{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c1c062ea4367ffc7", "name": "Possibly dead Python function: require_user", "shortDescription": {"text": "Possibly dead Python function: require_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c15ed2ab694782c7", "name": "Possibly dead Python function: tenant_scope", "shortDescription": {"text": "Possibly dead Python function: tenant_scope"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3771176ff24275a", "name": "Possibly dead Python function: format", "shortDescription": {"text": "Possibly dead Python function: format"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53e694b89a8682c", "name": "Possibly dead Python function: call", "shortDescription": {"text": "Possibly dead Python function: call"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-571ec797e07db027", "name": "Possibly dead Python function: screenshot", "shortDescription": {"text": "Possibly dead Python function: screenshot"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3cac6777dcd3413e", "name": "Possibly dead Python function: is_allowed", "shortDescription": {"text": "Possibly dead Python function: is_allowed"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9eacd9de39d2a228", "name": "Icon-only button without accessible name \u2014 frontend/components/panels/InspectorPanel.tsx:123", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/components/panels/InspectorPanel.tsx:123"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab7fe63260d79fe", "name": "Icon-only button without accessible name \u2014 frontend/components/overlays/Overlays.tsx:159", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/components/overlays/Overlays.tsx:159"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a06c007eee154274", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/overlays/Overlays.tsx:43", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/overlays/Overlays.tsx:43"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5122a967095a602f", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/hud/Hud.tsx:38", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/hud/Hud.tsx:38"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a8d28e3d9672303", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/page.tsx:32", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/page.tsx:32"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74cb385dc1c0582a", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/blog/[slug]/page.tsx:40", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/blog/[slug]/page.tsx:40"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-428d2f8b84ecfa7b", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/app/page.tsx:32", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/app/page.tsx:32"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf8faa0d492ea279", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/app/blog/[slug]/page.tsx:40", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/app/blog/[slug]/page.tsx:40"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f4b8ca98aec2c8e", "name": "Insecure pattern 'new_function_used' in claude-design-handoff/product/support.js:677", "shortDescription": {"text": "Insecure pattern 'new_function_used' in claude-design-handoff/product/support.js:677"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b545e91a403586e", "name": "Insecure pattern 'direct_innerhtml_assignment' in claude-design-handoff/product/support.js:422", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in claude-design-handoff/product/support.js:422"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee020178f5426747", "name": "Insecure pattern 'domparser_html_parse' in claude-design-handoff/product/support.js:44", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in claude-design-handoff/product/support.js:44"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c22ee67a4d50e69d", "name": "Insecure pattern 'new_function_used' in claude-design-handoff/marketing/support.js:677", "shortDescription": {"text": "Insecure pattern 'new_function_used' in claude-design-handoff/marketing/support.js:677"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83fa922fd72b3dcf", "name": "Insecure pattern 'direct_innerhtml_assignment' in claude-design-handoff/marketing/support.js:422", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in claude-design-handoff/marketing/support.js:422"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc4e1adddfd6931e", "name": "Insecure pattern 'domparser_html_parse' in claude-design-handoff/marketing/support.js:44", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in claude-design-handoff/marketing/support.js:44"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdc1fb40bc471e1b", "name": "Insecure pattern 'subprocess_shell_true' in backend/app/services/sandbox.py:102", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in backend/app/services/sandbox.py:102"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fde5705d9ea36fe5", "name": "Very large file: claude-design-handoff/product/support.js (1466 lines)", "shortDescription": {"text": "Very large file: claude-design-handoff/product/support.js (1466 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebd3c4d95fa7f091", "name": "Very large file: claude-design-handoff/marketing/support.js (1466 lines)", "shortDescription": {"text": "Very large file: claude-design-handoff/marketing/support.js (1466 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "21 tests / 90 src (ratio 0.23)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 40 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b7523f8587d8fb3", "name": "Agent authority lacks a verifier contract: .claude/commands/init.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/init.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53ce696c83aabd74", "name": "Agent authority lacks a verifier contract: .claude/commands/status.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/status.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb750e269fa4542d", "name": "Agent authority lacks a verifier contract: .claude/agents/product_manager.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/product_manager.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0919c19e893e0f1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.ts:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.ts:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-975c7503e503fdda", "name": "`fetch()` without try/.catch or AbortSignal \u2014 claude-design-handoff/product/support.js:968", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 claude-design-handoff/product/support.js:968"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9712a6689d230ddb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 claude-design-handoff/marketing/support.js:968", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 claude-design-handoff/marketing/support.js:968"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `NEXT_PUBLIC_API_URL`, `NEXT_PUBLIC_E2E`, `NEXT_PUBLIC_SITE_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/services/filestore.py:put_text, backend/app/services/filestore.py:put_text\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/services/sandbox.py:create, backend/app/services/sandbox.py:create, backend/app/services/sandbox.py:create\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a359d1138c8552cd", "name": "FastAPI PATCH `rename_project` without auth dependency \u2014 backend/app/routers/projects.py:225", "shortDescription": {"text": "FastAPI PATCH `rename_project` without auth dependency \u2014 backend/app/routers/projects.py:225"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e52587029ee2c96", "name": "FastAPI DELETE `delete_project` without auth dependency \u2014 backend/app/routers/projects.py:239", "shortDescription": {"text": "FastAPI DELETE `delete_project` without auth dependency \u2014 backend/app/routers/projects.py:239"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a4eada27454ffa38", "name": "FastAPI POST `pause_project` without auth dependency \u2014 backend/app/routers/projects.py:254", "shortDescription": {"text": "FastAPI POST `pause_project` without auth dependency \u2014 backend/app/routers/projects.py:254"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1887c71585c4ba20", "name": "FastAPI POST `resume_project` without auth dependency \u2014 backend/app/routers/projects.py:267", "shortDescription": {"text": "FastAPI POST `resume_project` without auth dependency \u2014 backend/app/routers/projects.py:267"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8db01722a56fe1d3", "name": "FastAPI POST `add_team` without auth dependency \u2014 backend/app/routers/teams.py:68", "shortDescription": {"text": "FastAPI POST `add_team` without auth dependency \u2014 backend/app/routers/teams.py:68"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f29c43f2bb0f26e", "name": "FastAPI PATCH `update_team` without auth dependency \u2014 backend/app/routers/teams.py:114", "shortDescription": {"text": "FastAPI PATCH `update_team` without auth dependency \u2014 backend/app/routers/teams.py:114"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34550f1173574613", "name": "FastAPI DELETE `delete_team` without auth dependency \u2014 backend/app/routers/teams.py:134", "shortDescription": {"text": "FastAPI DELETE `delete_team` without auth dependency \u2014 backend/app/routers/teams.py:134"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ae282e0eb0ff7ff", "name": "FastAPI POST `add_agent` without auth dependency \u2014 backend/app/routers/teams.py:179", "shortDescription": {"text": "FastAPI POST `add_agent` without auth dependency \u2014 backend/app/routers/teams.py:179"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-587b7e352b6d723d", "name": "FastAPI PATCH `update_agent` without auth dependency \u2014 backend/app/routers/teams.py:229", "shortDescription": {"text": "FastAPI PATCH `update_agent` without auth dependency \u2014 backend/app/routers/teams.py:229"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63ebe5b6ea663d16", "name": "FastAPI DELETE `delete_agent` without auth dependency \u2014 backend/app/routers/teams.py:252", "shortDescription": {"text": "FastAPI DELETE `delete_agent` without auth dependency \u2014 backend/app/routers/teams.py:252"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-196ebc4f274e182d", "name": "FastAPI POST `upload_context` without auth dependency \u2014 backend/app/routers/context.py:30", "shortDescription": {"text": "FastAPI POST `upload_context` without auth dependency \u2014 backend/app/routers/context.py:30"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5bada0c177d67339", "name": "FastAPI DELETE `delete_context` without auth dependency \u2014 backend/app/routers/context.py:85", "shortDescription": {"text": "FastAPI DELETE `delete_context` without auth dependency \u2014 backend/app/routers/context.py:85"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-17545e4930c8faa5", "name": "FastAPI PUT `put_memory` without auth dependency \u2014 backend/app/routers/memory.py:38", "shortDescription": {"text": "FastAPI PUT `put_memory` without auth dependency \u2014 backend/app/routers/memory.py:38"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43f08120d6ab7679", "name": "FastAPI DELETE `delete_memory` without auth dependency \u2014 backend/app/routers/memory.py:56", "shortDescription": {"text": "FastAPI DELETE `delete_memory` without auth dependency \u2014 backend/app/routers/memory.py:56"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6554e151faaa939d", "name": "FastAPI POST `stop_task` without auth dependency \u2014 backend/app/routers/tasks.py:38", "shortDescription": {"text": "FastAPI POST `stop_task` without auth dependency \u2014 backend/app/routers/tasks.py:38"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-432c8d4c9da117a9", "name": "FastAPI POST `continue_task` without auth dependency \u2014 backend/app/routers/tasks.py:57", "shortDescription": {"text": "FastAPI POST `continue_task` without auth dependency \u2014 backend/app/routers/tasks.py:57"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8582d3a352103d2e", "name": "FastAPI POST `create_edge` without auth dependency \u2014 backend/app/routers/edges.py:27", "shortDescription": {"text": "FastAPI POST `create_edge` without auth dependency \u2014 backend/app/routers/edges.py:27"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72fdd1070769a78f", "name": "FastAPI DELETE `delete_edge` without auth dependency \u2014 backend/app/routers/edges.py:56", "shortDescription": {"text": "FastAPI DELETE `delete_edge` without auth dependency \u2014 backend/app/routers/edges.py:56"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-017394171548a2b2", "name": "Unused endpoint: GET /templates", "shortDescription": {"text": "Unused endpoint: GET /templates"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `GET /templates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58666816ba500374", "name": "Unused endpoint: POST /projects", "shortDescription": {"text": "Unused endpoint: POST /projects"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `POST /projects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1e1ee09590b0a49", "name": "Unused endpoint: GET /projects", "shortDescription": {"text": "Unused endpoint: GET /projects"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `GET /projects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8276e9a42f5cb13a", "name": "Unused endpoint: GET /projects/{project_id}", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `GET /projects/{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1293cf39e94c35a", "name": "Unused endpoint: PATCH /projects/{project_id}", "shortDescription": {"text": "Unused endpoint: PATCH /projects/{project_id}"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `PATCH /projects/{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-757ec6dc0d84b69c", "name": "Unused endpoint: DELETE /projects/{project_id}", "shortDescription": {"text": "Unused endpoint: DELETE /projects/{project_id}"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `DELETE /projects/{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b4fa398c8868eea", "name": "Unused endpoint: POST /projects/{project_id}/pause", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/pause"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `POST /projects/{project_id}/pause` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-889acf240cc6b6c3", "name": "Unused endpoint: POST /projects/{project_id}/resume", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/resume"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `POST /projects/{project_id}/resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09fbbe0a8aeb09f2", "name": "Unused endpoint: GET /projects/{project_id}/map", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/map"}, "fullDescription": {"text": "`backend/app/routers/projects.py` declares `GET /projects/{project_id}/map` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-072eb4a273c7fe97", "name": "Unused endpoint: POST /projects/{project_id}/teams", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/teams"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `POST /projects/{project_id}/teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b3bfc889e1599ab", "name": "Unused endpoint: PATCH /teams/{team_id}", "shortDescription": {"text": "Unused endpoint: PATCH /teams/{team_id}"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `PATCH /teams/{team_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d11a051c24765206", "name": "Unused endpoint: DELETE /teams/{team_id}", "shortDescription": {"text": "Unused endpoint: DELETE /teams/{team_id}"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `DELETE /teams/{team_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e6e45699f6fef78", "name": "Unused endpoint: GET /teams/{team_id}", "shortDescription": {"text": "Unused endpoint: GET /teams/{team_id}"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `GET /teams/{team_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce305e751c01c7d0", "name": "Unused endpoint: POST /teams/{team_id}/agents", "shortDescription": {"text": "Unused endpoint: POST /teams/{team_id}/agents"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `POST /teams/{team_id}/agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c938812a5876d202", "name": "Unused endpoint: PATCH /agents/{agent_id}", "shortDescription": {"text": "Unused endpoint: PATCH /agents/{agent_id}"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `PATCH /agents/{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3b90085b95f0071", "name": "Unused endpoint: DELETE /agents/{agent_id}", "shortDescription": {"text": "Unused endpoint: DELETE /agents/{agent_id}"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `DELETE /agents/{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b30cbdd177c13681", "name": "Unused endpoint: GET /agents/{agent_id}", "shortDescription": {"text": "Unused endpoint: GET /agents/{agent_id}"}, "fullDescription": {"text": "`backend/app/routers/teams.py` declares `GET /agents/{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22fb9d4903ae09d7", "name": "Unused endpoint: POST /projects/{project_id}/context", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/context"}, "fullDescription": {"text": "`backend/app/routers/context.py` declares `POST /projects/{project_id}/context` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfde979bcb1cdd6c", "name": "Unused endpoint: GET /projects/{project_id}/context", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/context"}, "fullDescription": {"text": "`backend/app/routers/context.py` declares `GET /projects/{project_id}/context` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b84df52fd1de858", "name": "Unused endpoint: DELETE /context/{context_id}", "shortDescription": {"text": "Unused endpoint: DELETE /context/{context_id}"}, "fullDescription": {"text": "`backend/app/routers/context.py` declares `DELETE /context/{context_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`backend/app/routers/auth_demo.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed4e401af56e24bc", "name": "Unused endpoint: GET /agents/{agent_id}/memory", "shortDescription": {"text": "Unused endpoint: GET /agents/{agent_id}/memory"}, "fullDescription": {"text": "`backend/app/routers/memory.py` declares `GET /agents/{agent_id}/memory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7c47346f4c4f15d", "name": "Unused endpoint: PUT /agents/{agent_id}/memory", "shortDescription": {"text": "Unused endpoint: PUT /agents/{agent_id}/memory"}, "fullDescription": {"text": "`backend/app/routers/memory.py` declares `PUT /agents/{agent_id}/memory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e6946c20f67e38c", "name": "Unused endpoint: DELETE /agents/{agent_id}/memory", "shortDescription": {"text": "Unused endpoint: DELETE /agents/{agent_id}/memory"}, "fullDescription": {"text": "`backend/app/routers/memory.py` declares `DELETE /agents/{agent_id}/memory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f37216a9c513002", "name": "Unused endpoint: POST /tasks/{task_id}/stop", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/stop"}, "fullDescription": {"text": "`backend/app/routers/tasks.py` declares `POST /tasks/{task_id}/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-224f6d9f6a7c4328", "name": "Unused endpoint: POST /tasks/{task_id}/continue", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/continue"}, "fullDescription": {"text": "`backend/app/routers/tasks.py` declares `POST /tasks/{task_id}/continue` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32cd0b6313fd6b45", "name": "Unused endpoint: GET /projects/{project_id}/outputs", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/outputs"}, "fullDescription": {"text": "`backend/app/routers/outputs.py` declares `GET /projects/{project_id}/outputs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-592551e749676a51", "name": "Unused endpoint: GET /outputs/{output_id}", "shortDescription": {"text": "Unused endpoint: GET /outputs/{output_id}"}, "fullDescription": {"text": "`backend/app/routers/outputs.py` declares `GET /outputs/{output_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62c92cb5a8283413", "name": "Unused endpoint: GET /outputs/{output_id}/download", "shortDescription": {"text": "Unused endpoint: GET /outputs/{output_id}/download"}, "fullDescription": {"text": "`backend/app/routers/outputs.py` declares `GET /outputs/{output_id}/download` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc9f5f57b043ac0e", "name": "Unused endpoint: GET /tasks/{task_id}/outputs.zip", "shortDescription": {"text": "Unused endpoint: GET /tasks/{task_id}/outputs.zip"}, "fullDescription": {"text": "`backend/app/routers/outputs.py` declares `GET /tasks/{task_id}/outputs.zip` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99c3660adc2b0ff9", "name": "Unused endpoint: POST /projects/{project_id}/chat", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/chat"}, "fullDescription": {"text": "`backend/app/routers/chat.py` declares `POST /projects/{project_id}/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c342f85880f360c9", "name": "Unused endpoint: GET /projects/{project_id}/chat/history", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/chat/history"}, "fullDescription": {"text": "`backend/app/routers/chat.py` declares `GET /projects/{project_id}/chat/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f0b0bf2aead8783", "name": "Unused endpoint: POST /projects/{project_id}/edges", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/edges"}, "fullDescription": {"text": "`backend/app/routers/edges.py` declares `POST /projects/{project_id}/edges` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09d34253f0c47a49", "name": "Unused endpoint: DELETE /edges/{edge_id}", "shortDescription": {"text": "Unused endpoint: DELETE /edges/{edge_id}"}, "fullDescription": {"text": "`backend/app/routers/edges.py` declares `DELETE /edges/{edge_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26fe4aefb13db889", "name": "Unused endpoint: GET /projects/{project_id}/sse", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/sse"}, "fullDescription": {"text": "`backend/app/routers/realtime.py` declares `GET /projects/{project_id}/sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3af64e805d88ef35", "name": "Unused endpoint: GET /notifications", "shortDescription": {"text": "Unused endpoint: GET /notifications"}, "fullDescription": {"text": "`backend/app/routers/realtime.py` declares `GET /notifications` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b93f5ab485027b7", "name": "Unused endpoint: POST /notifications/read-all", "shortDescription": {"text": "Unused endpoint: POST /notifications/read-all"}, "fullDescription": {"text": "`backend/app/routers/realtime.py` declares `POST /notifications/read-all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8135bfa8c5489002", "name": "Unused endpoint: POST /notifications/{notif_id}/read", "shortDescription": {"text": "Unused endpoint: POST /notifications/{notif_id}/read"}, "fullDescription": {"text": "`backend/app/routers/realtime.py` declares `POST /notifications/{notif_id}/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4a6c34ff14043dc", "name": "Unused endpoint: GET /projects/{project_id}/board", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/board"}, "fullDescription": {"text": "`backend/app/routers/realtime.py` declares `GET /projects/{project_id}/board` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59d2abedfeb50678", "name": "Unused endpoint: GET /projects/{project_id}/usage", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/usage"}, "fullDescription": {"text": "`backend/app/routers/realtime.py` declares `GET /projects/{project_id}/usage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c236625afb6a8cb", "name": "Unused endpoint: GET /ready", "shortDescription": {"text": "Unused endpoint: GET /ready"}, "fullDescription": {"text": "`backend/app/routers/system.py` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23301"}, "properties": {"repository": "yoonhj7173/craft", "repoUrl": "https://github.com/yoonhj7173/craft", "branch": "main"}, "results": [{"ruleId": "scanner-c1c062ea4367ffc7", "level": "note", "message": {"text": "Possibly dead Python function: require_user"}, "properties": {"repobilityId": "2018d028cf795b1d", "scanner": "scanner-primary", "fingerprint": "c1c062ea4367ffc7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/auth.py:189"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c15ed2ab694782c7", "level": "note", "message": {"text": "Possibly dead Python function: tenant_scope"}, "properties": {"repobilityId": "07b80daa87594274", "scanner": "scanner-primary", "fingerprint": "c15ed2ab694782c7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/auth.py:241"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3771176ff24275a", "level": "note", "message": {"text": "Possibly dead Python function: format"}, "properties": {"repobilityId": "46a918df7787d491", "scanner": "scanner-primary", "fingerprint": "b3771176ff24275a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/logging_config.py:26"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53e694b89a8682c", "level": "note", "message": {"text": "Possibly dead Python function: call"}, "properties": {"repobilityId": "cf6e1a33b1245f9d", "scanner": "scanner-primary", "fingerprint": "a53e694b89a8682c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/crews/factory.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-571ec797e07db027", "level": "note", "message": {"text": "Possibly dead Python function: screenshot"}, "properties": {"repobilityId": "c876079e7f0526a8", "scanner": "scanner-primary", "fingerprint": "571ec797e07db027", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/verification.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3cac6777dcd3413e", "level": "note", "message": {"text": "Possibly dead Python function: is_allowed"}, "properties": {"repobilityId": "3d252507d6f6b06e", "scanner": "scanner-primary", "fingerprint": "3cac6777dcd3413e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/extract.py:23"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9eacd9de39d2a228", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/components/panels/InspectorPanel.tsx:123"}, "properties": {"repobilityId": "b6b022447d7e5e00", "scanner": "scanner-primary", "fingerprint": "9eacd9de39d2a228", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-3ab7fe63260d79fe", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/components/overlays/Overlays.tsx:159"}, "properties": {"repobilityId": "5889e94d2f6d6dae", "scanner": "scanner-primary", "fingerprint": "3ab7fe63260d79fe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-a06c007eee154274", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/overlays/Overlays.tsx:43"}, "properties": {"repobilityId": "72f14b0bfe11b3a1", "scanner": "scanner-primary", "fingerprint": "a06c007eee154274", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-5122a967095a602f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/hud/Hud.tsx:38"}, "properties": {"repobilityId": "461344c9f0cb960b", "scanner": "scanner-primary", "fingerprint": "5122a967095a602f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2a8d28e3d9672303", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/page.tsx:32"}, "properties": {"repobilityId": "02ed9b7fab448664", "scanner": "scanner-primary", "fingerprint": "2a8d28e3d9672303", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-74cb385dc1c0582a", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/blog/[slug]/page.tsx:40"}, "properties": {"repobilityId": "fb33d6e6e7aee74a", "scanner": "scanner-primary", "fingerprint": "74cb385dc1c0582a", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "e32365d1d1dd37f7", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-428d2f8b84ecfa7b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/app/page.tsx:32"}, "properties": {"repobilityId": "f2e10b48b33591d3", "scanner": "scanner-primary", "fingerprint": "428d2f8b84ecfa7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/app/page.tsx"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-bf8faa0d492ea279", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/app/blog/[slug]/page.tsx:40"}, "properties": {"repobilityId": "6157dd135d5196e7", "scanner": "scanner-primary", "fingerprint": "bf8faa0d492ea279", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/app/blog/[slug]/page.tsx"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-1f4b8ca98aec2c8e", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in claude-design-handoff/product/support.js:677"}, "properties": {"repobilityId": "bd40271fbe0577e5", "scanner": "scanner-primary", "fingerprint": "1f4b8ca98aec2c8e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-handoff/product/support.js"}, "region": {"startLine": 677}}}]}, {"ruleId": "scanner-9b545e91a403586e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in claude-design-handoff/product/support.js:422"}, "properties": {"repobilityId": "33e3ad11c10bf2af", "scanner": "scanner-primary", "fingerprint": "9b545e91a403586e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-handoff/product/support.js"}, "region": {"startLine": 422}}}]}, {"ruleId": "scanner-ee020178f5426747", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in claude-design-handoff/product/support.js:44"}, "properties": {"repobilityId": "a21f60b1a182375c", "scanner": "scanner-primary", "fingerprint": "ee020178f5426747", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-handoff/product/support.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-c22ee67a4d50e69d", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in claude-design-handoff/marketing/support.js:677"}, "properties": {"repobilityId": "cd687f88ffcdd021", "scanner": "scanner-primary", "fingerprint": "c22ee67a4d50e69d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-handoff/marketing/support.js"}, "region": {"startLine": 677}}}]}, {"ruleId": "scanner-83fa922fd72b3dcf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in claude-design-handoff/marketing/support.js:422"}, "properties": {"repobilityId": "6b8a1880a17c3921", "scanner": "scanner-primary", "fingerprint": "83fa922fd72b3dcf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-handoff/marketing/support.js"}, "region": {"startLine": 422}}}]}, {"ruleId": "scanner-dc4e1adddfd6931e", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in claude-design-handoff/marketing/support.js:44"}, "properties": {"repobilityId": "064a53f57f5e9af2", "scanner": "scanner-primary", "fingerprint": "dc4e1adddfd6931e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-handoff/marketing/support.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-bdc1fb40bc471e1b", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in backend/app/services/sandbox.py:102"}, "properties": {"repobilityId": "ff90072b8d5d644f", "scanner": "scanner-primary", "fingerprint": "bdc1fb40bc471e1b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/sandbox.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-fde5705d9ea36fe5", "level": "note", "message": {"text": "Very large file: claude-design-handoff/product/support.js (1466 lines)"}, "properties": {"repobilityId": "d65d25cbd483946d", "scanner": "scanner-primary", "fingerprint": "fde5705d9ea36fe5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ebd3c4d95fa7f091", "level": "note", "message": {"text": "Very large file: claude-design-handoff/marketing/support.js (1466 lines)"}, "properties": {"repobilityId": "3cbd8fb30396512c", "scanner": "scanner-primary", "fingerprint": "ebd3c4d95fa7f091", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "8ce7d4514e7a185b", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c591cc7fe2992e41", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "8d8ee6e051d6aa13", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "79210036e433774b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "7d85e0e991b57728", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "dac583fd5a1ba5bb", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "cfb453a7370a5533", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b7523f8587d8fb3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/init.md"}, "properties": {"repobilityId": "3eb02a667c779177", "scanner": "scanner-primary", "fingerprint": "5b7523f8587d8fb3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/init.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ce696c83aabd74", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/status.md"}, "properties": {"repobilityId": "88aae42dcbdf6a24", "scanner": "scanner-primary", "fingerprint": "53ce696c83aabd74", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/status.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb750e269fa4542d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/product_manager.md"}, "properties": {"repobilityId": "f84a32c6fd13c06b", "scanner": "scanner-primary", "fingerprint": "bb750e269fa4542d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/product_manager.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0919c19e893e0f1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.ts:12"}, "properties": {"repobilityId": "d5ca1d15750e9a6d", "scanner": "scanner-primary", "fingerprint": "a0919c19e893e0f1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-975c7503e503fdda", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 claude-design-handoff/product/support.js:968"}, "properties": {"repobilityId": "fc94e9d5786b39cc", "scanner": "scanner-primary", "fingerprint": "975c7503e503fdda", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9712a6689d230ddb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 claude-design-handoff/marketing/support.js:968"}, "properties": {"repobilityId": "4802ba5eedc3dde5", "scanner": "scanner-primary", "fingerprint": "9712a6689d230ddb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b5922d69f7430531", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0380df8163c7d205", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b275c289c37ec0e2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e11b476e78f86d40", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "15b9c6e861773d37", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "163385d8eb56a376", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b52ad90fe4ed6f97", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8a6625a24a2bfdec", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "a410fae0cb4ef4e1", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "9b3b6acb64dd3732", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "4b7d63967bca58e2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "698b50e0f8041b58", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3703a86fafa20f3f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "542dd5106d36c53f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-a359d1138c8552cd", "level": "error", "message": {"text": "FastAPI PATCH `rename_project` without auth dependency \u2014 backend/app/routers/projects.py:225"}, "properties": {"repobilityId": "c953811bdc12e45b", "scanner": "scanner-primary", "fingerprint": "a359d1138c8552cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/projects.py"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-0e52587029ee2c96", "level": "error", "message": {"text": "FastAPI DELETE `delete_project` without auth dependency \u2014 backend/app/routers/projects.py:239"}, "properties": {"repobilityId": "b81871ed3b8dfe6a", "scanner": "scanner-primary", "fingerprint": "0e52587029ee2c96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/projects.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-a4eada27454ffa38", "level": "error", "message": {"text": "FastAPI POST `pause_project` without auth dependency \u2014 backend/app/routers/projects.py:254"}, "properties": {"repobilityId": "88ae9a4b862441dc", "scanner": "scanner-primary", "fingerprint": "a4eada27454ffa38", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/projects.py"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-1887c71585c4ba20", "level": "error", "message": {"text": "FastAPI POST `resume_project` without auth dependency \u2014 backend/app/routers/projects.py:267"}, "properties": {"repobilityId": "dbce72daeff0c3b7", "scanner": "scanner-primary", "fingerprint": "1887c71585c4ba20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/projects.py"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-8db01722a56fe1d3", "level": "error", "message": {"text": "FastAPI POST `add_team` without auth dependency \u2014 backend/app/routers/teams.py:68"}, "properties": {"repobilityId": "6c4afd6fabcbe10a", "scanner": "scanner-primary", "fingerprint": "8db01722a56fe1d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/teams.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-4f29c43f2bb0f26e", "level": "error", "message": {"text": "FastAPI PATCH `update_team` without auth dependency \u2014 backend/app/routers/teams.py:114"}, "properties": {"repobilityId": "8ad7320eeda3b341", "scanner": "scanner-primary", "fingerprint": "4f29c43f2bb0f26e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/teams.py"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-34550f1173574613", "level": "error", "message": {"text": "FastAPI DELETE `delete_team` without auth dependency \u2014 backend/app/routers/teams.py:134"}, "properties": {"repobilityId": "d62f7733c91460d1", "scanner": "scanner-primary", "fingerprint": "34550f1173574613", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/teams.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-0ae282e0eb0ff7ff", "level": "error", "message": {"text": "FastAPI POST `add_agent` without auth dependency \u2014 backend/app/routers/teams.py:179"}, "properties": {"repobilityId": "35516334fef288a3", "scanner": "scanner-primary", "fingerprint": "0ae282e0eb0ff7ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/teams.py"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-587b7e352b6d723d", "level": "error", "message": {"text": "FastAPI PATCH `update_agent` without auth dependency \u2014 backend/app/routers/teams.py:229"}, "properties": {"repobilityId": "6123e01d6c5ebcb8", "scanner": "scanner-primary", "fingerprint": "587b7e352b6d723d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/teams.py"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-63ebe5b6ea663d16", "level": "error", "message": {"text": "FastAPI DELETE `delete_agent` without auth dependency \u2014 backend/app/routers/teams.py:252"}, "properties": {"repobilityId": "3c30b28635f488fd", "scanner": "scanner-primary", "fingerprint": "63ebe5b6ea663d16", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/teams.py"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-196ebc4f274e182d", "level": "error", "message": {"text": "FastAPI POST `upload_context` without auth dependency \u2014 backend/app/routers/context.py:30"}, "properties": {"repobilityId": "594ebb3bcf09789a", "scanner": "scanner-primary", "fingerprint": "196ebc4f274e182d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/context.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-5bada0c177d67339", "level": "error", "message": {"text": "FastAPI DELETE `delete_context` without auth dependency \u2014 backend/app/routers/context.py:85"}, "properties": {"repobilityId": "71bb611f608fafd1", "scanner": "scanner-primary", "fingerprint": "5bada0c177d67339", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/context.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-17545e4930c8faa5", "level": "error", "message": {"text": "FastAPI PUT `put_memory` without auth dependency \u2014 backend/app/routers/memory.py:38"}, "properties": {"repobilityId": "a83e093a37b4bc54", "scanner": "scanner-primary", "fingerprint": "17545e4930c8faa5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/memory.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-43f08120d6ab7679", "level": "error", "message": {"text": "FastAPI DELETE `delete_memory` without auth dependency \u2014 backend/app/routers/memory.py:56"}, "properties": {"repobilityId": "88c334dbf900fd2e", "scanner": "scanner-primary", "fingerprint": "43f08120d6ab7679", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/memory.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-6554e151faaa939d", "level": "error", "message": {"text": "FastAPI POST `stop_task` without auth dependency \u2014 backend/app/routers/tasks.py:38"}, "properties": {"repobilityId": "f6a433f5acf56af0", "scanner": "scanner-primary", "fingerprint": "6554e151faaa939d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/tasks.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-432c8d4c9da117a9", "level": "error", "message": {"text": "FastAPI POST `continue_task` without auth dependency \u2014 backend/app/routers/tasks.py:57"}, "properties": {"repobilityId": "17e157acb4d17ff4", "scanner": "scanner-primary", "fingerprint": "432c8d4c9da117a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/tasks.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-8582d3a352103d2e", "level": "error", "message": {"text": "FastAPI POST `create_edge` without auth dependency \u2014 backend/app/routers/edges.py:27"}, "properties": {"repobilityId": "846a78a090c55a74", "scanner": "scanner-primary", "fingerprint": "8582d3a352103d2e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/edges.py"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-72fdd1070769a78f", "level": "error", "message": {"text": "FastAPI DELETE `delete_edge` without auth dependency \u2014 backend/app/routers/edges.py:56"}, "properties": {"repobilityId": "085087d790d94f28", "scanner": "scanner-primary", "fingerprint": "72fdd1070769a78f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/routers/edges.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-017394171548a2b2", "level": "note", "message": {"text": "Unused endpoint: GET /templates"}, "properties": {"repobilityId": "33f9ae6e8f5ef645", "scanner": "scanner-primary", "fingerprint": "017394171548a2b2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58666816ba500374", "level": "note", "message": {"text": "Unused endpoint: POST /projects"}, "properties": {"repobilityId": "4d929c2985ac224f", "scanner": "scanner-primary", "fingerprint": "58666816ba500374", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1e1ee09590b0a49", "level": "note", "message": {"text": "Unused endpoint: GET /projects"}, "properties": {"repobilityId": "19b79c55f4af317d", "scanner": "scanner-primary", "fingerprint": "c1e1ee09590b0a49", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8276e9a42f5cb13a", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}"}, "properties": {"repobilityId": "81febe64d9f5e15b", "scanner": "scanner-primary", "fingerprint": "8276e9a42f5cb13a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d1293cf39e94c35a", "level": "note", "message": {"text": "Unused endpoint: PATCH /projects/{project_id}"}, "properties": {"repobilityId": "f7dc449d13e337c8", "scanner": "scanner-primary", "fingerprint": "d1293cf39e94c35a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-757ec6dc0d84b69c", "level": "note", "message": {"text": "Unused endpoint: DELETE /projects/{project_id}"}, "properties": {"repobilityId": "710cc7787c7c81b9", "scanner": "scanner-primary", "fingerprint": "757ec6dc0d84b69c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b4fa398c8868eea", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/pause"}, "properties": {"repobilityId": "6cc812355d82acdd", "scanner": "scanner-primary", "fingerprint": "1b4fa398c8868eea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-889acf240cc6b6c3", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/resume"}, "properties": {"repobilityId": "e8d7e8f27616b716", "scanner": "scanner-primary", "fingerprint": "889acf240cc6b6c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-09fbbe0a8aeb09f2", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/map"}, "properties": {"repobilityId": "db552ba3890f599e", "scanner": "scanner-primary", "fingerprint": "09fbbe0a8aeb09f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-072eb4a273c7fe97", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/teams"}, "properties": {"repobilityId": "f5e28d549ba17e59", "scanner": "scanner-primary", "fingerprint": "072eb4a273c7fe97", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b3bfc889e1599ab", "level": "note", "message": {"text": "Unused endpoint: PATCH /teams/{team_id}"}, "properties": {"repobilityId": "c6f7bb3b4ab01505", "scanner": "scanner-primary", "fingerprint": "3b3bfc889e1599ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d11a051c24765206", "level": "note", "message": {"text": "Unused endpoint: DELETE /teams/{team_id}"}, "properties": {"repobilityId": "d667377afaa6f006", "scanner": "scanner-primary", "fingerprint": "d11a051c24765206", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e6e45699f6fef78", "level": "note", "message": {"text": "Unused endpoint: GET /teams/{team_id}"}, "properties": {"repobilityId": "6a0c6b3a46990baa", "scanner": "scanner-primary", "fingerprint": "3e6e45699f6fef78", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce305e751c01c7d0", "level": "note", "message": {"text": "Unused endpoint: POST /teams/{team_id}/agents"}, "properties": {"repobilityId": "e144d983f90962ad", "scanner": "scanner-primary", "fingerprint": "ce305e751c01c7d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c938812a5876d202", "level": "note", "message": {"text": "Unused endpoint: PATCH /agents/{agent_id}"}, "properties": {"repobilityId": "0b168064ee2efb7f", "scanner": "scanner-primary", "fingerprint": "c938812a5876d202", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3b90085b95f0071", "level": "note", "message": {"text": "Unused endpoint: DELETE /agents/{agent_id}"}, "properties": {"repobilityId": "29128123ec31ec7e", "scanner": "scanner-primary", "fingerprint": "c3b90085b95f0071", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b30cbdd177c13681", "level": "note", "message": {"text": "Unused endpoint: GET /agents/{agent_id}"}, "properties": {"repobilityId": "92127f7f2dc640a2", "scanner": "scanner-primary", "fingerprint": "b30cbdd177c13681", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22fb9d4903ae09d7", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/context"}, "properties": {"repobilityId": "c53613870087dfb4", "scanner": "scanner-primary", "fingerprint": "22fb9d4903ae09d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cfde979bcb1cdd6c", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/context"}, "properties": {"repobilityId": "9272e802de3a2ea1", "scanner": "scanner-primary", "fingerprint": "cfde979bcb1cdd6c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b84df52fd1de858", "level": "note", "message": {"text": "Unused endpoint: DELETE /context/{context_id}"}, "properties": {"repobilityId": "707b68d46965756e", "scanner": "scanner-primary", "fingerprint": "8b84df52fd1de858", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "8556999910fefdb6", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed4e401af56e24bc", "level": "note", "message": {"text": "Unused endpoint: GET /agents/{agent_id}/memory"}, "properties": {"repobilityId": "2fc937accabae367", "scanner": "scanner-primary", "fingerprint": "ed4e401af56e24bc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7c47346f4c4f15d", "level": "note", "message": {"text": "Unused endpoint: PUT /agents/{agent_id}/memory"}, "properties": {"repobilityId": "d35e25beecd06b34", "scanner": "scanner-primary", "fingerprint": "f7c47346f4c4f15d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e6946c20f67e38c", "level": "note", "message": {"text": "Unused endpoint: DELETE /agents/{agent_id}/memory"}, "properties": {"repobilityId": "1189d1d39023f957", "scanner": "scanner-primary", "fingerprint": "4e6946c20f67e38c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7f37216a9c513002", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/stop"}, "properties": {"repobilityId": "3127fcbeecfd7de5", "scanner": "scanner-primary", "fingerprint": "7f37216a9c513002", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-224f6d9f6a7c4328", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/continue"}, "properties": {"repobilityId": "bf97949141c6e9e8", "scanner": "scanner-primary", "fingerprint": "224f6d9f6a7c4328", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32cd0b6313fd6b45", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/outputs"}, "properties": {"repobilityId": "ce85606ab4317589", "scanner": "scanner-primary", "fingerprint": "32cd0b6313fd6b45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-592551e749676a51", "level": "note", "message": {"text": "Unused endpoint: GET /outputs/{output_id}"}, "properties": {"repobilityId": "39fc7592f8266ec2", "scanner": "scanner-primary", "fingerprint": "592551e749676a51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-62c92cb5a8283413", "level": "note", "message": {"text": "Unused endpoint: GET /outputs/{output_id}/download"}, "properties": {"repobilityId": "96e7ee1c1c99e89f", "scanner": "scanner-primary", "fingerprint": "62c92cb5a8283413", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc9f5f57b043ac0e", "level": "note", "message": {"text": "Unused endpoint: GET /tasks/{task_id}/outputs.zip"}, "properties": {"repobilityId": "169ca5034ed5b6a7", "scanner": "scanner-primary", "fingerprint": "bc9f5f57b043ac0e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99c3660adc2b0ff9", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/chat"}, "properties": {"repobilityId": "e978bde46960e021", "scanner": "scanner-primary", "fingerprint": "99c3660adc2b0ff9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c342f85880f360c9", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/chat/history"}, "properties": {"repobilityId": "0935ebeafde3a5b3", "scanner": "scanner-primary", "fingerprint": "c342f85880f360c9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f0b0bf2aead8783", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/edges"}, "properties": {"repobilityId": "16494a1fa87ad204", "scanner": "scanner-primary", "fingerprint": "1f0b0bf2aead8783", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-09d34253f0c47a49", "level": "note", "message": {"text": "Unused endpoint: DELETE /edges/{edge_id}"}, "properties": {"repobilityId": "f818861746f21fb5", "scanner": "scanner-primary", "fingerprint": "09d34253f0c47a49", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-26fe4aefb13db889", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/sse"}, "properties": {"repobilityId": "caa620736adbc8e5", "scanner": "scanner-primary", "fingerprint": "26fe4aefb13db889", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3af64e805d88ef35", "level": "note", "message": {"text": "Unused endpoint: GET /notifications"}, "properties": {"repobilityId": "d0620aa0acd1f11e", "scanner": "scanner-primary", "fingerprint": "3af64e805d88ef35", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b93f5ab485027b7", "level": "note", "message": {"text": "Unused endpoint: POST /notifications/read-all"}, "properties": {"repobilityId": "f8201c79ed5d2f11", "scanner": "scanner-primary", "fingerprint": "1b93f5ab485027b7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8135bfa8c5489002", "level": "note", "message": {"text": "Unused endpoint: POST /notifications/{notif_id}/read"}, "properties": {"repobilityId": "c67c484efe3aa029", "scanner": "scanner-primary", "fingerprint": "8135bfa8c5489002", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d4a6c34ff14043dc", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/board"}, "properties": {"repobilityId": "a4d2e91308438db3", "scanner": "scanner-primary", "fingerprint": "d4a6c34ff14043dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-59d2abedfeb50678", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/usage"}, "properties": {"repobilityId": "148a7e109c6a16f7", "scanner": "scanner-primary", "fingerprint": "59d2abedfeb50678", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c236625afb6a8cb", "level": "note", "message": {"text": "Unused endpoint: GET /ready"}, "properties": {"repobilityId": "084fe6e3de53c25a", "scanner": "scanner-primary", "fingerprint": "8c236625afb6a8cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}