{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b1d7532ca8f725bb", "name": "Possibly dead Python function: extract_paper_title", "shortDescription": {"text": "Possibly dead Python function: extract_paper_title"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e731c8fa36510ed4", "name": "Possibly dead Python function: extract_paper_title_openai", "shortDescription": {"text": "Possibly dead Python function: extract_paper_title_openai"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7ce0470d0ee5fde", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eed7c56fb1f786f7", "name": "Possibly dead Python function: process_single_pdf", "shortDescription": {"text": "Possibly dead Python function: process_single_pdf"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d6d71909a96a64a", "name": "Stray `console.log` in TS/JS \u2014 static/edit_post.js:1163", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/edit_post.js:1163"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d52f83707f1c1412", "name": "Stray `console.log` in TS/JS \u2014 static/fabric.min.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/fabric.min.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-06b7b3b456d87d38", "name": "Stray `console.log` in TS/JS \u2014 static/scripts.js:103", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/scripts.js:103"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fcd79a8d80fafed", "name": "Stray `console.log` in TS/JS \u2014 static/cytoscape.min.js:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/cytoscape.min.js:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-013ccfae90583060", "name": "Insecure pattern 'subprocess_shell_true' in main.py:2929", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in main.py:2929"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-17898bf7bc51338c", "name": "Insecure pattern 'subprocess_shell_true' in create_youtubemd.py:202", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in create_youtubemd.py:202"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-364fe4d447b1c6ca", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/jquery-3.7.0.min.js:2", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/jquery-3.7.0.min.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15fed47e392e453b", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/edit_post.js:466", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/edit_post.js:466"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afd41bf10b26e5e1", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/bootstrap.min.js:6", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/bootstrap.min.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3eae500bdcb9384", "name": "Insecure pattern 'domparser_html_parse' in static/bootstrap.min.js:6", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in static/bootstrap.min.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c4d9e64e287d0ac", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/svg_editor.js:1235", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/svg_editor.js:1235"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7eabb0b920700b3f", "name": "Very large file: pdf_to_papernote.py (1244 lines)", "shortDescription": {"text": "Very large file: pdf_to_papernote.py (1244 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57f0deda41a5c2e3", "name": "Very large file: main.py (4916 lines)", "shortDescription": {"text": "Very large file: main.py (4916 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dccb103eeb379f9a", "name": "Very large file: static/edit_post.js (2100 lines)", "shortDescription": {"text": "Very large file: static/edit_post.js (2100 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6e86ed3e29fbf10", "name": "Very large file: static/svg_editor.js (1523 lines)", "shortDescription": {"text": "Very large file: static/svg_editor.js (1523 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0000425f276996b", "name": "Very large file: static/diff_match_patch.js (2220 lines)", "shortDescription": {"text": "Very large file: static/diff_match_patch.js (2220 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 20 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 255 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4992e132565cab8c", "name": "Agent authority lacks a verifier contract: .claude/commands/paper-translate.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/paper-translate.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0dde34330206651", "name": "Agent authority lacks a verifier contract: .claude/skills/paper-translate/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/paper-translate/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41945c9c2e94a049", "name": "Agent authority lacks a verifier contract: .claude/skills/paper-question/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/paper-question/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5355f5cb32fb9af", "name": "Legacy-named symbol `cache_file_old` in main.py:260", "shortDescription": {"text": "Legacy-named symbol `cache_file_old` in main.py:260"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97f67a5e7b2ec326", "name": "Commented-code block (7 lines) in main.py:300", "shortDescription": {"text": "Commented-code block (7 lines) in main.py:300"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-41eef7f1c04d9dee", "name": "Network/subprocess call without timeout or try/except \u2014 main.py:2929", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 main.py:2929"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91e3179d5813944f", "name": "Network/subprocess call without timeout or try/except \u2014 create_youtubemd.py:202", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 create_youtubemd.py:202"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e5c830ea090204d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/edit_post.js:138", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/edit_post.js:138"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ed813c6cebd2eca", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/scripts.js:81", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/scripts.js:81"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed552cceebaf1c43", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/upload.js:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/upload.js:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e90eed935a9e9680", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/svg_editor.js:1122", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/svg_editor.js:1122"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmain.py:post_replace_image, main.py:post\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1124dbe4bd84878c", "name": "Flask mutation route `login` without `@login_required` \u2014 main.py:214", "shortDescription": {"text": "Flask mutation route `login` without `@login_required` \u2014 main.py:214"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-05c8bd8e17ce482c", "name": "Flask mutation route `edit_memo` without `@login_required` \u2014 main.py:973", "shortDescription": {"text": "Flask mutation route `edit_memo` without `@login_required` \u2014 main.py:973"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4424961034f28fb4", "name": "Flask mutation route `api_ui_postlist_graph_timeline` without `@login_required` \u2014 main.py:2285", "shortDescription": {"text": "Flask mutation route `api_ui_postlist_graph_timeline` without `@login_required` \u2014 main.py:2285"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0de3935eadfd06a5", "name": "Flask mutation route `api_ui_postlist_graph_achievements` without `@login_required` \u2014 main.py:2338", "shortDescription": {"text": "Flask mutation route `api_ui_postlist_graph_achievements` without `@login_required` \u2014 main.py:2338"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b4dcca6e5acfcab4", "name": "Flask mutation route `api_ui_postlist_graph_layout_post` without `@login_required` \u2014 main.py:2420", "shortDescription": {"text": "Flask mutation route `api_ui_postlist_graph_layout_post` without `@login_required` \u2014 main.py:2420"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caad784df87c5f15", "name": "Flask mutation route `api_create_post` without `@login_required` \u2014 main.py:3655", "shortDescription": {"text": "Flask mutation route `api_create_post` without `@login_required` \u2014 main.py:3655"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a78b8d8ef4345c9", "name": "Flask mutation route `api_update_post` without `@login_required` \u2014 main.py:3714", "shortDescription": {"text": "Flask mutation route `api_update_post` without `@login_required` \u2014 main.py:3714"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32054d424cfc35ff", "name": "Flask mutation route `api_add_comment` without `@login_required` \u2014 main.py:3781", "shortDescription": {"text": "Flask mutation route `api_add_comment` without `@login_required` \u2014 main.py:3781"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f7fa35086a50cb9", "name": "Flask mutation route `api_delete_post` without `@login_required` \u2014 main.py:3871", "shortDescription": {"text": "Flask mutation route `api_delete_post` without `@login_required` \u2014 main.py:3871"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e900c1a51488f47e", "name": "Flask mutation route `api_upload_paper` without `@login_required` \u2014 main.py:4413", "shortDescription": {"text": "Flask mutation route `api_upload_paper` without `@login_required` \u2014 main.py:4413"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f05129bce08168e9", "name": "Flask mutation route `api_upload_image` without `@login_required` \u2014 main.py:4744", "shortDescription": {"text": "Flask mutation route `api_upload_image` without `@login_required` \u2014 main.py:4744"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-852397fd57c1af51", "name": "Dangling fetch: GET /api/backups/${currentFilename} (static/edit_post.js:1772)", "shortDescription": {"text": "Dangling fetch: GET /api/backups/${currentFilename} (static/edit_post.js:1772)"}, "fullDescription": {"text": "`static/edit_post.js:1772` calls `GET /api/backups/${currentFilename}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/backups/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-10ddfe857c464ab3", "name": "Dangling fetch: GET /api/backup_content/${encodeURIComponent(backupFilename)} (static/edit_post.js:1874)", "shortDescription": {"text": "Dangling fetch: GET /api/backup_content/${encodeURIComponent(backupFilename)} (static/edit_post.js:1874)"}, "fullDescription": {"text": "`static/edit_post.js:1874` calls `GET /api/backup_content/${encodeURIComponent(backupFilename)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/backup_content/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4c7ad61ba1b23915", "name": "Unused endpoint: ANY /login", "shortDescription": {"text": "Unused endpoint: ANY /login"}, "fullDescription": {"text": "`main.py` declares `ANY /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e449c3b9e73b73", "name": "Unused endpoint: ANY /logout", "shortDescription": {"text": "Unused endpoint: ANY /logout"}, "fullDescription": {"text": "`main.py` declares `ANY /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efbb07121e18756b", "name": "Unused endpoint: ANY /protected", "shortDescription": {"text": "Unused endpoint: ANY /protected"}, "fullDescription": {"text": "`main.py` declares `ANY /protected` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`main.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2c1caba6ad95197", "name": "Unused endpoint: ANY /<filename>", "shortDescription": {"text": "Unused endpoint: ANY /<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0eee01931ed9a137", "name": "Unused endpoint: ANY /pdfsattach/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /pdfsattach/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /pdfsattach/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36664992182c1571", "name": "Unused endpoint: ANY /attach/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /attach/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /attach/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29747d0de7e51904", "name": "Unused endpoint: ANY /upload", "shortDescription": {"text": "Unused endpoint: ANY /upload"}, "fullDescription": {"text": "`main.py` declares `ANY /upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47425eba63950413", "name": "Unused endpoint: ANY /cleantextize", "shortDescription": {"text": "Unused endpoint: ANY /cleantextize"}, "fullDescription": {"text": "`main.py` declares `ANY /cleantextize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41baf084e3046e3e", "name": "Unused endpoint: ANY /pdfs/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /pdfs/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /pdfs/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a65c9409c1e43c18", "name": "Unused endpoint: ANY /tw/<path:filename>", "shortDescription": {"text": "Unused endpoint: ANY /tw/<path:filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /tw/<path:filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bc577b5ee7a18fa", "name": "Unused endpoint: ANY /edit_memo/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /edit_memo/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /edit_memo/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-661067a5801a122e", "name": "Unused endpoint: ANY /memo/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /memo/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /memo/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b23fa5c5cd240ff6", "name": "Unused endpoint: ANY /delete", "shortDescription": {"text": "Unused endpoint: ANY /delete"}, "fullDescription": {"text": "`main.py` declares `ANY /delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9462032f773004ad", "name": "Unused endpoint: ANY /clean_text/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /clean_text/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /clean_text/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2aa01200ae99a44", "name": "Unused endpoint: ANY /move_to_top/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /move_to_top/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /move_to_top/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6294dae9f391e60d", "name": "Unused endpoint: ANY /post/<filename>/download", "shortDescription": {"text": "Unused endpoint: ANY /post/<filename>/download"}, "fullDescription": {"text": "`main.py` declares `ANY /post/<filename>/download` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55a5cc02c86567de", "name": "Unused endpoint: ANY /post/<filename>/download_pdf", "shortDescription": {"text": "Unused endpoint: ANY /post/<filename>/download_pdf"}, "fullDescription": {"text": "`main.py` declares `ANY /post/<filename>/download_pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5756dfacb9ea5a9", "name": "Unused endpoint: ANY /post/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /post/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /post/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d19a45e1a82ac2ae", "name": "Unused endpoint: ANY /postmd/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /postmd/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /postmd/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4e2270117e3f3d1", "name": "Unused endpoint: ANY /api/ui/postsections/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /api/ui/postsections/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /api/ui/postsections/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf9093a3337b52aa", "name": "Unused endpoint: ANY /edit_post/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /edit_post/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /edit_post/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33b32c57c3c23892", "name": "Unused endpoint: ANY /upload_text", "shortDescription": {"text": "Unused endpoint: ANY /upload_text"}, "fullDescription": {"text": "`main.py` declares `ANY /upload_text` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebafcf295347fbf1", "name": "Unused endpoint: ANY /postdata/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /postdata/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /postdata/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20e86c972290208e", "name": "Unused endpoint: ANY /api/ui/postlist/preview/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /api/ui/postlist/preview/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /api/ui/postlist/preview/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c33c8bb6b0689fb9", "name": "Unused endpoint: ANY /api/ui/postlist/graph", "shortDescription": {"text": "Unused endpoint: ANY /api/ui/postlist/graph"}, "fullDescription": {"text": "`main.py` declares `ANY /api/ui/postlist/graph` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b9f93b07c7a76d5", "name": "Unused endpoint: ANY /api/ui/postlist/graph/timeline", "shortDescription": {"text": "Unused endpoint: ANY /api/ui/postlist/graph/timeline"}, "fullDescription": {"text": "`main.py` declares `ANY /api/ui/postlist/graph/timeline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42d12893ee1a94d9", "name": "Unused endpoint: ANY /api/ui/postlist/graph/achievements", "shortDescription": {"text": "Unused endpoint: ANY /api/ui/postlist/graph/achievements"}, "fullDescription": {"text": "`main.py` declares `ANY /api/ui/postlist/graph/achievements` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d58f14fafb749c8c", "name": "Unused endpoint: ANY /api/ui/postlist/graph/layout", "shortDescription": {"text": "Unused endpoint: ANY /api/ui/postlist/graph/layout"}, "fullDescription": {"text": "`main.py` declares `ANY /api/ui/postlist/graph/layout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd5898854c75fb9b", "name": "Unused endpoint: ANY /rename_post", "shortDescription": {"text": "Unused endpoint: ANY /rename_post"}, "fullDescription": {"text": "`main.py` declares `ANY /rename_post` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d61bc10d24e3ff5d", "name": "Unused endpoint: ANY /add_post", "shortDescription": {"text": "Unused endpoint: ANY /add_post"}, "fullDescription": {"text": "`main.py` declares `ANY /add_post` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-398808dffadcab6f", "name": "Unused endpoint: ANY /archive_post", "shortDescription": {"text": "Unused endpoint: ANY /archive_post"}, "fullDescription": {"text": "`main.py` declares `ANY /archive_post` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4dd860059032048a", "name": "Unused endpoint: ANY /duplicate_post", "shortDescription": {"text": "Unused endpoint: ANY /duplicate_post"}, "fullDescription": {"text": "`main.py` declares `ANY /duplicate_post` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e1157f5b8ab61e3", "name": "Unused endpoint: ANY /get_categories", "shortDescription": {"text": "Unused endpoint: ANY /get_categories"}, "fullDescription": {"text": "`main.py` declares `ANY /get_categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82fa30c8cb0e8e90", "name": "Unused endpoint: ANY /change_category", "shortDescription": {"text": "Unused endpoint: ANY /change_category"}, "fullDescription": {"text": "`main.py` declares `ANY /change_category` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57e1b50f6d1c66d6", "name": "Unused endpoint: ANY /add_comment", "shortDescription": {"text": "Unused endpoint: ANY /add_comment"}, "fullDescription": {"text": "`main.py` declares `ANY /add_comment` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-776e07dabc548fab", "name": "Unused endpoint: ANY /summary/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /summary/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /summary/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7767db48bef5dc86", "name": "Unused endpoint: ANY /edit_summary/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /edit_summary/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /edit_summary/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df458d34e30d79f5", "name": "Unused endpoint: ANY /summary2/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /summary2/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /summary2/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00a4d0ce26a8b323", "name": "Unused endpoint: ANY /edit_summary2/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /edit_summary2/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /edit_summary2/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c8d1c9755c7c466", "name": "Unused endpoint: ANY /youtube", "shortDescription": {"text": "Unused endpoint: ANY /youtube"}, "fullDescription": {"text": "`main.py` declares `ANY /youtube` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b0514584c5241dd", "name": "Unused endpoint: ANY /upload_movie", "shortDescription": {"text": "Unused endpoint: ANY /upload_movie"}, "fullDescription": {"text": "`main.py` declares `ANY /upload_movie` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8e0410f7a1f0418", "name": "Unused endpoint: ANY /ytdl", "shortDescription": {"text": "Unused endpoint: ANY /ytdl"}, "fullDescription": {"text": "`main.py` declares `ANY /ytdl` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae97406071b77e83", "name": "Unused endpoint: ANY /webtomd", "shortDescription": {"text": "Unused endpoint: ANY /webtomd"}, "fullDescription": {"text": "`main.py` declares `ANY /webtomd` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d708f6676b91f34", "name": "Unused endpoint: ANY /postlist", "shortDescription": {"text": "Unused endpoint: ANY /postlist"}, "fullDescription": {"text": "`main.py` declares `ANY /postlist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb905eb6ce615d62", "name": "Unused endpoint: ANY /api/backups/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /api/backups/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /api/backups/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95e28704bcd95eaa", "name": "Unused endpoint: ANY /api/backup_content/<path:backup_filename>", "shortDescription": {"text": "Unused endpoint: ANY /api/backup_content/<path:backup_filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /api/backup_content/<path:backup_filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1b1aabca9cb2ca3", "name": "Unused endpoint: ANY /api/posts/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /api/posts/<filename>"}, "fullDescription": {"text": "`main.py` declares `ANY /api/posts/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-200c67c9f85396e7", "name": "Unused endpoint: ANY /api/posts/<filename>/sections", "shortDescription": {"text": "Unused endpoint: ANY /api/posts/<filename>/sections"}, "fullDescription": {"text": "`main.py` declares `ANY /api/posts/<filename>/sections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecbb65b841758cda", "name": "Unused endpoint: ANY /api/posts/<filename>/sections/titles", "shortDescription": {"text": "Unused endpoint: ANY /api/posts/<filename>/sections/titles"}, "fullDescription": {"text": "`main.py` declares `ANY /api/posts/<filename>/sections/titles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25189"}, "properties": {"repository": "daishir0/Papernote", "repoUrl": "https://github.com/daishir0/Papernote", "branch": "main"}, "results": [{"ruleId": "scanner-b1d7532ca8f725bb", "level": "note", "message": {"text": "Possibly dead Python function: extract_paper_title"}, "properties": {"repobilityId": "1dd4596f2dd8c890", "scanner": "scanner-primary", "fingerprint": "b1d7532ca8f725bb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf_to_papernote.py:309"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e731c8fa36510ed4", "level": "note", "message": {"text": "Possibly dead Python function: extract_paper_title_openai"}, "properties": {"repobilityId": "df561a754a977064", "scanner": "scanner-primary", "fingerprint": "e731c8fa36510ed4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pdf_to_papernote.py:411"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7ce0470d0ee5fde", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "b7ce0470d0ee5fde", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:1271"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eed7c56fb1f786f7", "level": "note", "message": {"text": "Possibly dead Python function: process_single_pdf"}, "properties": {"repobilityId": "a2926172dd675e99", "scanner": "scanner-primary", "fingerprint": "eed7c56fb1f786f7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:4397"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d6d71909a96a64a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/edit_post.js:1163"}, "properties": {"repobilityId": "994db5b61c5c1169", "scanner": "scanner-primary", "fingerprint": "7d6d71909a96a64a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d52f83707f1c1412", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/fabric.min.js:1"}, "properties": {"repobilityId": "b6e5b593df77427e", "scanner": "scanner-primary", "fingerprint": "d52f83707f1c1412", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-06b7b3b456d87d38", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/scripts.js:103"}, "properties": {"repobilityId": "94f3aef621322e04", "scanner": "scanner-primary", "fingerprint": "06b7b3b456d87d38", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5fcd79a8d80fafed", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/cytoscape.min.js:23"}, "properties": {"repobilityId": "fbce65e7ee0ef747", "scanner": "scanner-primary", "fingerprint": "5fcd79a8d80fafed", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-013ccfae90583060", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in main.py:2929"}, "properties": {"repobilityId": "50bc7cbb40080d41", "scanner": "scanner-primary", "fingerprint": "013ccfae90583060", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2929}}}]}, {"ruleId": "scanner-17898bf7bc51338c", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in create_youtubemd.py:202"}, "properties": {"repobilityId": "4636ab170664bf26", "scanner": "scanner-primary", "fingerprint": "17898bf7bc51338c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "create_youtubemd.py"}, "region": {"startLine": 202}}}]}, {"ruleId": "scanner-364fe4d447b1c6ca", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/jquery-3.7.0.min.js:2"}, "properties": {"repobilityId": "726c4ea33a56e9b4", "scanner": "scanner-primary", "fingerprint": "364fe4d447b1c6ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/jquery-3.7.0.min.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-15fed47e392e453b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/edit_post.js:466"}, "properties": {"repobilityId": "bcb7f6a4560f686c", "scanner": "scanner-primary", "fingerprint": "15fed47e392e453b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/edit_post.js"}, "region": {"startLine": 466}}}]}, {"ruleId": "scanner-afd41bf10b26e5e1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/bootstrap.min.js:6"}, "properties": {"repobilityId": "d30924690b7fd032", "scanner": "scanner-primary", "fingerprint": "afd41bf10b26e5e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/bootstrap.min.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-a3eae500bdcb9384", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in static/bootstrap.min.js:6"}, "properties": {"repobilityId": "dd8a54d2a5699323", "scanner": "scanner-primary", "fingerprint": "a3eae500bdcb9384", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/bootstrap.min.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-3c4d9e64e287d0ac", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/svg_editor.js:1235"}, "properties": {"repobilityId": "3b732d8f7cc53a39", "scanner": "scanner-primary", "fingerprint": "3c4d9e64e287d0ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/svg_editor.js"}, "region": {"startLine": 1235}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7eabb0b920700b3f", "level": "note", "message": {"text": "Very large file: pdf_to_papernote.py (1244 lines)"}, "properties": {"repobilityId": "4a4932c87fb6ea04", "scanner": "scanner-primary", "fingerprint": "7eabb0b920700b3f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57f0deda41a5c2e3", "level": "note", "message": {"text": "Very large file: main.py (4916 lines)"}, "properties": {"repobilityId": "d28330f452f23706", "scanner": "scanner-primary", "fingerprint": "57f0deda41a5c2e3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dccb103eeb379f9a", "level": "note", "message": {"text": "Very large file: static/edit_post.js (2100 lines)"}, "properties": {"repobilityId": "573f06d2bc0cb8c6", "scanner": "scanner-primary", "fingerprint": "dccb103eeb379f9a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f6e86ed3e29fbf10", "level": "note", "message": {"text": "Very large file: static/svg_editor.js (1523 lines)"}, "properties": {"repobilityId": "d03bcead2f3fbb27", "scanner": "scanner-primary", "fingerprint": "f6e86ed3e29fbf10", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f0000425f276996b", "level": "note", "message": {"text": "Very large file: static/diff_match_patch.js (2220 lines)"}, "properties": {"repobilityId": "8474ba7ab28eb87c", "scanner": "scanner-primary", "fingerprint": "f0000425f276996b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "40adbf701f370313", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "f57b2333c1d19c8e", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bf844ff816495c74", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-4992e132565cab8c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/paper-translate.md"}, "properties": {"repobilityId": "7584fc1b14b295a8", "scanner": "scanner-primary", "fingerprint": "4992e132565cab8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/paper-translate.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0dde34330206651", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/paper-translate/SKILL.md"}, "properties": {"repobilityId": "7043eba00ad35fc0", "scanner": "scanner-primary", "fingerprint": "e0dde34330206651", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/paper-translate/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41945c9c2e94a049", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/paper-question/SKILL.md"}, "properties": {"repobilityId": "87b2876516053e52", "scanner": "scanner-primary", "fingerprint": "41945c9c2e94a049", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/paper-question/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5355f5cb32fb9af", "level": "note", "message": {"text": "Legacy-named symbol `cache_file_old` in main.py:260"}, "properties": {"repobilityId": "863ef70f54298ae4", "scanner": "scanner-primary", "fingerprint": "f5355f5cb32fb9af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-97f67a5e7b2ec326", "level": "none", "message": {"text": "Commented-code block (7 lines) in main.py:300"}, "properties": {"repobilityId": "d8d5c030df681d71", "scanner": "scanner-primary", "fingerprint": "97f67a5e7b2ec326", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-41eef7f1c04d9dee", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 main.py:2929"}, "properties": {"repobilityId": "7a50c54c02700028", "scanner": "scanner-primary", "fingerprint": "41eef7f1c04d9dee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-91e3179d5813944f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 create_youtubemd.py:202"}, "properties": {"repobilityId": "1697c6b00f7ff7e1", "scanner": "scanner-primary", "fingerprint": "91e3179d5813944f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2e5c830ea090204d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/edit_post.js:138"}, "properties": {"repobilityId": "16eed49b5bd3ea2e", "scanner": "scanner-primary", "fingerprint": "2e5c830ea090204d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3ed813c6cebd2eca", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/scripts.js:81"}, "properties": {"repobilityId": "347e1ed6629521b8", "scanner": "scanner-primary", "fingerprint": "3ed813c6cebd2eca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ed552cceebaf1c43", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/upload.js:17"}, "properties": {"repobilityId": "7a6d8e1422ab5765", "scanner": "scanner-primary", "fingerprint": "ed552cceebaf1c43", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e90eed935a9e9680", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/svg_editor.js:1122"}, "properties": {"repobilityId": "9960cd05960c2847", "scanner": "scanner-primary", "fingerprint": "e90eed935a9e9680", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "18de9e6792138699", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "884335c0639ec166", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-1124dbe4bd84878c", "level": "error", "message": {"text": "Flask mutation route `login` without `@login_required` \u2014 main.py:214"}, "properties": {"repobilityId": "a150d8fcdb619b95", "scanner": "scanner-primary", "fingerprint": "1124dbe4bd84878c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-05c8bd8e17ce482c", "level": "error", "message": {"text": "Flask mutation route `edit_memo` without `@login_required` \u2014 main.py:973"}, "properties": {"repobilityId": "f142fc8f591e5a84", "scanner": "scanner-primary", "fingerprint": "05c8bd8e17ce482c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 973}}}]}, {"ruleId": "scanner-4424961034f28fb4", "level": "error", "message": {"text": "Flask mutation route `api_ui_postlist_graph_timeline` without `@login_required` \u2014 main.py:2285"}, "properties": {"repobilityId": "1e3eb71a3f3a3c2f", "scanner": "scanner-primary", "fingerprint": "4424961034f28fb4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2285}}}]}, {"ruleId": "scanner-0de3935eadfd06a5", "level": "error", "message": {"text": "Flask mutation route `api_ui_postlist_graph_achievements` without `@login_required` \u2014 main.py:2338"}, "properties": {"repobilityId": "1b407d1929d69a50", "scanner": "scanner-primary", "fingerprint": "0de3935eadfd06a5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2338}}}]}, {"ruleId": "scanner-b4dcca6e5acfcab4", "level": "error", "message": {"text": "Flask mutation route `api_ui_postlist_graph_layout_post` without `@login_required` \u2014 main.py:2420"}, "properties": {"repobilityId": "0a5d48767d4b58fd", "scanner": "scanner-primary", "fingerprint": "b4dcca6e5acfcab4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2420}}}]}, {"ruleId": "scanner-caad784df87c5f15", "level": "error", "message": {"text": "Flask mutation route `api_create_post` without `@login_required` \u2014 main.py:3655"}, "properties": {"repobilityId": "0a5c11ae965aeda8", "scanner": "scanner-primary", "fingerprint": "caad784df87c5f15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3655}}}]}, {"ruleId": "scanner-6a78b8d8ef4345c9", "level": "error", "message": {"text": "Flask mutation route `api_update_post` without `@login_required` \u2014 main.py:3714"}, "properties": {"repobilityId": "882406565f1d0d18", "scanner": "scanner-primary", "fingerprint": "6a78b8d8ef4345c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3714}}}]}, {"ruleId": "scanner-32054d424cfc35ff", "level": "error", "message": {"text": "Flask mutation route `api_add_comment` without `@login_required` \u2014 main.py:3781"}, "properties": {"repobilityId": "b7415fb004979e47", "scanner": "scanner-primary", "fingerprint": "32054d424cfc35ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3781}}}]}, {"ruleId": "scanner-6f7fa35086a50cb9", "level": "error", "message": {"text": "Flask mutation route `api_delete_post` without `@login_required` \u2014 main.py:3871"}, "properties": {"repobilityId": "ad54969ccca84bfd", "scanner": "scanner-primary", "fingerprint": "6f7fa35086a50cb9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3871}}}]}, {"ruleId": "scanner-e900c1a51488f47e", "level": "error", "message": {"text": "Flask mutation route `api_upload_paper` without `@login_required` \u2014 main.py:4413"}, "properties": {"repobilityId": "eaedda9ca0d3908e", "scanner": "scanner-primary", "fingerprint": "e900c1a51488f47e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 4413}}}]}, {"ruleId": "scanner-f05129bce08168e9", "level": "error", "message": {"text": "Flask mutation route `api_upload_image` without `@login_required` \u2014 main.py:4744"}, "properties": {"repobilityId": "d610d4eabd8b3b86", "scanner": "scanner-primary", "fingerprint": "f05129bce08168e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 4744}}}]}, {"ruleId": "scanner-852397fd57c1af51", "level": "error", "message": {"text": "Dangling fetch: GET /api/backups/${currentFilename} (static/edit_post.js:1772)"}, "properties": {"repobilityId": "09b35efbde51fdd2", "scanner": "scanner-primary", "fingerprint": "852397fd57c1af51", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-10ddfe857c464ab3", "level": "error", "message": {"text": "Dangling fetch: GET /api/backup_content/${encodeURIComponent(backupFilename)} (static/edit_post.js:1874)"}, "properties": {"repobilityId": "4c51c7eb4126ce54", "scanner": "scanner-primary", "fingerprint": "10ddfe857c464ab3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4c7ad61ba1b23915", "level": "note", "message": {"text": "Unused endpoint: ANY /login"}, "properties": {"repobilityId": "31bb19aebb305b6b", "scanner": "scanner-primary", "fingerprint": "4c7ad61ba1b23915", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c9e449c3b9e73b73", "level": "note", "message": {"text": "Unused endpoint: ANY /logout"}, "properties": {"repobilityId": "e009eb7135bbfef9", "scanner": "scanner-primary", "fingerprint": "c9e449c3b9e73b73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-efbb07121e18756b", "level": "note", "message": {"text": "Unused endpoint: ANY /protected"}, "properties": {"repobilityId": "8d3f0d327999f56b", "scanner": "scanner-primary", "fingerprint": "efbb07121e18756b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "8500fba178ce04a7", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c2c1caba6ad95197", "level": "note", "message": {"text": "Unused endpoint: ANY /<filename>"}, "properties": {"repobilityId": "0f867b8fe8413cda", "scanner": "scanner-primary", "fingerprint": "c2c1caba6ad95197", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0eee01931ed9a137", "level": "note", "message": {"text": "Unused endpoint: ANY /pdfsattach/<filename>"}, "properties": {"repobilityId": "6364343c9fdd9f35", "scanner": "scanner-primary", "fingerprint": "0eee01931ed9a137", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-36664992182c1571", "level": "note", "message": {"text": "Unused endpoint: ANY /attach/<filename>"}, "properties": {"repobilityId": "c1170fa98fe0e359", "scanner": "scanner-primary", "fingerprint": "36664992182c1571", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-29747d0de7e51904", "level": "note", "message": {"text": "Unused endpoint: ANY /upload"}, "properties": {"repobilityId": "9dd79e60c32c8fd7", "scanner": "scanner-primary", "fingerprint": "29747d0de7e51904", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47425eba63950413", "level": "note", "message": {"text": "Unused endpoint: ANY /cleantextize"}, "properties": {"repobilityId": "cd7694fb71bea6a8", "scanner": "scanner-primary", "fingerprint": "47425eba63950413", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41baf084e3046e3e", "level": "note", "message": {"text": "Unused endpoint: ANY /pdfs/<filename>"}, "properties": {"repobilityId": "2276b7c34726a103", "scanner": "scanner-primary", "fingerprint": "41baf084e3046e3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a65c9409c1e43c18", "level": "note", "message": {"text": "Unused endpoint: ANY /tw/<path:filename>"}, "properties": {"repobilityId": "8a5c6affdc42d122", "scanner": "scanner-primary", "fingerprint": "a65c9409c1e43c18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1bc577b5ee7a18fa", "level": "note", "message": {"text": "Unused endpoint: ANY /edit_memo/<filename>"}, "properties": {"repobilityId": "45c74329902d8737", "scanner": "scanner-primary", "fingerprint": "1bc577b5ee7a18fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-661067a5801a122e", "level": "note", "message": {"text": "Unused endpoint: ANY /memo/<filename>"}, "properties": {"repobilityId": "b8859ce85cd7fedf", "scanner": "scanner-primary", "fingerprint": "661067a5801a122e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b23fa5c5cd240ff6", "level": "note", "message": {"text": "Unused endpoint: ANY /delete"}, "properties": {"repobilityId": "ab49526591d4bba5", "scanner": "scanner-primary", "fingerprint": "b23fa5c5cd240ff6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9462032f773004ad", "level": "note", "message": {"text": "Unused endpoint: ANY /clean_text/<filename>"}, "properties": {"repobilityId": "69a82f5cb02ccba5", "scanner": "scanner-primary", "fingerprint": "9462032f773004ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2aa01200ae99a44", "level": "note", "message": {"text": "Unused endpoint: ANY /move_to_top/<filename>"}, "properties": {"repobilityId": "08518cf8d0b0bace", "scanner": "scanner-primary", "fingerprint": "e2aa01200ae99a44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6294dae9f391e60d", "level": "note", "message": {"text": "Unused endpoint: ANY /post/<filename>/download"}, "properties": {"repobilityId": "79885885a6ee8b4b", "scanner": "scanner-primary", "fingerprint": "6294dae9f391e60d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55a5cc02c86567de", "level": "note", "message": {"text": "Unused endpoint: ANY /post/<filename>/download_pdf"}, "properties": {"repobilityId": "d3e90e6d2ea5e599", "scanner": "scanner-primary", "fingerprint": "55a5cc02c86567de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5756dfacb9ea5a9", "level": "note", "message": {"text": "Unused endpoint: ANY /post/<filename>"}, "properties": {"repobilityId": "1a609d12fd262948", "scanner": "scanner-primary", "fingerprint": "b5756dfacb9ea5a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d19a45e1a82ac2ae", "level": "note", "message": {"text": "Unused endpoint: ANY /postmd/<filename>"}, "properties": {"repobilityId": "21ec63048cddf937", "scanner": "scanner-primary", "fingerprint": "d19a45e1a82ac2ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d4e2270117e3f3d1", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ui/postsections/<filename>"}, "properties": {"repobilityId": "d2b300be0c01c848", "scanner": "scanner-primary", "fingerprint": "d4e2270117e3f3d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf9093a3337b52aa", "level": "note", "message": {"text": "Unused endpoint: ANY /edit_post/<filename>"}, "properties": {"repobilityId": "c184426640e078c3", "scanner": "scanner-primary", "fingerprint": "cf9093a3337b52aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-33b32c57c3c23892", "level": "note", "message": {"text": "Unused endpoint: ANY /upload_text"}, "properties": {"repobilityId": "a7dcd2146807a6ac", "scanner": "scanner-primary", "fingerprint": "33b32c57c3c23892", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ebafcf295347fbf1", "level": "note", "message": {"text": "Unused endpoint: ANY /postdata/<filename>"}, "properties": {"repobilityId": "9be49e262c4b044d", "scanner": "scanner-primary", "fingerprint": "ebafcf295347fbf1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-20e86c972290208e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ui/postlist/preview/<filename>"}, "properties": {"repobilityId": "d7fd882ca07c84dc", "scanner": "scanner-primary", "fingerprint": "20e86c972290208e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c33c8bb6b0689fb9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ui/postlist/graph"}, "properties": {"repobilityId": "1b6adbfd852eba6c", "scanner": "scanner-primary", "fingerprint": "c33c8bb6b0689fb9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b9f93b07c7a76d5", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ui/postlist/graph/timeline"}, "properties": {"repobilityId": "1d0bd8a4dfba41b6", "scanner": "scanner-primary", "fingerprint": "5b9f93b07c7a76d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-42d12893ee1a94d9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ui/postlist/graph/achievements"}, "properties": {"repobilityId": "9ef08dd083f2f13d", "scanner": "scanner-primary", "fingerprint": "42d12893ee1a94d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d58f14fafb749c8c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ui/postlist/graph/layout"}, "properties": {"repobilityId": "cc12e5b4afa4d643", "scanner": "scanner-primary", "fingerprint": "d58f14fafb749c8c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd5898854c75fb9b", "level": "note", "message": {"text": "Unused endpoint: ANY /rename_post"}, "properties": {"repobilityId": "9a278196e76b70ec", "scanner": "scanner-primary", "fingerprint": "fd5898854c75fb9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d61bc10d24e3ff5d", "level": "note", "message": {"text": "Unused endpoint: ANY /add_post"}, "properties": {"repobilityId": "14fd395f759820be", "scanner": "scanner-primary", "fingerprint": "d61bc10d24e3ff5d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-398808dffadcab6f", "level": "note", "message": {"text": "Unused endpoint: ANY /archive_post"}, "properties": {"repobilityId": "200d78d81650ec61", "scanner": "scanner-primary", "fingerprint": "398808dffadcab6f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4dd860059032048a", "level": "note", "message": {"text": "Unused endpoint: ANY /duplicate_post"}, "properties": {"repobilityId": "0824f2913526280b", "scanner": "scanner-primary", "fingerprint": "4dd860059032048a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e1157f5b8ab61e3", "level": "note", "message": {"text": "Unused endpoint: ANY /get_categories"}, "properties": {"repobilityId": "921caea2c17ac12a", "scanner": "scanner-primary", "fingerprint": "3e1157f5b8ab61e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-82fa30c8cb0e8e90", "level": "note", "message": {"text": "Unused endpoint: ANY /change_category"}, "properties": {"repobilityId": "e8a48089405b4203", "scanner": "scanner-primary", "fingerprint": "82fa30c8cb0e8e90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-57e1b50f6d1c66d6", "level": "note", "message": {"text": "Unused endpoint: ANY /add_comment"}, "properties": {"repobilityId": "d6f9b828b1d332dc", "scanner": "scanner-primary", "fingerprint": "57e1b50f6d1c66d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-776e07dabc548fab", "level": "note", "message": {"text": "Unused endpoint: ANY /summary/<filename>"}, "properties": {"repobilityId": "1ceb5d1420340f9b", "scanner": "scanner-primary", "fingerprint": "776e07dabc548fab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7767db48bef5dc86", "level": "note", "message": {"text": "Unused endpoint: ANY /edit_summary/<filename>"}, "properties": {"repobilityId": "60ba40dc5aface8e", "scanner": "scanner-primary", "fingerprint": "7767db48bef5dc86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-df458d34e30d79f5", "level": "note", "message": {"text": "Unused endpoint: ANY /summary2/<filename>"}, "properties": {"repobilityId": "01464843b55a9014", "scanner": "scanner-primary", "fingerprint": "df458d34e30d79f5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00a4d0ce26a8b323", "level": "note", "message": {"text": "Unused endpoint: ANY /edit_summary2/<filename>"}, "properties": {"repobilityId": "c70890ec3b8b68f3", "scanner": "scanner-primary", "fingerprint": "00a4d0ce26a8b323", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c8d1c9755c7c466", "level": "note", "message": {"text": "Unused endpoint: ANY /youtube"}, "properties": {"repobilityId": "0f5de8d6059d93b2", "scanner": "scanner-primary", "fingerprint": "9c8d1c9755c7c466", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b0514584c5241dd", "level": "note", "message": {"text": "Unused endpoint: ANY /upload_movie"}, "properties": {"repobilityId": "36169df7c5478493", "scanner": "scanner-primary", "fingerprint": "3b0514584c5241dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8e0410f7a1f0418", "level": "note", "message": {"text": "Unused endpoint: ANY /ytdl"}, "properties": {"repobilityId": "3058b58d78a34a3f", "scanner": "scanner-primary", "fingerprint": "e8e0410f7a1f0418", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ae97406071b77e83", "level": "note", "message": {"text": "Unused endpoint: ANY /webtomd"}, "properties": {"repobilityId": "35be947d877da988", "scanner": "scanner-primary", "fingerprint": "ae97406071b77e83", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d708f6676b91f34", "level": "note", "message": {"text": "Unused endpoint: ANY /postlist"}, "properties": {"repobilityId": "8044ecffcc79a752", "scanner": "scanner-primary", "fingerprint": "6d708f6676b91f34", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb905eb6ce615d62", "level": "note", "message": {"text": "Unused endpoint: ANY /api/backups/<filename>"}, "properties": {"repobilityId": "4c006e16a634078f", "scanner": "scanner-primary", "fingerprint": "cb905eb6ce615d62", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-95e28704bcd95eaa", "level": "note", "message": {"text": "Unused endpoint: ANY /api/backup_content/<path:backup_filename>"}, "properties": {"repobilityId": "191f471cd9544ec2", "scanner": "scanner-primary", "fingerprint": "95e28704bcd95eaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1b1aabca9cb2ca3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/posts/<filename>"}, "properties": {"repobilityId": "0e02bc13465c0267", "scanner": "scanner-primary", "fingerprint": "c1b1aabca9cb2ca3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-200c67c9f85396e7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/posts/<filename>/sections"}, "properties": {"repobilityId": "66db763f16ccf824", "scanner": "scanner-primary", "fingerprint": "200c67c9f85396e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ecbb65b841758cda", "level": "note", "message": {"text": "Unused endpoint: ANY /api/posts/<filename>/sections/titles"}, "properties": {"repobilityId": "3ef08c842878ba33", "scanner": "scanner-primary", "fingerprint": "ecbb65b841758cda", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}