{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-47a3cb1320d3eac0", "name": "Possibly dead Python function: cb", "shortDescription": {"text": "Possibly dead Python function: cb"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-199d89e891c10858", "name": "Possibly dead Python function: cmd_extrude", "shortDescription": {"text": "Possibly dead Python function: cmd_extrude"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d50aa2b1ea12706d", "name": "Possibly dead Python function: cmd_relief", "shortDescription": {"text": "Possibly dead Python function: cmd_relief"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-848f9a792c1dfcbe", "name": "Possibly dead Python function: cmd_convert", "shortDescription": {"text": "Possibly dead Python function: cmd_convert"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66840a706f9dcb22", "name": "Stray `console.log` in TS/JS \u2014 main.js:201", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 main.js:201"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9e5c8219920423a", "name": "Stray `console.log` in TS/JS \u2014 scripts/ws.js:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/ws.js:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec3bdc8ce3c2cdaf", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-icons.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-icons.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99ee8a3d66b967a0", "name": "Stray `console.log` in TS/JS \u2014 scripts/resume.js:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/resume.js:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f62a64cb17f7bdd9", "name": "Stray `console.log` in TS/JS \u2014 scripts/orchestrate.js:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/orchestrate.js:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a0fbc98abd7a604", "name": "Stray `console.log` in TS/JS \u2014 scripts/spotify-auth.js:61", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/spotify-auth.js:61"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a745a568db7b2c0c", "name": "Stray `console.log` in TS/JS \u2014 scripts/test-pass39.js:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/test-pass39.js:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12e412a8e823c1ab", "name": "Stray `console.log` in TS/JS \u2014 scripts/notion-setup.js:114", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/notion-setup.js:114"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a4e704862527028", "name": "Stray `console.log` in TS/JS \u2014 cloud/server.js:196", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 cloud/server.js:196"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41800fc5e78cb662", "name": "Stray `console.log` in TS/JS \u2014 lib/adapters.js:103", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/adapters.js:103"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-298edf10c28e3fb4", "name": "Dockerfile runs as root: cloud/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: cloud/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-372516db41c9cbec", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-551be3a7ec25c5e7", "name": "Insecure pattern 'cors_wildcard' in mcp-server.js:46", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in mcp-server.js:46"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbc7070b48962913", "name": "Possible secret in main.js", "shortDescription": {"text": "Possible secret in main.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-864ba0bada0d71f0", "name": "Insecure pattern 'exec_used' in main.js:1637", "shortDescription": {"text": "Insecure pattern 'exec_used' in main.js:1637"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-645e3e2013531cf3", "name": "Insecure pattern 'node_child_process' in main.js:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in main.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edfe17252df8a6a3", "name": "Insecure pattern 'exec_used' in scripts/spotify-auth.js:76", "shortDescription": {"text": "Insecure pattern 'exec_used' in scripts/spotify-auth.js:76"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6520eb75dfa84a8", "name": "Insecure pattern 'node_child_process' in scripts/spotify-auth.js:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/spotify-auth.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-458ee2260766d67d", "name": "Insecure pattern 'node_child_process' in scripts/test-pass39.js:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/test-pass39.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2126a96c56de3964", "name": "Insecure pattern 'cors_wildcard' in cloud/server.js:119", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in cloud/server.js:119"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4d4234fde0d67ec", "name": "Insecure pattern 'exec_used' in lib/adapters.js:89", "shortDescription": {"text": "Insecure pattern 'exec_used' in lib/adapters.js:89"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2f6be049d2b7346", "name": "Insecure pattern 'node_child_process' in lib/adapters.js:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/adapters.js:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76f58f07315cc1fd", "name": "Insecure pattern 'node_child_process' in lib/figures.js:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/figures.js:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94cb2f3b984b61e7", "name": "Insecure pattern 'direct_innerhtml_assignment' in phone-app/Web/mobile.html:273", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in phone-app/Web/mobile.html:273"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f0b684d07429a79", "name": "Insecure pattern 'local_storage_auth_token' in phone-app/Web/mobile.html:393", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in phone-app/Web/mobile.html:393"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db8f48442c37c5cf", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/mobile.html:273", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/mobile.html:273"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3de22206454bb02", "name": "Insecure pattern 'local_storage_auth_token' in src/mobile.html:393", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in src/mobile.html:393"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55c562ac28636fa6", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/terminal.html:26", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/terminal.html:26"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ac5184941dc3aa9", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/index.html:548", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/index.html:548"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3d29c4e176ac1e1", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/activity.html:136", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/activity.html:136"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0c5ac9927c344f7", "name": "Very large file: main.js (4839 lines)", "shortDescription": {"text": "Very large file: main.js (4839 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 41 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 80 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-47bcc463771cd79a", "name": "Commented-code block (5 lines) in mcp-server.js:2", "shortDescription": {"text": "Commented-code block (5 lines) in mcp-server.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be99611043846e02", "name": "Commented-code block (7 lines) in main.js:96", "shortDescription": {"text": "Commented-code block (7 lines) in main.js:96"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0eb0fd062659d68", "name": "`fetch()` without try/.catch or AbortSignal \u2014 main.js:814", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 main.js:814"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9088f6bb7119993", "name": "Commented-code block (5 lines) in scripts/ws.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/ws.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4a117282e250c5b6", "name": "Commented-code block (5 lines) in scripts/spotify-auth.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/spotify-auth.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d963ec0592801d00", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/spotify-auth.js:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/spotify-auth.js:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da3e5f7c7ac049d1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/test-pass39.js:195", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/test-pass39.js:195"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-147fecd73be91fce", "name": "Commented-code block (5 lines) in cloud/server.js:2", "shortDescription": {"text": "Commented-code block (5 lines) in cloud/server.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bb795d37cfc99d37", "name": "`fetch()` without try/.catch or AbortSignal \u2014 cloud/server.js:83", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 cloud/server.js:83"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9498f4731f357f7e", "name": "Commented-code block (5 lines) in lib/logins.js:2", "shortDescription": {"text": "Commented-code block (5 lines) in lib/logins.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6550f508bdbc0e2b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 lib/adapters.js:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/adapters.js:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6b33916c38fcc03", "name": "Commented-code block (5 lines) in lib/memory.js:2", "shortDescription": {"text": "Commented-code block (5 lines) in lib/memory.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cfe49d86bb92fa23", "name": "Commented-code block (6 lines) in lib/prompts.js:2", "shortDescription": {"text": "Commented-code block (6 lines) in lib/prompts.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c94635508f9280d", "name": "Commented-code block (5 lines) in lib/security.js:2", "shortDescription": {"text": "Commented-code block (5 lines) in lib/security.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-069899c5d21ce5a4", "name": "Commented-code block (8 lines) in lib/notion.js:2", "shortDescription": {"text": "Commented-code block (8 lines) in lib/notion.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-edaa04c0c52bc647", "name": "Commented-code block (7 lines) in lib/figures.js:2", "shortDescription": {"text": "Commented-code block (7 lines) in lib/figures.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ce780ef487ff0e4", "name": "Commented-code block (6 lines) in lib/jobs.js:2", "shortDescription": {"text": "Commented-code block (6 lines) in lib/jobs.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d8a17287bf658d33", "name": "`fetch()` without try/.catch or AbortSignal \u2014 lib/integrations/trellis.js:21", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/integrations/trellis.js:21"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db8c431b04e7f667", "name": "Commented-code block (6 lines) in lib/agents/exec.js:2", "shortDescription": {"text": "Commented-code block (6 lines) in lib/agents/exec.js:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1063e9456b2e21b7", "name": "Commented-code block (8 lines) in lib/agents/orchestrator.js:38", "shortDescription": {"text": "Commented-code block (8 lines) in lib/agents/orchestrator.js:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0b5e7cb1208a7cd", "name": "13 env vars used in code but missing from .env.example", "shortDescription": {"text": "13 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `BHATBOT_BARGE`, `BHATBOT_BARGE_FRAMES`, `BHATBOT_BARGE_THRESH`, `BHATBOT_PROJECT`, `BHATBOT_VOSK_MODEL`, `BHATBOT_WAKE_DEBUG`, `BHATBOT_WAKE_ENGINES`, `BHATBOT_WAKE_THRESH` + 5 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ff4d137e5264939", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (main.js:829)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (main.js:829)"}, "fullDescription": {"text": "`main.js:829` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92b9480e3aa5ee7d", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (main.js:878)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (main.js:878)"}, "fullDescription": {"text": "`main.js:878` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-616128b5c354ad2d", "name": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (main.js:1035)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (main.js:1035)"}, "fullDescription": {"text": "`main.js:1035` calls `POST https://api.openai.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c6a3b7b65d67a2b", "name": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent (main.js:1046)", "shortDescription": {"text": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent (main.js:1046)"}, "fullDescription": {"text": "`main.js:1046` calls `POST https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/generativelanguage.googleapis.com/v1beta/models/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ddefa01ad6b08db", "name": "Dangling fetch: POST https://accounts.spotify.com/api/token (main.js:1188)", "shortDescription": {"text": "Dangling fetch: POST https://accounts.spotify.com/api/token (main.js:1188)"}, "fullDescription": {"text": "`main.js:1188` calls `POST https://accounts.spotify.com/api/token` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/accounts.spotify.com/api/token`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f42e1e2a5b23c3a0", "name": "Dangling fetch: GET https://api.spotify.com/v1/search?type=track&limit=1&q=${encodeURIComponent(query)} (main.js:1199)", "shortDescription": {"text": "Dangling fetch: GET https://api.spotify.com/v1/search?type=track&limit=1&q=${encodeURIComponent(query)} (main.js:1199)"}, "fullDescription": {"text": "`main.js:1199` calls `GET https://api.spotify.com/v1/search?type=track&limit=1&q=${encodeURIComponent(query)}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.spotify.com/v1/search`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38432b4b86c08b5e", "name": "Dangling fetch: POST https://accounts.spotify.com/api/token (main.js:1220)", "shortDescription": {"text": "Dangling fetch: POST https://accounts.spotify.com/api/token (main.js:1220)"}, "fullDescription": {"text": "`main.js:1220` calls `POST https://accounts.spotify.com/api/token` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/accounts.spotify.com/api/token`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-344bffc5d7845383", "name": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (main.js:2101)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (main.js:2101)"}, "fullDescription": {"text": "`main.js:2101` calls `POST https://api.openai.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e7385e8b24c4839e", "name": "Dangling fetch: GET https://api.replicate.com/v1/models/firtoz/trellis (main.js:2304)", "shortDescription": {"text": "Dangling fetch: GET https://api.replicate.com/v1/models/firtoz/trellis (main.js:2304)"}, "fullDescription": {"text": "`main.js:2304` calls `GET https://api.replicate.com/v1/models/firtoz/trellis` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.replicate.com/v1/models/firtoz/trellis`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab3d693b45ff99ce", "name": "Dangling fetch: POST https://api.replicate.com/v1/predictions (main.js:2321)", "shortDescription": {"text": "Dangling fetch: POST https://api.replicate.com/v1/predictions (main.js:2321)"}, "fullDescription": {"text": "`main.js:2321` calls `POST https://api.replicate.com/v1/predictions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.replicate.com/v1/predictions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c766d6da5696c77", "name": "Dangling fetch: POST https://api.openai.com/v1/images/generations (main.js:2625)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/images/generations (main.js:2625)"}, "fullDescription": {"text": "`main.js:2625` calls `POST https://api.openai.com/v1/images/generations` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/images/generations`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-42eb77617295484a", "name": "Dangling fetch: POST https://api.elevenlabs.io/v1/text-to-speech/${voiceId}?output_format=mp3_44100_128&optimize_streami", "shortDescription": {"text": "Dangling fetch: POST https://api.elevenlabs.io/v1/text-to-speech/${voiceId}?output_format=mp3_44100_128&optimize_streaming_latency=3 (main.js:4166)"}, "fullDescription": {"text": "`main.js:4166` calls `POST https://api.elevenlabs.io/v1/text-to-speech/${voiceId}?output_format=mp3_44100_128&optimize_streaming_latency=3` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.elevenlabs.io/v1/text-to-speech/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d51023f0dbf72b8c", "name": "Dangling fetch: POST https://api.openai.com/v1/audio/speech (main.js:4178)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/audio/speech (main.js:4178)"}, "fullDescription": {"text": "`main.js:4178` calls `POST https://api.openai.com/v1/audio/speech` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/audio/speech`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ce45e3ff65b6492", "name": "Dangling fetch: GET http://localhost:11434/api/tags (main.js:4721)", "shortDescription": {"text": "Dangling fetch: GET http://localhost:11434/api/tags (main.js:4721)"}, "fullDescription": {"text": "`main.js:4721` calls `GET http://localhost:11434/api/tags` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:11434/api/tags`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d7e193f1f4ae595", "name": "Dangling fetch: POST https://accounts.spotify.com/api/token (scripts/spotify-auth.js:37)", "shortDescription": {"text": "Dangling fetch: POST https://accounts.spotify.com/api/token (scripts/spotify-auth.js:37)"}, "fullDescription": {"text": "`scripts/spotify-auth.js:37` calls `POST https://accounts.spotify.com/api/token` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/accounts.spotify.com/api/token`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5014a236cceb27d5", "name": "Dangling fetch: POST http://localhost:11434/api/generate (scripts/test-pass39.js:55)", "shortDescription": {"text": "Dangling fetch: POST http://localhost:11434/api/generate (scripts/test-pass39.js:55)"}, "fullDescription": {"text": "`scripts/test-pass39.js:55` calls `POST http://localhost:11434/api/generate` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:11434/api/generate`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c947cf978ddc40dc", "name": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (scripts/test-pass39.js:66)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (scripts/test-pass39.js:66)"}, "fullDescription": {"text": "`scripts/test-pass39.js:66` calls `POST https://api.openai.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b34a449f8b95dbcf", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (scripts/test-pass39.js:76)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (scripts/test-pass39.js:76)"}, "fullDescription": {"text": "`scripts/test-pass39.js:76` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d88cbd47ec6ca96", "name": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent (scripts/t", "shortDescription": {"text": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent (scripts/test-pass39.js:87)"}, "fullDescription": {"text": "`scripts/test-pass39.js:87` calls `POST https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed56b177c3fd2156", "name": "Dangling fetch: POST https://api.openai.com/v1/audio/speech (scripts/test-pass39.js:131)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/audio/speech (scripts/test-pass39.js:131)"}, "fullDescription": {"text": "`scripts/test-pass39.js:131` calls `POST https://api.openai.com/v1/audio/speech` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/audio/speech`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73b30f0dbc4ef6c7", "name": "Dangling fetch: POST http://localhost:11434/api/chat (scripts/test-pass39.js:163)", "shortDescription": {"text": "Dangling fetch: POST http://localhost:11434/api/chat (scripts/test-pass39.js:163)"}, "fullDescription": {"text": "`scripts/test-pass39.js:163` calls `POST http://localhost:11434/api/chat` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:11434/api/chat`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-705dcf017a21d5d2", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (cloud/server.js:61)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (cloud/server.js:61)"}, "fullDescription": {"text": "`cloud/server.js:61` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91d52a6eae0cf356", "name": "Dangling fetch: POST https://api.elevenlabs.io/v1/text-to-speech/${EL_VOICE}?output_format=mp3_44100_128&optimize_stream", "shortDescription": {"text": "Dangling fetch: POST https://api.elevenlabs.io/v1/text-to-speech/${EL_VOICE}?output_format=mp3_44100_128&optimize_streaming_latency=3 (cloud/server.js:83)"}, "fullDescription": {"text": "`cloud/server.js:83` calls `POST https://api.elevenlabs.io/v1/text-to-speech/${EL_VOICE}?output_format=mp3_44100_128&optimize_streaming_latency=3` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.elevenlabs.io/v1/text-to-speech/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ddcf0d649854da9", "name": "Dangling fetch: POST https://api.openai.com/v1/audio/transcriptions (cloud/server.js:99)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/audio/transcriptions (cloud/server.js:99)"}, "fullDescription": {"text": "`cloud/server.js:99` calls `POST https://api.openai.com/v1/audio/transcriptions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/audio/transcriptions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25c5f44918ffd006", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (lib/adapters.js:32)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (lib/adapters.js:32)"}, "fullDescription": {"text": "`lib/adapters.js:32` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36fabc1f2af0cce2", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (lib/adapters.js:67)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (lib/adapters.js:67)"}, "fullDescription": {"text": "`lib/adapters.js:67` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21ad9dc1f677b4eb", "name": "Unused endpoint: POST /mcp/:token", "shortDescription": {"text": "Unused endpoint: POST /mcp/:token"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /mcp/:token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29143f50144caf3c", "name": "Unused endpoint: GET /mcp/:token", "shortDescription": {"text": "Unused endpoint: GET /mcp/:token"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /mcp/:token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-127848cf2ee43206", "name": "Unused endpoint: GET /app/:token", "shortDescription": {"text": "Unused endpoint: GET /app/:token"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /app/:token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-116dc677d271be65", "name": "Unused endpoint: GET /app/:token/version", "shortDescription": {"text": "Unused endpoint: GET /app/:token/version"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /app/:token/version` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27199affb45904da", "name": "Unused endpoint: GET /app/:token/manifest.webmanifest", "shortDescription": {"text": "Unused endpoint: GET /app/:token/manifest.webmanifest"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /app/:token/manifest.webmanifest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5aa2a494802602c", "name": "Unused endpoint: GET /app/:token/sw.js", "shortDescription": {"text": "Unused endpoint: GET /app/:token/sw.js"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /app/:token/sw.js` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3175afccbbb8723c", "name": "Unused endpoint: GET /app/:token/icon-192.png", "shortDescription": {"text": "Unused endpoint: GET /app/:token/icon-192.png"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /app/:token/icon-192.png` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac7c8fc84b708d73", "name": "Unused endpoint: GET /app/:token/icon-512.png", "shortDescription": {"text": "Unused endpoint: GET /app/:token/icon-512.png"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /app/:token/icon-512.png` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebaede49e4940580", "name": "Unused endpoint: POST /api/:token/chat", "shortDescription": {"text": "Unused endpoint: POST /api/:token/chat"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1dbff5f4eb9c4862", "name": "Unused endpoint: POST /api/:token/attach", "shortDescription": {"text": "Unused endpoint: POST /api/:token/attach"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/attach` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddf748f0b4e13c99", "name": "Unused endpoint: POST /api/:token/stt", "shortDescription": {"text": "Unused endpoint: POST /api/:token/stt"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/stt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af40ea3406618c24", "name": "Unused endpoint: POST /api/:token/tts", "shortDescription": {"text": "Unused endpoint: POST /api/:token/tts"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/tts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc78d4b51be624e2", "name": "Unused endpoint: POST /api/:token/summarize", "shortDescription": {"text": "Unused endpoint: POST /api/:token/summarize"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/summarize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7796943dd56daa79", "name": "Unused endpoint: GET /api/:token/activity", "shortDescription": {"text": "Unused endpoint: GET /api/:token/activity"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /api/:token/activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42b52b2588f6ef93", "name": "Unused endpoint: GET /api/:token/config", "shortDescription": {"text": "Unused endpoint: GET /api/:token/config"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /api/:token/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-152c4529142a3ea0", "name": "Unused endpoint: GET /api/:token/jobs", "shortDescription": {"text": "Unused endpoint: GET /api/:token/jobs"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /api/:token/jobs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08ac0b86b3889006", "name": "Unused endpoint: POST /api/:token/jobs/:id/cancel", "shortDescription": {"text": "Unused endpoint: POST /api/:token/jobs/:id/cancel"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/jobs/:id/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6d901a1e2fecbe6", "name": "Unused endpoint: POST /api/:token/jobs/:id/guide", "shortDescription": {"text": "Unused endpoint: POST /api/:token/jobs/:id/guide"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/jobs/:id/guide` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51cceab0cc9574cf", "name": "Unused endpoint: POST /api/:token/control", "shortDescription": {"text": "Unused endpoint: POST /api/:token/control"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /api/:token/control` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afe4d48ce8dd0900", "name": "Unused endpoint: GET /api/:token/screen", "shortDescription": {"text": "Unused endpoint: GET /api/:token/screen"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /api/:token/screen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9589bf14501d77e4", "name": "Unused endpoint: GET /voice/:token/clip/:id", "shortDescription": {"text": "Unused endpoint: GET /voice/:token/clip/:id"}, "fullDescription": {"text": "`mcp-server.js` declares `GET /voice/:token/clip/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c8eefd8ebb9b2a8", "name": "Unused endpoint: POST /voice/:token/incoming", "shortDescription": {"text": "Unused endpoint: POST /voice/:token/incoming"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /voice/:token/incoming` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebca112a3fdb60a7", "name": "Unused endpoint: POST /voice/:token/gather", "shortDescription": {"text": "Unused endpoint: POST /voice/:token/gather"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /voice/:token/gather` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f5ff67191cc2b46", "name": "Unused endpoint: POST /voice/:token/status", "shortDescription": {"text": "Unused endpoint: POST /voice/:token/status"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /voice/:token/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63732025c2dfc482", "name": "Unused endpoint: POST /sms/:token/incoming", "shortDescription": {"text": "Unused endpoint: POST /sms/:token/incoming"}, "fullDescription": {"text": "`mcp-server.js` declares `POST /sms/:token/incoming` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d31addfe491b04a", "name": "Unused endpoint: ALL /api/:token", "shortDescription": {"text": "Unused endpoint: ALL /api/:token"}, "fullDescription": {"text": "`cloud/server.js` declares `ALL /api/:token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19021"}, "properties": {"repository": "SBhat2026/BhatBot", "repoUrl": "https://github.com/SBhat2026/BhatBot", "branch": "main"}, "results": [{"ruleId": "scanner-47a3cb1320d3eac0", "level": "note", "message": {"text": "Possibly dead Python function: cb"}, "properties": {"repobilityId": "c388730a0badedf1", "scanner": "scanner-primary", "fingerprint": "47a3cb1320d3eac0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/listen.py:123"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-199d89e891c10858", "level": "note", "message": {"text": "Possibly dead Python function: cmd_extrude"}, "properties": {"repobilityId": "681b366d5ce56362", "scanner": "scanner-primary", "fingerprint": "199d89e891c10858", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mesh_tool.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d50aa2b1ea12706d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_relief"}, "properties": {"repobilityId": "2a73dfca898fea34", "scanner": "scanner-primary", "fingerprint": "d50aa2b1ea12706d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mesh_tool.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-848f9a792c1dfcbe", "level": "note", "message": {"text": "Possibly dead Python function: cmd_convert"}, "properties": {"repobilityId": "1d50e9baeb66423a", "scanner": "scanner-primary", "fingerprint": "848f9a792c1dfcbe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mesh_tool.py:228"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66840a706f9dcb22", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 main.js:201"}, "properties": {"repobilityId": "4a2f610e5e3afce9", "scanner": "scanner-primary", "fingerprint": "66840a706f9dcb22", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a9e5c8219920423a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/ws.js:16"}, "properties": {"repobilityId": "751cfad1b01b4875", "scanner": "scanner-primary", "fingerprint": "a9e5c8219920423a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ec3bdc8ce3c2cdaf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-icons.js:45"}, "properties": {"repobilityId": "08f2cedb020e0714", "scanner": "scanner-primary", "fingerprint": "ec3bdc8ce3c2cdaf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-99ee8a3d66b967a0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/resume.js:13"}, "properties": {"repobilityId": "8d93c4a89aa6f4b6", "scanner": "scanner-primary", "fingerprint": "99ee8a3d66b967a0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f62a64cb17f7bdd9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/orchestrate.js:17"}, "properties": {"repobilityId": "dd1a87a347065686", "scanner": "scanner-primary", "fingerprint": "f62a64cb17f7bdd9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6a0fbc98abd7a604", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/spotify-auth.js:61"}, "properties": {"repobilityId": "2981430af9b181b5", "scanner": "scanner-primary", "fingerprint": "6a0fbc98abd7a604", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a745a568db7b2c0c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/test-pass39.js:16"}, "properties": {"repobilityId": "69d0ab4f12a74732", "scanner": "scanner-primary", "fingerprint": "a745a568db7b2c0c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-12e412a8e823c1ab", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/notion-setup.js:114"}, "properties": {"repobilityId": "1a2e577124d3dc86", "scanner": "scanner-primary", "fingerprint": "12e412a8e823c1ab", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5a4e704862527028", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 cloud/server.js:196"}, "properties": {"repobilityId": "eeb1d31d931c2680", "scanner": "scanner-primary", "fingerprint": "5a4e704862527028", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-41800fc5e78cb662", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/adapters.js:103"}, "properties": {"repobilityId": "453f848d9a1abf77", "scanner": "scanner-primary", "fingerprint": "41800fc5e78cb662", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-298edf10c28e3fb4", "level": "warning", "message": {"text": "Dockerfile runs as root: cloud/Dockerfile"}, "properties": {"repobilityId": "4c7c22b9ecf95d3b", "scanner": "scanner-primary", "fingerprint": "298edf10c28e3fb4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-372516db41c9cbec", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "3074dd884ce54d03", "scanner": "scanner-primary", "fingerprint": "372516db41c9cbec", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-551be3a7ec25c5e7", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in mcp-server.js:46"}, "properties": {"repobilityId": "a0f257d1dd50a37a", "scanner": "scanner-primary", "fingerprint": "551be3a7ec25c5e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mcp-server.js"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-cbc7070b48962913", "level": "error", "message": {"text": "Possible secret in main.js"}, "properties": {"repobilityId": "7d19e01bcbba3135", "scanner": "scanner-primary", "fingerprint": "cbc7070b48962913", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 3608}}}]}, {"ruleId": "scanner-864ba0bada0d71f0", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in main.js:1637"}, "properties": {"repobilityId": "ccc5a68c8e1fcda7", "scanner": "scanner-primary", "fingerprint": "864ba0bada0d71f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 1637}}}]}, {"ruleId": "scanner-645e3e2013531cf3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in main.js:9"}, "properties": {"repobilityId": "f39f9770bd53a67e", "scanner": "scanner-primary", "fingerprint": "645e3e2013531cf3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-edfe17252df8a6a3", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in scripts/spotify-auth.js:76"}, "properties": {"repobilityId": "44081dc96b05fbc0", "scanner": "scanner-primary", "fingerprint": "edfe17252df8a6a3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/spotify-auth.js"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-d6520eb75dfa84a8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/spotify-auth.js:15"}, "properties": {"repobilityId": "4c90f78602c297c5", "scanner": "scanner-primary", "fingerprint": "d6520eb75dfa84a8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/spotify-auth.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-458ee2260766d67d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/test-pass39.js:8"}, "properties": {"repobilityId": "cb25c548a5a68c2d", "scanner": "scanner-primary", "fingerprint": "458ee2260766d67d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/test-pass39.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-2126a96c56de3964", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in cloud/server.js:119"}, "properties": {"repobilityId": "7143394ff8c671d4", "scanner": "scanner-primary", "fingerprint": "2126a96c56de3964", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/server.js"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-e4d4234fde0d67ec", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in lib/adapters.js:89"}, "properties": {"repobilityId": "ae26ed27a0ffce9f", "scanner": "scanner-primary", "fingerprint": "e4d4234fde0d67ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/adapters.js"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-a2f6be049d2b7346", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/adapters.js:10"}, "properties": {"repobilityId": "a8fc984a378f85b5", "scanner": "scanner-primary", "fingerprint": "a2f6be049d2b7346", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/adapters.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-76f58f07315cc1fd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/figures.js:12"}, "properties": {"repobilityId": "5694089cb82186f0", "scanner": "scanner-primary", "fingerprint": "76f58f07315cc1fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/figures.js"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-94cb2f3b984b61e7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in phone-app/Web/mobile.html:273"}, "properties": {"repobilityId": "5e1ab949396e9769", "scanner": "scanner-primary", "fingerprint": "94cb2f3b984b61e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "phone-app/Web/mobile.html"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-1f0b684d07429a79", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in phone-app/Web/mobile.html:393"}, "properties": {"repobilityId": "e842aa9619ca5271", "scanner": "scanner-primary", "fingerprint": "1f0b684d07429a79", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "phone-app/Web/mobile.html"}, "region": {"startLine": 393}}}]}, {"ruleId": "scanner-db8f48442c37c5cf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/mobile.html:273"}, "properties": {"repobilityId": "3457a4e2de44847a", "scanner": "scanner-primary", "fingerprint": "db8f48442c37c5cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/mobile.html"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-e3de22206454bb02", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in src/mobile.html:393"}, "properties": {"repobilityId": "1e8a4e5e9168f0d1", "scanner": "scanner-primary", "fingerprint": "e3de22206454bb02", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/mobile.html"}, "region": {"startLine": 393}}}]}, {"ruleId": "scanner-55c562ac28636fa6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/terminal.html:26"}, "properties": {"repobilityId": "dd91001699c522d7", "scanner": "scanner-primary", "fingerprint": "55c562ac28636fa6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/terminal.html"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-4ac5184941dc3aa9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/index.html:548"}, "properties": {"repobilityId": "f44966ae3ef43208", "scanner": "scanner-primary", "fingerprint": "4ac5184941dc3aa9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/index.html"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-a3d29c4e176ac1e1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/activity.html:136"}, "properties": {"repobilityId": "7f8339823505b97b", "scanner": "scanner-primary", "fingerprint": "a3d29c4e176ac1e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/activity.html"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f0c5ac9927c344f7", "level": "note", "message": {"text": "Very large file: main.js (4839 lines)"}, "properties": {"repobilityId": "35584af1b78f3853", "scanner": "scanner-primary", "fingerprint": "f0c5ac9927c344f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "2985174e677e5db7", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5b338ac262927867", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "62cff49c296e4d46", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "325fb8f007daf6c5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "a6af636261ff58f1", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2ca593fd8a84d775", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "73e3abb4b31ce242", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-47bcc463771cd79a", "level": "none", "message": {"text": "Commented-code block (5 lines) in mcp-server.js:2"}, "properties": {"repobilityId": "5b3dd6603e8c82fd", "scanner": "scanner-primary", "fingerprint": "47bcc463771cd79a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-be99611043846e02", "level": "none", "message": {"text": "Commented-code block (7 lines) in main.js:96"}, "properties": {"repobilityId": "db72efa9a124e885", "scanner": "scanner-primary", "fingerprint": "be99611043846e02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0eb0fd062659d68", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 main.js:814"}, "properties": {"repobilityId": "3c67f2854ff23b2a", "scanner": "scanner-primary", "fingerprint": "e0eb0fd062659d68", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e9088f6bb7119993", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/ws.js:3"}, "properties": {"repobilityId": "01954e0a364756a0", "scanner": "scanner-primary", "fingerprint": "e9088f6bb7119993", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4a117282e250c5b6", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/spotify-auth.js:3"}, "properties": {"repobilityId": "93a531ba0d8e5edc", "scanner": "scanner-primary", "fingerprint": "4a117282e250c5b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d963ec0592801d00", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/spotify-auth.js:37"}, "properties": {"repobilityId": "faf378900e24d9ca", "scanner": "scanner-primary", "fingerprint": "d963ec0592801d00", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-da3e5f7c7ac049d1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/test-pass39.js:195"}, "properties": {"repobilityId": "655d0e62d541e7f9", "scanner": "scanner-primary", "fingerprint": "da3e5f7c7ac049d1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-147fecd73be91fce", "level": "none", "message": {"text": "Commented-code block (5 lines) in cloud/server.js:2"}, "properties": {"repobilityId": "994b5852acec5d14", "scanner": "scanner-primary", "fingerprint": "147fecd73be91fce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bb795d37cfc99d37", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 cloud/server.js:83"}, "properties": {"repobilityId": "5bb10ec5b379455b", "scanner": "scanner-primary", "fingerprint": "bb795d37cfc99d37", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9498f4731f357f7e", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/logins.js:2"}, "properties": {"repobilityId": "c7dff91597ce9c57", "scanner": "scanner-primary", "fingerprint": "9498f4731f357f7e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6550f508bdbc0e2b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/adapters.js:22"}, "properties": {"repobilityId": "c446e311f9f192b9", "scanner": "scanner-primary", "fingerprint": "6550f508bdbc0e2b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f6b33916c38fcc03", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/memory.js:2"}, "properties": {"repobilityId": "852fdd641494f797", "scanner": "scanner-primary", "fingerprint": "f6b33916c38fcc03", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cfe49d86bb92fa23", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/prompts.js:2"}, "properties": {"repobilityId": "990b4d4c8f349139", "scanner": "scanner-primary", "fingerprint": "cfe49d86bb92fa23", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c94635508f9280d", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/security.js:2"}, "properties": {"repobilityId": "0d7f33af92b5aa2b", "scanner": "scanner-primary", "fingerprint": "0c94635508f9280d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-069899c5d21ce5a4", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/notion.js:2"}, "properties": {"repobilityId": "7f8697fa0bd8e21a", "scanner": "scanner-primary", "fingerprint": "069899c5d21ce5a4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-edaa04c0c52bc647", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/figures.js:2"}, "properties": {"repobilityId": "f40749fc3d96cc97", "scanner": "scanner-primary", "fingerprint": "edaa04c0c52bc647", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5ce780ef487ff0e4", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/jobs.js:2"}, "properties": {"repobilityId": "b8017d46342ae29d", "scanner": "scanner-primary", "fingerprint": "5ce780ef487ff0e4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d8a17287bf658d33", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/integrations/trellis.js:21"}, "properties": {"repobilityId": "6b77418e5c5efea7", "scanner": "scanner-primary", "fingerprint": "d8a17287bf658d33", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-db8c431b04e7f667", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/agents/exec.js:2"}, "properties": {"repobilityId": "779b1d54f1fdeeb9", "scanner": "scanner-primary", "fingerprint": "db8c431b04e7f667", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1063e9456b2e21b7", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/agents/orchestrator.js:38"}, "properties": {"repobilityId": "daa93b5c79f9f3cc", "scanner": "scanner-primary", "fingerprint": "1063e9456b2e21b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0b5e7cb1208a7cd", "level": "note", "message": {"text": "13 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "2737b8666c1f7eeb", "scanner": "scanner-primary", "fingerprint": "b0b5e7cb1208a7cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-0ff4d137e5264939", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (main.js:829)"}, "properties": {"repobilityId": "253e93eba34c4db4", "scanner": "scanner-primary", "fingerprint": "0ff4d137e5264939", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-92b9480e3aa5ee7d", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (main.js:878)"}, "properties": {"repobilityId": "7332669879d6c59f", "scanner": "scanner-primary", "fingerprint": "92b9480e3aa5ee7d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-616128b5c354ad2d", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (main.js:1035)"}, "properties": {"repobilityId": "e84325cacf2adbba", "scanner": "scanner-primary", "fingerprint": "616128b5c354ad2d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6c6a3b7b65d67a2b", "level": "error", "message": {"text": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent (main.js:1046)"}, "properties": {"repobilityId": "af0ef0f982a000e7", "scanner": "scanner-primary", "fingerprint": "6c6a3b7b65d67a2b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3ddefa01ad6b08db", "level": "error", "message": {"text": "Dangling fetch: POST https://accounts.spotify.com/api/token (main.js:1188)"}, "properties": {"repobilityId": "2f7dddbd9550e78c", "scanner": "scanner-primary", "fingerprint": "3ddefa01ad6b08db", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-f42e1e2a5b23c3a0", "level": "error", "message": {"text": "Dangling fetch: GET https://api.spotify.com/v1/search?type=track&limit=1&q=${encodeURIComponent(query)} (main.js:1199)"}, "properties": {"repobilityId": "3718758de1e12893", "scanner": "scanner-primary", "fingerprint": "f42e1e2a5b23c3a0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-38432b4b86c08b5e", "level": "error", "message": {"text": "Dangling fetch: POST https://accounts.spotify.com/api/token (main.js:1220)"}, "properties": {"repobilityId": "eec93ea001bf210c", "scanner": "scanner-primary", "fingerprint": "38432b4b86c08b5e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-344bffc5d7845383", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (main.js:2101)"}, "properties": {"repobilityId": "c5f66522247bf0e8", "scanner": "scanner-primary", "fingerprint": "344bffc5d7845383", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e7385e8b24c4839e", "level": "error", "message": {"text": "Dangling fetch: GET https://api.replicate.com/v1/models/firtoz/trellis (main.js:2304)"}, "properties": {"repobilityId": "ada11e3f064bedea", "scanner": "scanner-primary", "fingerprint": "e7385e8b24c4839e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ab3d693b45ff99ce", "level": "error", "message": {"text": "Dangling fetch: POST https://api.replicate.com/v1/predictions (main.js:2321)"}, "properties": {"repobilityId": "07dd27dd454819a6", "scanner": "scanner-primary", "fingerprint": "ab3d693b45ff99ce", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1c766d6da5696c77", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/images/generations (main.js:2625)"}, "properties": {"repobilityId": "d969b487f46d992d", "scanner": "scanner-primary", "fingerprint": "1c766d6da5696c77", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-42eb77617295484a", "level": "error", "message": {"text": "Dangling fetch: POST https://api.elevenlabs.io/v1/text-to-speech/${voiceId}?output_format=mp3_44100_128&optimize_streaming_latency=3 (main.js:4166)"}, "properties": {"repobilityId": "b8465283038abb2d", "scanner": "scanner-primary", "fingerprint": "42eb77617295484a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d51023f0dbf72b8c", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/audio/speech (main.js:4178)"}, "properties": {"repobilityId": "862919ae83d7af2d", "scanner": "scanner-primary", "fingerprint": "d51023f0dbf72b8c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0ce45e3ff65b6492", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:11434/api/tags (main.js:4721)"}, "properties": {"repobilityId": "34640daab94e2a77", "scanner": "scanner-primary", "fingerprint": "0ce45e3ff65b6492", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3d7e193f1f4ae595", "level": "error", "message": {"text": "Dangling fetch: POST https://accounts.spotify.com/api/token (scripts/spotify-auth.js:37)"}, "properties": {"repobilityId": "87e7aef4bcc84c03", "scanner": "scanner-primary", "fingerprint": "3d7e193f1f4ae595", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5014a236cceb27d5", "level": "error", "message": {"text": "Dangling fetch: POST http://localhost:11434/api/generate (scripts/test-pass39.js:55)"}, "properties": {"repobilityId": "9e0afdaf4f1d46ae", "scanner": "scanner-primary", "fingerprint": "5014a236cceb27d5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c947cf978ddc40dc", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (scripts/test-pass39.js:66)"}, "properties": {"repobilityId": "5f96d932cecfcbc5", "scanner": "scanner-primary", "fingerprint": "c947cf978ddc40dc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b34a449f8b95dbcf", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (scripts/test-pass39.js:76)"}, "properties": {"repobilityId": "c504bee0217bdedf", "scanner": "scanner-primary", "fingerprint": "b34a449f8b95dbcf", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8d88cbd47ec6ca96", "level": "error", "message": {"text": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent (scripts/test-pass39.js:87)"}, "properties": {"repobilityId": "2eba45beee91d31b", "scanner": "scanner-primary", "fingerprint": "8d88cbd47ec6ca96", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ed56b177c3fd2156", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/audio/speech (scripts/test-pass39.js:131)"}, "properties": {"repobilityId": "f39bf1f9d4595f8c", "scanner": "scanner-primary", "fingerprint": "ed56b177c3fd2156", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-73b30f0dbc4ef6c7", "level": "error", "message": {"text": "Dangling fetch: POST http://localhost:11434/api/chat (scripts/test-pass39.js:163)"}, "properties": {"repobilityId": "b7ea52ef394de6ab", "scanner": "scanner-primary", "fingerprint": "73b30f0dbc4ef6c7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-705dcf017a21d5d2", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (cloud/server.js:61)"}, "properties": {"repobilityId": "4bb9e55bcda51883", "scanner": "scanner-primary", "fingerprint": "705dcf017a21d5d2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-91d52a6eae0cf356", "level": "error", "message": {"text": "Dangling fetch: POST https://api.elevenlabs.io/v1/text-to-speech/${EL_VOICE}?output_format=mp3_44100_128&optimize_streaming_latency=3 (cloud/server.js:83)"}, "properties": {"repobilityId": "7b93a291ca17a49f", "scanner": "scanner-primary", "fingerprint": "91d52a6eae0cf356", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9ddcf0d649854da9", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/audio/transcriptions (cloud/server.js:99)"}, "properties": {"repobilityId": "a707969875d5ae4e", "scanner": "scanner-primary", "fingerprint": "9ddcf0d649854da9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-25c5f44918ffd006", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (lib/adapters.js:32)"}, "properties": {"repobilityId": "9416d32303f5fb14", "scanner": "scanner-primary", "fingerprint": "25c5f44918ffd006", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-36fabc1f2af0cce2", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (lib/adapters.js:67)"}, "properties": {"repobilityId": "72cb4a070d683485", "scanner": "scanner-primary", "fingerprint": "36fabc1f2af0cce2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-21ad9dc1f677b4eb", "level": "note", "message": {"text": "Unused endpoint: POST /mcp/:token"}, "properties": {"repobilityId": "01b336bcd70f5a60", "scanner": "scanner-primary", "fingerprint": "21ad9dc1f677b4eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-29143f50144caf3c", "level": "note", "message": {"text": "Unused endpoint: GET /mcp/:token"}, "properties": {"repobilityId": "3c585a6aac9e27dd", "scanner": "scanner-primary", "fingerprint": "29143f50144caf3c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-127848cf2ee43206", "level": "note", "message": {"text": "Unused endpoint: GET /app/:token"}, "properties": {"repobilityId": "c5f72754040fb929", "scanner": "scanner-primary", "fingerprint": "127848cf2ee43206", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-116dc677d271be65", "level": "note", "message": {"text": "Unused endpoint: GET /app/:token/version"}, "properties": {"repobilityId": "be8421893f644d24", "scanner": "scanner-primary", "fingerprint": "116dc677d271be65", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-27199affb45904da", "level": "note", "message": {"text": "Unused endpoint: GET /app/:token/manifest.webmanifest"}, "properties": {"repobilityId": "0d3be7f885d08da4", "scanner": "scanner-primary", "fingerprint": "27199affb45904da", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5aa2a494802602c", "level": "note", "message": {"text": "Unused endpoint: GET /app/:token/sw.js"}, "properties": {"repobilityId": "2725a1c3bae313ec", "scanner": "scanner-primary", "fingerprint": "a5aa2a494802602c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3175afccbbb8723c", "level": "note", "message": {"text": "Unused endpoint: GET /app/:token/icon-192.png"}, "properties": {"repobilityId": "3bfe4e72418d1b31", "scanner": "scanner-primary", "fingerprint": "3175afccbbb8723c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac7c8fc84b708d73", "level": "note", "message": {"text": "Unused endpoint: GET /app/:token/icon-512.png"}, "properties": {"repobilityId": "873fa1a4c6671b6a", "scanner": "scanner-primary", "fingerprint": "ac7c8fc84b708d73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ebaede49e4940580", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/chat"}, "properties": {"repobilityId": "956f974115c56d5b", "scanner": "scanner-primary", "fingerprint": "ebaede49e4940580", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1dbff5f4eb9c4862", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/attach"}, "properties": {"repobilityId": "a4967029325d1b13", "scanner": "scanner-primary", "fingerprint": "1dbff5f4eb9c4862", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ddf748f0b4e13c99", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/stt"}, "properties": {"repobilityId": "da47d14575dbace3", "scanner": "scanner-primary", "fingerprint": "ddf748f0b4e13c99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af40ea3406618c24", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/tts"}, "properties": {"repobilityId": "b7daa2aeda5f5af8", "scanner": "scanner-primary", "fingerprint": "af40ea3406618c24", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc78d4b51be624e2", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/summarize"}, "properties": {"repobilityId": "4944477921c9188f", "scanner": "scanner-primary", "fingerprint": "cc78d4b51be624e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7796943dd56daa79", "level": "note", "message": {"text": "Unused endpoint: GET /api/:token/activity"}, "properties": {"repobilityId": "e62a660d4e9438cd", "scanner": "scanner-primary", "fingerprint": "7796943dd56daa79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-42b52b2588f6ef93", "level": "note", "message": {"text": "Unused endpoint: GET /api/:token/config"}, "properties": {"repobilityId": "6044afa502cd8c3d", "scanner": "scanner-primary", "fingerprint": "42b52b2588f6ef93", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-152c4529142a3ea0", "level": "note", "message": {"text": "Unused endpoint: GET /api/:token/jobs"}, "properties": {"repobilityId": "a694989651ef23e6", "scanner": "scanner-primary", "fingerprint": "152c4529142a3ea0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-08ac0b86b3889006", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/jobs/:id/cancel"}, "properties": {"repobilityId": "d61fde5c685516a1", "scanner": "scanner-primary", "fingerprint": "08ac0b86b3889006", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6d901a1e2fecbe6", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/jobs/:id/guide"}, "properties": {"repobilityId": "78dadb9caf5e7aef", "scanner": "scanner-primary", "fingerprint": "b6d901a1e2fecbe6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-51cceab0cc9574cf", "level": "note", "message": {"text": "Unused endpoint: POST /api/:token/control"}, "properties": {"repobilityId": "5280c1539bf2b21e", "scanner": "scanner-primary", "fingerprint": "51cceab0cc9574cf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-afe4d48ce8dd0900", "level": "note", "message": {"text": "Unused endpoint: GET /api/:token/screen"}, "properties": {"repobilityId": "60ad3aa8e173d93e", "scanner": "scanner-primary", "fingerprint": "afe4d48ce8dd0900", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9589bf14501d77e4", "level": "note", "message": {"text": "Unused endpoint: GET /voice/:token/clip/:id"}, "properties": {"repobilityId": "3c07bc43595b0cdb", "scanner": "scanner-primary", "fingerprint": "9589bf14501d77e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c8eefd8ebb9b2a8", "level": "note", "message": {"text": "Unused endpoint: POST /voice/:token/incoming"}, "properties": {"repobilityId": "04a421b64061916b", "scanner": "scanner-primary", "fingerprint": "8c8eefd8ebb9b2a8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ebca112a3fdb60a7", "level": "note", "message": {"text": "Unused endpoint: POST /voice/:token/gather"}, "properties": {"repobilityId": "01fb513ef6633ff6", "scanner": "scanner-primary", "fingerprint": "ebca112a3fdb60a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9f5ff67191cc2b46", "level": "note", "message": {"text": "Unused endpoint: POST /voice/:token/status"}, "properties": {"repobilityId": "4a99c3d872eab332", "scanner": "scanner-primary", "fingerprint": "9f5ff67191cc2b46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63732025c2dfc482", "level": "note", "message": {"text": "Unused endpoint: POST /sms/:token/incoming"}, "properties": {"repobilityId": "55ce6ec51784f2c8", "scanner": "scanner-primary", "fingerprint": "63732025c2dfc482", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d31addfe491b04a", "level": "note", "message": {"text": "Unused endpoint: ALL /api/:token"}, "properties": {"repobilityId": "06d7bbca438977e5", "scanner": "scanner-primary", "fingerprint": "5d31addfe491b04a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}