan/web/app.py:577
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:577 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `site_export` without auth dependency — chunchugwan/web/app.py:559
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:559 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `site_failed_retry` without auth dependency — chunchugwan/web/app.py:507
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:507 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `snapshot_delete` without auth dependency — chunchugwan/web/app.py:1620
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/app.py:1620 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_backup` without auth dependency — chunchugwan/web/system_routes.py:179
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:179 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_compact` without auth dependency — chunchugwan/web/system_routes.py:205
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:205 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_crawl_settings` without auth dependency — chunchugwan/web/system_routes.py:265
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:265 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_export` without auth dependency — chunchugwan/web/system_routes.py:186
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:186 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_import` without auth dependency — chunchugwan/web/system_routes.py:716
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:716 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_restore` without auth dependency — chunchugwan/web/system_routes.py:361
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:361 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `system_settings` without auth dependency — chunchugwan/web/system_routes.py:241
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:241 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `totp_confirm` without auth dependency — chunchugwan/web/auth_routes.py:352
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:352 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `totp_disable` without auth dependency — chunchugwan/web/auth_routes.py:373
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:373 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `totp_login` without auth dependency — chunchugwan/web/auth_routes.py:261
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:261 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `users_delete` without auth dependency — chunchugwan/web/system_routes.py:455
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:455 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `users_force_logout` without auth dependency — chunchugwan/web/system_routes.py:515
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:515 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `users_invite_delete` without auth dependency — chunchugwan/web/system_routes.py:585
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:585 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `users_invite` without auth dependency — chunchugwan/web/system_routes.py:535
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:535 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `users_set_name` without auth dependency — chunchugwan/web/system_routes.py:488
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:488 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `users_set_role` without auth dependency — chunchugwan/web/system_routes.py:420
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/system_routes.py:420 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `withdraw_account` without auth dependency — chunchugwan/web/auth_routes.py:590
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
chunchugwan/web/auth_routes.py:590 securityAuth fastapi unauth mutation
medium System graph cicd CI/CD security conf 1.00 7 occurrences GitHub Action is tag-pinned rather than SHA-pinned
astral-sh/setup-uv@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
3 files, 7 locations
.github/workflows/docker.yml:40, 48, 88, 98, 125 (5 hits)
.github/workflows/ci.yml:21
.github/workflows/release.yml:89
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/docker.yml CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/release.yml CI/CD securitySupply chainGithub actions
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.12-bookworm-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:2 containersPinned dependencies
low System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/cache@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 2 locations
.github/workflows/ci.yml:31
.github/workflows/release.yml:50
CI/CD securitySupply chainGithub actions
low System graph quality Integrity conf 1.00 15 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: chunchugwan/db.py:list_archive_logs, chunchugwan/db.py:count_archive_logs This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
15 occurrences
repo-level (15 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_consistent_db_copy` in chunchugwan/backup.py:73
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in chunchugwan/cli.py:617
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `create_backup` in tests/test_backup.py:86
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `system_backup` in chunchugwan/web/system_routes.py:180
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: emit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
chunchugwan/system_log.py:48
low System graph software Dead code conf 1.00 Possibly dead Python function: repl
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
chunchugwan/capture.py:698
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`chunchugwan/web/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /archive/active
`chunchugwan/web/app.py` declares `GET /archive/active` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /archive/new
`chunchugwan/web/app.py` declares `GET /archive/new` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /archives
`chunchugwan/web/app.py` declares `GET /archives` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /crawl/{crawl_id}/goto
`chunchugwan/web/app.py` declares `GET /crawl/{crawl_id}/goto` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /crawls
`chunchugwan/web/app.py` declares `GET /crawls` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /crawls/{crawl_id}
`chunchugwan/web/app.py` declares `GET /crawls/{crawl_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /crawls/{crawl_id}/status
`chunchugwan/web/app.py` declares `GET /crawls/{crawl_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /dashboard
`chunchugwan/web/app.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /diff/{page_id}
`chunchugwan/web/app.py` declares `GET /diff/{page_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /diff/{page_id}/shotdiff
`chunchugwan/web/app.py` declares `GET /diff/{page_id}/shotdiff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /document/{sha256}/{name}
`chunchugwan/web/app.py` declares `GET /document/{sha256}/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /documents
`chunchugwan/web/app.py` declares `GET /documents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /favicon.svg
`chunchugwan/web/app.py` declares `GET /favicon.svg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /login
`chunchugwan/web/auth_routes.py` declares `GET /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /login/totp
`chunchugwan/web/auth_routes.py` declares `GET /login/totp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /logs
`chunchugwan/web/app.py` declares `GET /logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /page/{page_id}
`chunchugwan/web/app.py` declares `GET /page/{page_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /pages
`chunchugwan/web/api_routes.py` declares `GET /pages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /pages/{page_id}
`chunchugwan/web/api_routes.py` declares `GET /pages/{page_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /resource/{name}
`chunchugwan/web/app.py` declares `GET /resource/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /schedules
`chunchugwan/web/app.py` declares `GET /schedules` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /setup
`chunchugwan/web/auth_routes.py` declares `GET /setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sites/{site_id}
`chunchugwan/web/app.py` declares `GET /sites/{site_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /sites/{site_id}/certificates/{cert_id}.pem
`chunchugwan/web/app.py` declares `GET /sites/{site_id}/certificates/{cert_id}.pem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /snapshot/{snapshot_id}
`chunchugwan/web/app.py` declares `GET /snapshot/{snapshot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /snapshot/{snapshot_id}/doc/{name}
`chunchugwan/web/app.py` declares `GET /snapshot/{snapshot_id}/doc/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /snapshot/{snapshot_id}/file/{name}
`chunchugwan/web/app.py` declares `GET /snapshot/{snapshot_id}/file/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /snapshots/{snapshot_id}
`chunchugwan/web/api_routes.py` declares `GET /snapshots/{snapshot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /snapshots/{snapshot_id}/file/{name}
`chunchugwan/web/api_routes.py` declares `GET /snapshots/{snapshot_id}/file/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /archive
`chunchugwan/web/api_routes.py` declares `POST /archive` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /crawl-schedules/{schedule_id}
`chunchugwan/web/app.py` declares `POST /crawl-schedules/{schedule_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /crawl-schedules/{schedule_id}/delete
`chunchugwan/web/app.py` declares `POST /crawl-schedules/{schedule_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /crawl-schedules/{schedule_id}/next-run
`chunchugwan/web/app.py` declares `POST /crawl-schedules/{schedule_id}/next-run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /crawls/{crawl_id}/cancel
`chunchugwan/web/app.py` declares `POST /crawls/{crawl_id}/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /crawls/{crawl_id}/pages/{crawl_page_id}/retry
`chunchugwan/web/app.py` declares `POST /crawls/{crawl_id}/pages/{crawl_page_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who con…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /crawls/{crawl_id}/retry
`chunchugwan/web/app.py` declares `POST /crawls/{crawl_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /login
`chunchugwan/web/auth_routes.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /logs/{log_id}/retry
`chunchugwan/web/app.py` declares `POST /logs/{log_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /page/{page_id}/delete
`chunchugwan/web/app.py` declares `POST /page/{page_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /page/{page_id}/rearchive
`chunchugwan/web/app.py` declares `POST /page/{page_id}/rearchive` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /page/{page_id}/schedule
`chunchugwan/web/app.py` declares `POST /page/{page_id}/schedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /page/{page_id}/schedule/delete
`chunchugwan/web/app.py` declares `POST /page/{page_id}/schedule/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /page/{page_id}/schedule/next-run
`chunchugwan/web/app.py` declares `POST /page/{page_id}/schedule/next-run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /setup
`chunchugwan/web/auth_routes.py` declares `POST /setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sites/{site_id}/crawl-failed/{crawl_page_id}/retry
`chunchugwan/web/app.py` declares `POST /sites/{site_id}/crawl-failed/{crawl_page_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting wh…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sites/{site_id}/delete
`chunchugwan/web/app.py` declares `POST /sites/{site_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sites/{site_id}/export
`chunchugwan/web/app.py` declares `POST /sites/{site_id}/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sites/{site_id}/failed/{log_id}/retry
`chunchugwan/web/app.py` declares `POST /sites/{site_id}/failed/{log_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /snapshot/{snapshot_id}/delete
`chunchugwan/web/app.py` declares `POST /snapshot/{snapshot_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: chunchugwan/db.py (2850 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: chunchugwan/web/app.py (1863 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: chunchugwan/web/i18n.py (909 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/a611ab73-d500-41e2-b35f-feee6961fd6e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/a611ab73-d500-41e2-b35f-feee6961fd6e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.