{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f733215110aae5e7", "name": "Possibly dead Python function: check_category_helpers", "shortDescription": {"text": "Possibly dead Python function: check_category_helpers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97285a88d0ceec85", "name": "Possibly dead Python function: check_boilerplate_filter", "shortDescription": {"text": "Possibly dead Python function: check_boilerplate_filter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a14242510403028c", "name": "Possibly dead Python function: check_title_authority", "shortDescription": {"text": "Possibly dead Python function: check_title_authority"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9cd8753896252913", "name": "Possibly dead Python function: emit", "shortDescription": {"text": "Possibly dead Python function: emit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8fece9db4bb5eda", "name": "Possibly dead Python function: log_interaction", "shortDescription": {"text": "Possibly dead Python function: log_interaction"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5e8a84752befa3d", "name": "Possibly dead Python function: log_knowledge_gap", "shortDescription": {"text": "Possibly dead Python function: log_knowledge_gap"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4da8193d79a1bd39", "name": "Possibly dead Python function: save_visitor_turn", "shortDescription": {"text": "Possibly dead Python function: save_visitor_turn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ab6b2b17954e237", "name": "Possibly dead Python function: embed_documents", "shortDescription": {"text": "Possibly dead Python function: embed_documents"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbc238b70db8bbf6", "name": "Possibly dead Python function: embed_query", "shortDescription": {"text": "Possibly dead Python function: embed_query"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e46a8332a8c6310", "name": "Possibly dead Python function: answer_catalog_query", "shortDescription": {"text": "Possibly dead Python function: answer_catalog_query"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f11fa2b53e8ccb14", "name": "Possibly dead Python function: key_health_score", "shortDescription": {"text": "Possibly dead Python function: key_health_score"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59868562782cd0f8", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b40ada84dc3fa877", "name": "Insecure pattern 'weak_hash' in README.md:31", "shortDescription": {"text": "Insecure pattern 'weak_hash' in README.md:31"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96710b2890508379", "name": "Insecure pattern 'cors_wildcard' in app.py:2963", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in app.py:2963"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd94c52d3737f773", "name": "Insecure pattern 'direct_innerhtml_assignment' in chat.html:317", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in chat.html:317"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c0dbf5b44f1cc76", "name": "Insecure pattern 'local_storage_auth_token' in chat.html:300", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in chat.html:300"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30af2b5ecf3e7e17", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin.html:926", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin.html:926"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a41b3190f07e897", "name": "Insecure pattern 'local_storage_auth_token' in admin.html:986", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in admin.html:986"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a0aa13edcbf8318", "name": "Possible secret in watchdog.py", "shortDescription": {"text": "Possible secret in watchdog.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a64689d19b9eb8ee", "name": "Insecure pattern 'direct_innerhtml_assignment' in widget.js:99", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in widget.js:99"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df9a0730e6168d21", "name": "Possible secret in jikan_ingest.py", "shortDescription": {"text": "Possible secret in jikan_ingest.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4ee66b7f0c9ab4e3", "name": "Possible secret in sequential_crawl.py", "shortDescription": {"text": "Possible secret in sequential_crawl.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-13a1c647c3156eee", "name": "Insecure pattern 'direct_innerhtml_assignment' in widget_chat.html:286", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in widget_chat.html:286"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a8087883c138d70", "name": "Insecure pattern 'local_storage_auth_token' in widget_chat.html:223", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in widget_chat.html:223"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a50467f36b413ec", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-136da25d70c346a1", "name": "Very large file: brutal_test.py (1112 lines)", "shortDescription": {"text": "Very large file: brutal_test.py (1112 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23cfb73a64f811ff", "name": "Very large file: app.py (14163 lines)", "shortDescription": {"text": "Very large file: app.py (14163 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-278cc5d84961426a", "name": "Very large file: services/retrieval.py (3990 lines)", "shortDescription": {"text": "Very large file: services/retrieval.py (3990 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e80ceb06b4888c6a", "name": "Very large file: services/crawler_utils.py (1838 lines)", "shortDescription": {"text": "Very large file: services/crawler_utils.py (1838 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7b596c29706897d", "name": "Very large file: evals/eval_v1.py (1863 lines)", "shortDescription": {"text": "Very large file: evals/eval_v1.py (1863 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 233 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 16 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dcb57ad95f1b260c", "name": "Legacy-named symbol `agentfactory_minilm_backup` in reindex_multilingual.py:10", "shortDescription": {"text": "Legacy-named symbol `agentfactory_minilm_backup` in reindex_multilingual.py:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8bef8da077d4aa5", "name": "Network/subprocess call without timeout or try/except \u2014 reindex_multilingual.py:112", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 reindex_multilingual.py:112"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4f4156be6a56b27", "name": "Commented-code block (5 lines) in pipeline_check.py:19", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline_check.py:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20222162752d721a", "name": "Legacy-named symbol `eval_v1` in modal_app.py:44", "shortDescription": {"text": "Legacy-named symbol `eval_v1` in modal_app.py:44"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acc5c44d27aea74d", "name": "Legacy-named symbol `eval_v1` in app.py:8597", "shortDescription": {"text": "Legacy-named symbol `eval_v1` in app.py:8597"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e007830db168a509", "name": "Commented-code block (5 lines) in app.py:298", "shortDescription": {"text": "Commented-code block (5 lines) in app.py:298"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55024926ffee0c25", "name": "Blocking `urllib.request.urlopen(...)` inside `async def ingest_fetch_url` \u2014 app.py:10736", "shortDescription": {"text": "Blocking `urllib.request.urlopen(...)` inside `async def ingest_fetch_url` \u2014 app.py:10736"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `urllib.request.urlopen(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac9222b15b3bc7ad", "name": "Network/subprocess call without timeout or try/except \u2014 orchestrate_and_test.py:27", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 orchestrate_and_test.py:27"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-708d283b0976b2b7", "name": "Commented-code block (6 lines) in offline_logic_test.py:8", "shortDescription": {"text": "Commented-code block (6 lines) in offline_logic_test.py:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cc04bd1e330b821", "name": "Legacy-named symbol `ready_legacy` in watchdog.py:59", "shortDescription": {"text": "Legacy-named symbol `ready_legacy` in watchdog.py:59"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b36d181d5b5a6b9f", "name": "Network/subprocess call without timeout or try/except \u2014 jikan_ingest.py:8", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 jikan_ingest.py:8"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-381fd099070706aa", "name": "Legacy-named symbol `eval_v1` in tests/test_eval_v1.py:4", "shortDescription": {"text": "Legacy-named symbol `eval_v1` in tests/test_eval_v1.py:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c4264b18a770f6d", "name": "Legacy-named symbol `eval_v1` in tests/test_security_basics.py:5", "shortDescription": {"text": "Legacy-named symbol `eval_v1` in tests/test_security_basics.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c16e5447bc54d83", "name": "Commented-code block (5 lines) in services/retrieval.py:1244", "shortDescription": {"text": "Commented-code block (5 lines) in services/retrieval.py:1244"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f5873ce993492e4", "name": "Commented-code block (5 lines) in services/page_extract.py:125", "shortDescription": {"text": "Commented-code block (5 lines) in services/page_extract.py:125"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-377e65e1227fadb0", "name": "Commented-code block (5 lines) in services/crawler_utils.py:63", "shortDescription": {"text": "Commented-code block (5 lines) in services/crawler_utils.py:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-976dbd474520921a", "name": "Commented-code block (5 lines) in services/catalog_query.py:271", "shortDescription": {"text": "Commented-code block (5 lines) in services/catalog_query.py:271"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa2ee34904ddc6e1", "name": "Commented-code block (5 lines) in services/legacy_answerers.py:376", "shortDescription": {"text": "Commented-code block (5 lines) in services/legacy_answerers.py:376"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-615b2de1668d370c", "name": "Legacy-named symbol `minilm_old` in services/db_instances.py:142", "shortDescription": {"text": "Legacy-named symbol `minilm_old` in services/db_instances.py:142"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83f2f418d56d1e66", "name": "Commented-code block (6 lines) in services/safety.py:296", "shortDescription": {"text": "Commented-code block (6 lines) in services/safety.py:296"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55a76dd15cbe8344", "name": "Legacy-named symbol `eval_v1` in evals/lite_eval.py:5", "shortDescription": {"text": "Legacy-named symbol `eval_v1` in evals/lite_eval.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb07f51555cf381f", "name": "Legacy-named symbol `eval_v1` in evals/eval_v1.py:19", "shortDescription": {"text": "Legacy-named symbol `eval_v1` in evals/eval_v1.py:19"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c8b918e1fee9558", "name": "20 env vars used in code but missing from .env.example", "shortDescription": {"text": "20 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ACTIVE_DB`, `ADMIN_PASSWORD`, `ALLOW_SPACE_CRAWL`, `CONFIG_JSON`, `GITHUB_PAT`, `GITHUB_REPO`, `GITHUB_USERNAME`, `GIT_SHA` + 12 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nmarathon_test.py:ts, brutal_test.py:ts\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nfinal_test_v2.py:chat, final_test_v2.py:c, final_test_v2.py:c, final_test_v2.py:c\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp.py:test_knowledge_endpoint, app.py:test_safety_endpoint, app.py:test_live_endpoint\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9cb05e489852bad", "name": "FastAPI POST `submit_lead` without auth dependency \u2014 submit_lead_block.py:1", "shortDescription": {"text": "FastAPI POST `submit_lead` without auth dependency \u2014 submit_lead_block.py:1"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953ec1a0ee6df50d", "name": "Unused endpoint: GET /admin", "shortDescription": {"text": "Unused endpoint: GET /admin"}, "fullDescription": {"text": "`app.py` declares `GET /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88545e2548cfb265", "name": "Unused endpoint: GET /widget-chat", "shortDescription": {"text": "Unused endpoint: GET /widget-chat"}, "fullDescription": {"text": "`app.py` declares `GET /widget-chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85c21657e0ff1b99", "name": "Unused endpoint: GET /widget.js", "shortDescription": {"text": "Unused endpoint: GET /widget.js"}, "fullDescription": {"text": "`app.py` declares `GET /widget.js` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff8da5fbc19c76d", "name": "Unused endpoint: POST /chat", "shortDescription": {"text": "Unused endpoint: POST /chat"}, "fullDescription": {"text": "`app.py` declares `POST /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b083e6246ca9f518", "name": "Unused endpoint: GET /admin/faqs", "shortDescription": {"text": "Unused endpoint: GET /admin/faqs"}, "fullDescription": {"text": "`app.py` declares `GET /admin/faqs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-887c43f79b5bbae2", "name": "Unused endpoint: POST /admin/faqs", "shortDescription": {"text": "Unused endpoint: POST /admin/faqs"}, "fullDescription": {"text": "`app.py` declares `POST /admin/faqs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-705fde3963e07e6a", "name": "Unused endpoint: DELETE /admin/faqs/{faq_id}", "shortDescription": {"text": "Unused endpoint: DELETE /admin/faqs/{faq_id}"}, "fullDescription": {"text": "`app.py` declares `DELETE /admin/faqs/{faq_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd91eba88d442a69", "name": "Unused endpoint: POST /debug/retrieve", "shortDescription": {"text": "Unused endpoint: POST /debug/retrieve"}, "fullDescription": {"text": "`app.py` declares `POST /debug/retrieve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70913de41f0398fd", "name": "Unused endpoint: POST /debug/has-source", "shortDescription": {"text": "Unused endpoint: POST /debug/has-source"}, "fullDescription": {"text": "`app.py` declares `POST /debug/has-source` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8353ace582925d8b", "name": "Unused endpoint: POST /admin/evals/generate", "shortDescription": {"text": "Unused endpoint: POST /admin/evals/generate"}, "fullDescription": {"text": "`app.py` declares `POST /admin/evals/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-237196ee2c4b6bee", "name": "Unused endpoint: GET /admin/evals/history", "shortDescription": {"text": "Unused endpoint: GET /admin/evals/history"}, "fullDescription": {"text": "`app.py` declares `GET /admin/evals/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dd50b2865111ce7", "name": "Unused endpoint: POST /admin/evals/run", "shortDescription": {"text": "Unused endpoint: POST /admin/evals/run"}, "fullDescription": {"text": "`app.py` declares `POST /admin/evals/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6f48e60c30777ab", "name": "Unused endpoint: GET /config", "shortDescription": {"text": "Unused endpoint: GET /config"}, "fullDescription": {"text": "`app.py` declares `GET /config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2535c4d09a28f6ab", "name": "Unused endpoint: GET /admin/csrf-token", "shortDescription": {"text": "Unused endpoint: GET /admin/csrf-token"}, "fullDescription": {"text": "`app.py` declares `GET /admin/csrf-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1499edd4121b40ce", "name": "Unused endpoint: GET /admin/auth-mode", "shortDescription": {"text": "Unused endpoint: GET /admin/auth-mode"}, "fullDescription": {"text": "`app.py` declares `GET /admin/auth-mode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618bafae653de6a1", "name": "Unused endpoint: GET /admin/branding", "shortDescription": {"text": "Unused endpoint: GET /admin/branding"}, "fullDescription": {"text": "`app.py` declares `GET /admin/branding` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a3d504c2f8ea2c4", "name": "Unused endpoint: POST /admin/ops", "shortDescription": {"text": "Unused endpoint: POST /admin/ops"}, "fullDescription": {"text": "`app.py` declares `POST /admin/ops` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-547a72c9c6964181", "name": "Unused endpoint: POST /admin/branding", "shortDescription": {"text": "Unused endpoint: POST /admin/branding"}, "fullDescription": {"text": "`app.py` declares `POST /admin/branding` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f93e56e6f2acf72", "name": "Unused endpoint: GET /admin/embedding-model", "shortDescription": {"text": "Unused endpoint: GET /admin/embedding-model"}, "fullDescription": {"text": "`app.py` declares `GET /admin/embedding-model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a2e6ebb3301ef6c", "name": "Unused endpoint: POST /admin/embedding-model", "shortDescription": {"text": "Unused endpoint: POST /admin/embedding-model"}, "fullDescription": {"text": "`app.py` declares `POST /admin/embedding-model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a7a40905f31ee1d", "name": "Unused endpoint: GET /admin/databases", "shortDescription": {"text": "Unused endpoint: GET /admin/databases"}, "fullDescription": {"text": "`app.py` declares `GET /admin/databases` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee56fa09e775e07e", "name": "Unused endpoint: POST /admin/databases/clear-data", "shortDescription": {"text": "Unused endpoint: POST /admin/databases/clear-data"}, "fullDescription": {"text": "`app.py` declares `POST /admin/databases/clear-data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f60c0759c378f0f4", "name": "Unused endpoint: POST /admin/sync-github", "shortDescription": {"text": "Unused endpoint: POST /admin/sync-github"}, "fullDescription": {"text": "`app.py` declares `POST /admin/sync-github` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f66f7df1700b637d", "name": "Unused endpoint: POST /admin/databases/set-active", "shortDescription": {"text": "Unused endpoint: POST /admin/databases/set-active"}, "fullDescription": {"text": "`app.py` declares `POST /admin/databases/set-active` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c47402370d5fcd16", "name": "Unused endpoint: POST /admin/databases/reload-active", "shortDescription": {"text": "Unused endpoint: POST /admin/databases/reload-active"}, "fullDescription": {"text": "`app.py` declares `POST /admin/databases/reload-active` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ad619c86e734762", "name": "Unused endpoint: POST /admin/create-db", "shortDescription": {"text": "Unused endpoint: POST /admin/create-db"}, "fullDescription": {"text": "`app.py` declares `POST /admin/create-db` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bfde744b382ea2e", "name": "Unused endpoint: POST /admin/delete-db", "shortDescription": {"text": "Unused endpoint: POST /admin/delete-db"}, "fullDescription": {"text": "`app.py` declares `POST /admin/delete-db` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e720cc1e373abbe", "name": "Unused endpoint: POST /admin/rename-db", "shortDescription": {"text": "Unused endpoint: POST /admin/rename-db"}, "fullDescription": {"text": "`app.py` declares `POST /admin/rename-db` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d39ad2c752743497", "name": "Unused endpoint: GET /admin/analytics", "shortDescription": {"text": "Unused endpoint: GET /admin/analytics"}, "fullDescription": {"text": "`app.py` declares `GET /admin/analytics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3efa39f16615421a", "name": "Unused endpoint: GET /admin/analytics-charts", "shortDescription": {"text": "Unused endpoint: GET /admin/analytics-charts"}, "fullDescription": {"text": "`app.py` declares `GET /admin/analytics-charts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2ee4b600b8eb336", "name": "Unused endpoint: GET /admin/test/identity", "shortDescription": {"text": "Unused endpoint: GET /admin/test/identity"}, "fullDescription": {"text": "`app.py` declares `GET /admin/test/identity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4ceb5517bb5fb88", "name": "Unused endpoint: GET /admin/test/knowledge", "shortDescription": {"text": "Unused endpoint: GET /admin/test/knowledge"}, "fullDescription": {"text": "`app.py` declares `GET /admin/test/knowledge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9196822875f21e5b", "name": "Unused endpoint: GET /admin/test/safety", "shortDescription": {"text": "Unused endpoint: GET /admin/test/safety"}, "fullDescription": {"text": "`app.py` declares `GET /admin/test/safety` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2f807f5899b11e9", "name": "Unused endpoint: GET /admin/test/live", "shortDescription": {"text": "Unused endpoint: GET /admin/test/live"}, "fullDescription": {"text": "`app.py` declares `GET /admin/test/live` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a33b955ba757b23", "name": "Unused endpoint: GET /admin/test/admin-check", "shortDescription": {"text": "Unused endpoint: GET /admin/test/admin-check"}, "fullDescription": {"text": "`app.py` declares `GET /admin/test/admin-check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1d3e4c5245f43a7", "name": "Unused endpoint: GET /admin/test-detailed", "shortDescription": {"text": "Unused endpoint: GET /admin/test-detailed"}, "fullDescription": {"text": "`app.py` declares `GET /admin/test-detailed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45f7a0457a71fa5a", "name": "Unused endpoint: POST /admin/ingest/smart-text", "shortDescription": {"text": "Unused endpoint: POST /admin/ingest/smart-text"}, "fullDescription": {"text": "`app.py` declares `POST /admin/ingest/smart-text` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f725abdb1f28ef46", "name": "Unused endpoint: POST /admin/ingest/fetch-url", "shortDescription": {"text": "Unused endpoint: POST /admin/ingest/fetch-url"}, "fullDescription": {"text": "`app.py` declares `POST /admin/ingest/fetch-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8aecfa9c8fba4f09", "name": "Unused endpoint: POST /admin/ingest/text", "shortDescription": {"text": "Unused endpoint: POST /admin/ingest/text"}, "fullDescription": {"text": "`app.py` declares `POST /admin/ingest/text` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40e9eff1ac6e7178", "name": "Unused endpoint: POST /admin/ingest/files", "shortDescription": {"text": "Unused endpoint: POST /admin/ingest/files"}, "fullDescription": {"text": "`app.py` declares `POST /admin/ingest/files` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fe032c5985a7778", "name": "Unused endpoint: GET /admin/embed-code", "shortDescription": {"text": "Unused endpoint: GET /admin/embed-code"}, "fullDescription": {"text": "`app.py` declares `GET /admin/embed-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0644b133fe50493e", "name": "Unused endpoint: GET /admin/widget-key-status", "shortDescription": {"text": "Unused endpoint: GET /admin/widget-key-status"}, "fullDescription": {"text": "`app.py` declares `GET /admin/widget-key-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b01d48b355744e5", "name": "Unused endpoint: POST /admin/reindex", "shortDescription": {"text": "Unused endpoint: POST /admin/reindex"}, "fullDescription": {"text": "`app.py` declares `POST /admin/reindex` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7477595b8935e37", "name": "Unused endpoint: POST /admin/reindex-from-artifacts", "shortDescription": {"text": "Unused endpoint: POST /admin/reindex-from-artifacts"}, "fullDescription": {"text": "`app.py` declares `POST /admin/reindex-from-artifacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e553ec4c42845bca", "name": "Unused endpoint: GET /admin/artifacts-status", "shortDescription": {"text": "Unused endpoint: GET /admin/artifacts-status"}, "fullDescription": {"text": "`app.py` declares `GET /admin/artifacts-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44bbc3f7bc8b04a3", "name": "Unused endpoint: POST /admin/crawl-inspect", "shortDescription": {"text": "Unused endpoint: POST /admin/crawl-inspect"}, "fullDescription": {"text": "`app.py` declares `POST /admin/crawl-inspect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-856a0e0e1ae193ac", "name": "Unused endpoint: GET /admin/db-stats", "shortDescription": {"text": "Unused endpoint: GET /admin/db-stats"}, "fullDescription": {"text": "`app.py` declares `GET /admin/db-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a1e165c6aff44dd", "name": "Unused endpoint: GET /admin/db-preview", "shortDescription": {"text": "Unused endpoint: GET /admin/db-preview"}, "fullDescription": {"text": "`app.py` declares `GET /admin/db-preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6266bf8be53cbd5e", "name": "Unused endpoint: POST /admin/crawl-schedule", "shortDescription": {"text": "Unused endpoint: POST /admin/crawl-schedule"}, "fullDescription": {"text": "`app.py` declares `POST /admin/crawl-schedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17917"}, "properties": {"repository": "RE-coder376/AI-Chatbot", "repoUrl": "https://github.com/RE-coder376/AI-Chatbot", "branch": "main"}, "results": [{"ruleId": "scanner-f733215110aae5e7", "level": "note", "message": {"text": "Possibly dead Python function: check_category_helpers"}, "properties": {"repobilityId": "a9368569bb14ee49", "scanner": "scanner-primary", "fingerprint": "f733215110aae5e7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline_check.py:197"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97285a88d0ceec85", "level": "note", "message": {"text": "Possibly dead Python function: check_boilerplate_filter"}, "properties": {"repobilityId": "e0f9495a9dc3f539", "scanner": "scanner-primary", "fingerprint": "97285a88d0ceec85", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline_check.py:222"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a14242510403028c", "level": "note", "message": {"text": "Possibly dead Python function: check_title_authority"}, "properties": {"repobilityId": "3f8255da0e7815d9", "scanner": "scanner-primary", "fingerprint": "a14242510403028c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline_check.py:265"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cd8753896252913", "level": "note", "message": {"text": "Possibly dead Python function: emit"}, "properties": {"repobilityId": "fecc700ec874b669", "scanner": "scanner-primary", "fingerprint": "9cd8753896252913", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "modal_app.py:113"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8fece9db4bb5eda", "level": "note", "message": {"text": "Possibly dead Python function: log_interaction"}, "properties": {"repobilityId": "8033ef8c2ecb30ce", "scanner": "scanner-primary", "fingerprint": "f8fece9db4bb5eda", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py:1318"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5e8a84752befa3d", "level": "note", "message": {"text": "Possibly dead Python function: log_knowledge_gap"}, "properties": {"repobilityId": "d1fe442ed2ffca7e", "scanner": "scanner-primary", "fingerprint": "a5e8a84752befa3d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py:1358"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4da8193d79a1bd39", "level": "note", "message": {"text": "Possibly dead Python function: save_visitor_turn"}, "properties": {"repobilityId": "4f2581033bd7eacf", "scanner": "scanner-primary", "fingerprint": "4da8193d79a1bd39", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py:1373"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4ab6b2b17954e237", "level": "note", "message": {"text": "Possibly dead Python function: embed_documents"}, "properties": {"repobilityId": "5cc0f99252928d83", "scanner": "scanner-primary", "fingerprint": "4ab6b2b17954e237", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py:12745"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbc238b70db8bbf6", "level": "note", "message": {"text": "Possibly dead Python function: embed_query"}, "properties": {"repobilityId": "acc8e0dd5efae9cc", "scanner": "scanner-primary", "fingerprint": "fbc238b70db8bbf6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py:12746"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e46a8332a8c6310", "level": "note", "message": {"text": "Possibly dead Python function: answer_catalog_query"}, "properties": {"repobilityId": "9f037db4b195cbee", "scanner": "scanner-primary", "fingerprint": "5e46a8332a8c6310", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/catalog_query.py:320"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f11fa2b53e8ccb14", "level": "note", "message": {"text": "Possibly dead Python function: key_health_score"}, "properties": {"repobilityId": "30047f1625a4359a", "scanner": "scanner-primary", "fingerprint": "f11fa2b53e8ccb14", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/llm_keys.py:262"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59868562782cd0f8", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "59868562782cd0f8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "f391052c9bfd7e8b", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b40ada84dc3fa877", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in README.md:31"}, "properties": {"repobilityId": "5388562008acceec", "scanner": "scanner-primary", "fingerprint": "b40ada84dc3fa877", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-96710b2890508379", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in app.py:2963"}, "properties": {"repobilityId": "a4402f0f4770da42", "scanner": "scanner-primary", "fingerprint": "96710b2890508379", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 2963}}}]}, {"ruleId": "scanner-bd94c52d3737f773", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in chat.html:317"}, "properties": {"repobilityId": "a41e9122bbd353ec", "scanner": "scanner-primary", "fingerprint": "bd94c52d3737f773", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "chat.html"}, "region": {"startLine": 317}}}]}, {"ruleId": "scanner-3c0dbf5b44f1cc76", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in chat.html:300"}, "properties": {"repobilityId": "95a3f24a30fcae79", "scanner": "scanner-primary", "fingerprint": "3c0dbf5b44f1cc76", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "chat.html"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-30af2b5ecf3e7e17", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin.html:926"}, "properties": {"repobilityId": "6ce12d2fb0d90b99", "scanner": "scanner-primary", "fingerprint": "30af2b5ecf3e7e17", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin.html"}, "region": {"startLine": 926}}}]}, {"ruleId": "scanner-8a41b3190f07e897", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in admin.html:986"}, "properties": {"repobilityId": "5d98fd28ca8f6ef4", "scanner": "scanner-primary", "fingerprint": "8a41b3190f07e897", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin.html"}, "region": {"startLine": 986}}}]}, {"ruleId": "scanner-1a0aa13edcbf8318", "level": "error", "message": {"text": "Possible secret in watchdog.py"}, "properties": {"repobilityId": "1329d336e151bc8b", "scanner": "scanner-primary", "fingerprint": "1a0aa13edcbf8318", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-a64689d19b9eb8ee", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in widget.js:99"}, "properties": {"repobilityId": "8134ed963c042a3e", "scanner": "scanner-primary", "fingerprint": "a64689d19b9eb8ee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "widget.js"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-df9a0730e6168d21", "level": "error", "message": {"text": "Possible secret in jikan_ingest.py"}, "properties": {"repobilityId": "a66b7928fd80142f", "scanner": "scanner-primary", "fingerprint": "df9a0730e6168d21", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "jikan_ingest.py"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-4ee66b7f0c9ab4e3", "level": "error", "message": {"text": "Possible secret in sequential_crawl.py"}, "properties": {"repobilityId": "d8f3f7e81df9b491", "scanner": "scanner-primary", "fingerprint": "4ee66b7f0c9ab4e3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sequential_crawl.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-13a1c647c3156eee", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in widget_chat.html:286"}, "properties": {"repobilityId": "86a0ac26e8737ad4", "scanner": "scanner-primary", "fingerprint": "13a1c647c3156eee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "widget_chat.html"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-2a8087883c138d70", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in widget_chat.html:223"}, "properties": {"repobilityId": "62ebe5b7097a8012", "scanner": "scanner-primary", "fingerprint": "2a8087883c138d70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "widget_chat.html"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-1a50467f36b413ec", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "926b5aa2fc342af4", "scanner": "scanner-primary", "fingerprint": "1a50467f36b413ec", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-136da25d70c346a1", "level": "note", "message": {"text": "Very large file: brutal_test.py (1112 lines)"}, "properties": {"repobilityId": "52c9d0a8659127b6", "scanner": "scanner-primary", "fingerprint": "136da25d70c346a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-23cfb73a64f811ff", "level": "note", "message": {"text": "Very large file: app.py (14163 lines)"}, "properties": {"repobilityId": "5a74e6652f3a10d4", "scanner": "scanner-primary", "fingerprint": "23cfb73a64f811ff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-278cc5d84961426a", "level": "note", "message": {"text": "Very large file: services/retrieval.py (3990 lines)"}, "properties": {"repobilityId": "3c24aaf5c79231a9", "scanner": "scanner-primary", "fingerprint": "278cc5d84961426a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e80ceb06b4888c6a", "level": "note", "message": {"text": "Very large file: services/crawler_utils.py (1838 lines)"}, "properties": {"repobilityId": "2df00eb6d927a29c", "scanner": "scanner-primary", "fingerprint": "e80ceb06b4888c6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d7b596c29706897d", "level": "note", "message": {"text": "Very large file: evals/eval_v1.py (1863 lines)"}, "properties": {"repobilityId": "ddbe350790837460", "scanner": "scanner-primary", "fingerprint": "d7b596c29706897d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "f33c34a39db305df", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "680b5ab14decff21", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "0a3d37f490c44f60", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4ecabb54fb8af8ce", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "30d0726476da6661", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "eed873c7ff943a4b", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-dcb57ad95f1b260c", "level": "note", "message": {"text": "Legacy-named symbol `agentfactory_minilm_backup` in reindex_multilingual.py:10"}, "properties": {"repobilityId": "74c3b657acbd463a", "scanner": "scanner-primary", "fingerprint": "dcb57ad95f1b260c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b8bef8da077d4aa5", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 reindex_multilingual.py:112"}, "properties": {"repobilityId": "f547480b07212ae4", "scanner": "scanner-primary", "fingerprint": "b8bef8da077d4aa5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a4f4156be6a56b27", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline_check.py:19"}, "properties": {"repobilityId": "7262c1b1982db028", "scanner": "scanner-primary", "fingerprint": "a4f4156be6a56b27", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-20222162752d721a", "level": "note", "message": {"text": "Legacy-named symbol `eval_v1` in modal_app.py:44"}, "properties": {"repobilityId": "1833b590b3ae128d", "scanner": "scanner-primary", "fingerprint": "20222162752d721a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-acc5c44d27aea74d", "level": "note", "message": {"text": "Legacy-named symbol `eval_v1` in app.py:8597"}, "properties": {"repobilityId": "43b64e464f7fdf24", "scanner": "scanner-primary", "fingerprint": "acc5c44d27aea74d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e007830db168a509", "level": "none", "message": {"text": "Commented-code block (5 lines) in app.py:298"}, "properties": {"repobilityId": "7e0585a660889861", "scanner": "scanner-primary", "fingerprint": "e007830db168a509", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-55024926ffee0c25", "level": "error", "message": {"text": "Blocking `urllib.request.urlopen(...)` inside `async def ingest_fetch_url` \u2014 app.py:10736"}, "properties": {"repobilityId": "670f3dd77dcebddd", "scanner": "scanner-primary", "fingerprint": "55024926ffee0c25", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 10736}}}]}, {"ruleId": "scanner-ac9222b15b3bc7ad", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 orchestrate_and_test.py:27"}, "properties": {"repobilityId": "81db8f1a05f75916", "scanner": "scanner-primary", "fingerprint": "ac9222b15b3bc7ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-708d283b0976b2b7", "level": "none", "message": {"text": "Commented-code block (6 lines) in offline_logic_test.py:8"}, "properties": {"repobilityId": "252768cd7cb56ac9", "scanner": "scanner-primary", "fingerprint": "708d283b0976b2b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7cc04bd1e330b821", "level": "note", "message": {"text": "Legacy-named symbol `ready_legacy` in watchdog.py:59"}, "properties": {"repobilityId": "b5bebe7fe175664f", "scanner": "scanner-primary", "fingerprint": "7cc04bd1e330b821", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b36d181d5b5a6b9f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 jikan_ingest.py:8"}, "properties": {"repobilityId": "0fd2f5a9766f51e0", "scanner": "scanner-primary", "fingerprint": "b36d181d5b5a6b9f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-381fd099070706aa", "level": "note", "message": {"text": "Legacy-named symbol `eval_v1` in tests/test_eval_v1.py:4"}, "properties": {"repobilityId": "c104555b2d7a592c", "scanner": "scanner-primary", "fingerprint": "381fd099070706aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6c4264b18a770f6d", "level": "note", "message": {"text": "Legacy-named symbol `eval_v1` in tests/test_security_basics.py:5"}, "properties": {"repobilityId": "b4223d120df2e5df", "scanner": "scanner-primary", "fingerprint": "6c4264b18a770f6d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7c16e5447bc54d83", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/retrieval.py:1244"}, "properties": {"repobilityId": "03ef55a56e588bf9", "scanner": "scanner-primary", "fingerprint": "7c16e5447bc54d83", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f5873ce993492e4", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/page_extract.py:125"}, "properties": {"repobilityId": "5709fbf86b22644e", "scanner": "scanner-primary", "fingerprint": "8f5873ce993492e4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-377e65e1227fadb0", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/crawler_utils.py:63"}, "properties": {"repobilityId": "725d753875284534", "scanner": "scanner-primary", "fingerprint": "377e65e1227fadb0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-976dbd474520921a", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/catalog_query.py:271"}, "properties": {"repobilityId": "9ce4614bad592f26", "scanner": "scanner-primary", "fingerprint": "976dbd474520921a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa2ee34904ddc6e1", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/legacy_answerers.py:376"}, "properties": {"repobilityId": "adf6eeea9dd18dea", "scanner": "scanner-primary", "fingerprint": "fa2ee34904ddc6e1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-615b2de1668d370c", "level": "note", "message": {"text": "Legacy-named symbol `minilm_old` in services/db_instances.py:142"}, "properties": {"repobilityId": "518485b8c4eece92", "scanner": "scanner-primary", "fingerprint": "615b2de1668d370c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-83f2f418d56d1e66", "level": "none", "message": {"text": "Commented-code block (6 lines) in services/safety.py:296"}, "properties": {"repobilityId": "161b99ba28671ac6", "scanner": "scanner-primary", "fingerprint": "83f2f418d56d1e66", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-55a76dd15cbe8344", "level": "note", "message": {"text": "Legacy-named symbol `eval_v1` in evals/lite_eval.py:5"}, "properties": {"repobilityId": "460d3bf5ff00a997", "scanner": "scanner-primary", "fingerprint": "55a76dd15cbe8344", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cb07f51555cf381f", "level": "note", "message": {"text": "Legacy-named symbol `eval_v1` in evals/eval_v1.py:19"}, "properties": {"repobilityId": "8d410a889121a8ce", "scanner": "scanner-primary", "fingerprint": "cb07f51555cf381f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7c8b918e1fee9558", "level": "note", "message": {"text": "20 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd1f6d44917e8105", "scanner": "scanner-primary", "fingerprint": "7c8b918e1fee9558", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "53e868e5a17d5157", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "352eec21ad1934eb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "273b3dadee820ecc", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5b7a5fcde27acc0d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6546e08a34ffafea", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "525c8d4f41a18d99", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "519dc4cfbd10a3c9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "163747bd033ba985", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fdf3baae474e5a51", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ed042a110e4a336d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6dba80d44b3f5a2d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "939ccb6bb8cc5aee", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1880bfccc0348e91", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "23836334c93835f4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-c9cb05e489852bad", "level": "error", "message": {"text": "FastAPI POST `submit_lead` without auth dependency \u2014 submit_lead_block.py:1"}, "properties": {"repobilityId": "764201b6f9bf7764", "scanner": "scanner-primary", "fingerprint": "c9cb05e489852bad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "submit_lead_block.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "49cf5d64a7f531bc", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-953ec1a0ee6df50d", "level": "note", "message": {"text": "Unused endpoint: GET /admin"}, "properties": {"repobilityId": "aec9ae45abf4820a", "scanner": "scanner-primary", "fingerprint": "953ec1a0ee6df50d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-88545e2548cfb265", "level": "note", "message": {"text": "Unused endpoint: GET /widget-chat"}, "properties": {"repobilityId": "6ed5c495c69306ef", "scanner": "scanner-primary", "fingerprint": "88545e2548cfb265", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85c21657e0ff1b99", "level": "note", "message": {"text": "Unused endpoint: GET /widget.js"}, "properties": {"repobilityId": "4d9ec0219a0c6776", "scanner": "scanner-primary", "fingerprint": "85c21657e0ff1b99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cff8da5fbc19c76d", "level": "note", "message": {"text": "Unused endpoint: POST /chat"}, "properties": {"repobilityId": "1018a0b3a9444d1e", "scanner": "scanner-primary", "fingerprint": "cff8da5fbc19c76d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b083e6246ca9f518", "level": "note", "message": {"text": "Unused endpoint: GET /admin/faqs"}, "properties": {"repobilityId": "e33e932e79dfab7b", "scanner": "scanner-primary", "fingerprint": "b083e6246ca9f518", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-887c43f79b5bbae2", "level": "note", "message": {"text": "Unused endpoint: POST /admin/faqs"}, "properties": {"repobilityId": "4ab351cf917f85ed", "scanner": "scanner-primary", "fingerprint": "887c43f79b5bbae2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-705fde3963e07e6a", "level": "note", "message": {"text": "Unused endpoint: DELETE /admin/faqs/{faq_id}"}, "properties": {"repobilityId": "b755b28753ebeddf", "scanner": "scanner-primary", "fingerprint": "705fde3963e07e6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd91eba88d442a69", "level": "note", "message": {"text": "Unused endpoint: POST /debug/retrieve"}, "properties": {"repobilityId": "77b2e2cf5a2e7c2c", "scanner": "scanner-primary", "fingerprint": "bd91eba88d442a69", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-70913de41f0398fd", "level": "note", "message": {"text": "Unused endpoint: POST /debug/has-source"}, "properties": {"repobilityId": "453787c1df545860", "scanner": "scanner-primary", "fingerprint": "70913de41f0398fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8353ace582925d8b", "level": "note", "message": {"text": "Unused endpoint: POST /admin/evals/generate"}, "properties": {"repobilityId": "f5402ff8753f35ec", "scanner": "scanner-primary", "fingerprint": "8353ace582925d8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-237196ee2c4b6bee", "level": "note", "message": {"text": "Unused endpoint: GET /admin/evals/history"}, "properties": {"repobilityId": "d64b9f25a1d41472", "scanner": "scanner-primary", "fingerprint": "237196ee2c4b6bee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6dd50b2865111ce7", "level": "note", "message": {"text": "Unused endpoint: POST /admin/evals/run"}, "properties": {"repobilityId": "1220d3cb3ad1c568", "scanner": "scanner-primary", "fingerprint": "6dd50b2865111ce7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6f48e60c30777ab", "level": "note", "message": {"text": "Unused endpoint: GET /config"}, "properties": {"repobilityId": "181f39826dd8dfeb", "scanner": "scanner-primary", "fingerprint": "a6f48e60c30777ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2535c4d09a28f6ab", "level": "note", "message": {"text": "Unused endpoint: GET /admin/csrf-token"}, "properties": {"repobilityId": "295ff99e07b9a4c2", "scanner": "scanner-primary", "fingerprint": "2535c4d09a28f6ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1499edd4121b40ce", "level": "note", "message": {"text": "Unused endpoint: GET /admin/auth-mode"}, "properties": {"repobilityId": "03e5a6a14d62aa01", "scanner": "scanner-primary", "fingerprint": "1499edd4121b40ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618bafae653de6a1", "level": "note", "message": {"text": "Unused endpoint: GET /admin/branding"}, "properties": {"repobilityId": "efbbb690bf5cf224", "scanner": "scanner-primary", "fingerprint": "618bafae653de6a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8a3d504c2f8ea2c4", "level": "note", "message": {"text": "Unused endpoint: POST /admin/ops"}, "properties": {"repobilityId": "8171f6fa6fbb7732", "scanner": "scanner-primary", "fingerprint": "8a3d504c2f8ea2c4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-547a72c9c6964181", "level": "note", "message": {"text": "Unused endpoint: POST /admin/branding"}, "properties": {"repobilityId": "54dd6c89c4903b99", "scanner": "scanner-primary", "fingerprint": "547a72c9c6964181", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f93e56e6f2acf72", "level": "note", "message": {"text": "Unused endpoint: GET /admin/embedding-model"}, "properties": {"repobilityId": "7a6278537052a0ce", "scanner": "scanner-primary", "fingerprint": "4f93e56e6f2acf72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a2e6ebb3301ef6c", "level": "note", "message": {"text": "Unused endpoint: POST /admin/embedding-model"}, "properties": {"repobilityId": "c49b88c8de5296da", "scanner": "scanner-primary", "fingerprint": "4a2e6ebb3301ef6c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8a7a40905f31ee1d", "level": "note", "message": {"text": "Unused endpoint: GET /admin/databases"}, "properties": {"repobilityId": "27c175649c9fd1d9", "scanner": "scanner-primary", "fingerprint": "8a7a40905f31ee1d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee56fa09e775e07e", "level": "note", "message": {"text": "Unused endpoint: POST /admin/databases/clear-data"}, "properties": {"repobilityId": "3f1678cdd44cdb25", "scanner": "scanner-primary", "fingerprint": "ee56fa09e775e07e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f60c0759c378f0f4", "level": "note", "message": {"text": "Unused endpoint: POST /admin/sync-github"}, "properties": {"repobilityId": "d81c4fd5c1b25293", "scanner": "scanner-primary", "fingerprint": "f60c0759c378f0f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f66f7df1700b637d", "level": "note", "message": {"text": "Unused endpoint: POST /admin/databases/set-active"}, "properties": {"repobilityId": "c2e1801770c5d0f1", "scanner": "scanner-primary", "fingerprint": "f66f7df1700b637d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c47402370d5fcd16", "level": "note", "message": {"text": "Unused endpoint: POST /admin/databases/reload-active"}, "properties": {"repobilityId": "a2678a9c948af42f", "scanner": "scanner-primary", "fingerprint": "c47402370d5fcd16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0ad619c86e734762", "level": "note", "message": {"text": "Unused endpoint: POST /admin/create-db"}, "properties": {"repobilityId": "2f7c29bbfdf8f13f", "scanner": "scanner-primary", "fingerprint": "0ad619c86e734762", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3bfde744b382ea2e", "level": "note", "message": {"text": "Unused endpoint: POST /admin/delete-db"}, "properties": {"repobilityId": "bdfe238a814f60e0", "scanner": "scanner-primary", "fingerprint": "3bfde744b382ea2e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e720cc1e373abbe", "level": "note", "message": {"text": "Unused endpoint: POST /admin/rename-db"}, "properties": {"repobilityId": "f47943afaf9c4db1", "scanner": "scanner-primary", "fingerprint": "5e720cc1e373abbe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d39ad2c752743497", "level": "note", "message": {"text": "Unused endpoint: GET /admin/analytics"}, "properties": {"repobilityId": "6d84e355bcb7fae2", "scanner": "scanner-primary", "fingerprint": "d39ad2c752743497", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3efa39f16615421a", "level": "note", "message": {"text": "Unused endpoint: GET /admin/analytics-charts"}, "properties": {"repobilityId": "5afd578efaad13a1", "scanner": "scanner-primary", "fingerprint": "3efa39f16615421a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2ee4b600b8eb336", "level": "note", "message": {"text": "Unused endpoint: GET /admin/test/identity"}, "properties": {"repobilityId": "f90afad0d48968de", "scanner": "scanner-primary", "fingerprint": "e2ee4b600b8eb336", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4ceb5517bb5fb88", "level": "note", "message": {"text": "Unused endpoint: GET /admin/test/knowledge"}, "properties": {"repobilityId": "9383bbafd45f2e12", "scanner": "scanner-primary", "fingerprint": "a4ceb5517bb5fb88", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9196822875f21e5b", "level": "note", "message": {"text": "Unused endpoint: GET /admin/test/safety"}, "properties": {"repobilityId": "fbf5db310c392112", "scanner": "scanner-primary", "fingerprint": "9196822875f21e5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c2f807f5899b11e9", "level": "note", "message": {"text": "Unused endpoint: GET /admin/test/live"}, "properties": {"repobilityId": "35d8916c5db6d7fe", "scanner": "scanner-primary", "fingerprint": "c2f807f5899b11e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a33b955ba757b23", "level": "note", "message": {"text": "Unused endpoint: GET /admin/test/admin-check"}, "properties": {"repobilityId": "c41882efa5688e73", "scanner": "scanner-primary", "fingerprint": "9a33b955ba757b23", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1d3e4c5245f43a7", "level": "note", "message": {"text": "Unused endpoint: GET /admin/test-detailed"}, "properties": {"repobilityId": "89ccb9a0d0365e18", "scanner": "scanner-primary", "fingerprint": "f1d3e4c5245f43a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45f7a0457a71fa5a", "level": "note", "message": {"text": "Unused endpoint: POST /admin/ingest/smart-text"}, "properties": {"repobilityId": "c1db70a64c4ace42", "scanner": "scanner-primary", "fingerprint": "45f7a0457a71fa5a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f725abdb1f28ef46", "level": "note", "message": {"text": "Unused endpoint: POST /admin/ingest/fetch-url"}, "properties": {"repobilityId": "c88b4c96f5babced", "scanner": "scanner-primary", "fingerprint": "f725abdb1f28ef46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8aecfa9c8fba4f09", "level": "note", "message": {"text": "Unused endpoint: POST /admin/ingest/text"}, "properties": {"repobilityId": "d41f130f69a5b850", "scanner": "scanner-primary", "fingerprint": "8aecfa9c8fba4f09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40e9eff1ac6e7178", "level": "note", "message": {"text": "Unused endpoint: POST /admin/ingest/files"}, "properties": {"repobilityId": "b3d57e0f8972531c", "scanner": "scanner-primary", "fingerprint": "40e9eff1ac6e7178", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3fe032c5985a7778", "level": "note", "message": {"text": "Unused endpoint: GET /admin/embed-code"}, "properties": {"repobilityId": "955808a722966baa", "scanner": "scanner-primary", "fingerprint": "3fe032c5985a7778", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0644b133fe50493e", "level": "note", "message": {"text": "Unused endpoint: GET /admin/widget-key-status"}, "properties": {"repobilityId": "fad86f7c8612fc4b", "scanner": "scanner-primary", "fingerprint": "0644b133fe50493e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b01d48b355744e5", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reindex"}, "properties": {"repobilityId": "0923f608af118d87", "scanner": "scanner-primary", "fingerprint": "3b01d48b355744e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a7477595b8935e37", "level": "note", "message": {"text": "Unused endpoint: POST /admin/reindex-from-artifacts"}, "properties": {"repobilityId": "c51523ea4f288b9a", "scanner": "scanner-primary", "fingerprint": "a7477595b8935e37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e553ec4c42845bca", "level": "note", "message": {"text": "Unused endpoint: GET /admin/artifacts-status"}, "properties": {"repobilityId": "784975129592f9fd", "scanner": "scanner-primary", "fingerprint": "e553ec4c42845bca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44bbc3f7bc8b04a3", "level": "note", "message": {"text": "Unused endpoint: POST /admin/crawl-inspect"}, "properties": {"repobilityId": "229561a8dae7acd0", "scanner": "scanner-primary", "fingerprint": "44bbc3f7bc8b04a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-856a0e0e1ae193ac", "level": "note", "message": {"text": "Unused endpoint: GET /admin/db-stats"}, "properties": {"repobilityId": "4f7272a4583b7d8f", "scanner": "scanner-primary", "fingerprint": "856a0e0e1ae193ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a1e165c6aff44dd", "level": "note", "message": {"text": "Unused endpoint: GET /admin/db-preview"}, "properties": {"repobilityId": "b1dd2e06e36cd16a", "scanner": "scanner-primary", "fingerprint": "1a1e165c6aff44dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6266bf8be53cbd5e", "level": "note", "message": {"text": "Unused endpoint: POST /admin/crawl-schedule"}, "properties": {"repobilityId": "5954bdd0b26d38d3", "scanner": "scanner-primary", "fingerprint": "6266bf8be53cbd5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}