{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bb09249c9ae70fd7", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate_placeholders.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate_placeholders.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b2056441091f090", "name": "Stray `console.log` in TS/JS \u2014 maker/vite.config.ts:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/vite.config.ts:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc34b51f65331bef", "name": "Stray `console.log` in TS/JS \u2014 maker/scripts/kill-port.ts:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/scripts/kill-port.ts:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bed435d61234854", "name": "Stray `console.log` in TS/JS \u2014 maker/scripts/rebuild-default-world.ts:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/scripts/rebuild-default-world.ts:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b569601ceafc41be", "name": "Stray `console.log` in TS/JS \u2014 maker/server/import.ts:91", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/import.ts:91"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad147977549c110b", "name": "Stray `console.log` in TS/JS \u2014 maker/server/index.ts:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/index.ts:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2c8f05d4f4ae383", "name": "Stray `console.log` in TS/JS \u2014 maker/server/app.ts:155", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/app.ts:155"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ee41292d16b5154", "name": "Stray `console.log` in TS/JS \u2014 maker/server/middleware/auth.ts:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/middleware/auth.ts:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28772ebf5253b1bb", "name": "Stray `console.log` in TS/JS \u2014 maker/server/lib/logger.ts:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/lib/logger.ts:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49f4760097041ba8", "name": "Docker base image is tag-pinned but not digest-pinned: amazoncorretto:21", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: amazoncorretto:21"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc8428a62ed3b640", "name": "Docker base image is tag-pinned but not digest-pinned: amazoncorretto:21-alpine-jdk", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: amazoncorretto:21-alpine-jdk"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f3717eab62efbd3", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50fc9f68d7cc1808", "name": "Insecure pattern 'direct_innerhtml_assignment' in client/src/wasmJsMain/resources/index.html:237", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in client/src/wasmJsMain/resources/index.html:237"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b90b0b8d312d032f", "name": "Insecure pattern 'node_child_process' in scripts/slim-assets.mjs:40", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/slim-assets.mjs:40"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c78fe5f3247a154a", "name": "Insecure pattern 'node_child_process' in scripts/generate-icons.mjs:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate-icons.mjs:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8add705302faa2da", "name": "Insecure pattern 'node_child_process' in scripts/process-icons.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/process-icons.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00f6f9b5917c1458", "name": "Insecure pattern 'node_child_process' in scripts/remove-bg.mjs:33", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/remove-bg.mjs:33"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0e2c7e6b6315a52", "name": "Insecure pattern 'node_child_process' in scripts/icons-to-webp.mjs:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/icons-to-webp.mjs:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f87ee400f4b8be1", "name": "Insecure pattern 'node_child_process' in maker/scripts/kill-port.ts:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in maker/scripts/kill-port.ts:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1ea5caee57b36fd", "name": "Insecure pattern 'node_child_process' in maker/scripts/rebuild-default-world.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in maker/scripts/rebuild-default-world.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-513582ed7d6e7d04", "name": "Insecure pattern 'node_child_process' in maker/server/db.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in maker/server/db.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9ee957d2ecf34ea", "name": "Insecure pattern 'node_child_process' in maker/server/projectContext.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in maker/server/projectContext.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c09e7fc6533e8125", "name": "Insecure pattern 'node_child_process' in maker/server/__tests__/helpers.ts:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in maker/server/__tests__/helpers.ts:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16997e334bef3822", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "appleboy/ssh-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23a267c296140259", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdabfc974b395133", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfe71888c7a47541", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5cd3df80e6327a22", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fe2e61ddb0553a1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d268c9cea4abb0d6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8296e87bd908e8d", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9df4da8105b91ec", "name": "Very large file: maker/src/pages/NpcEditor.tsx (1423 lines)", "shortDescription": {"text": "Very large file: maker/src/pages/NpcEditor.tsx (1423 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84f7a3ee5876183c", "name": "Very large file: maker/src/pages/ZoneEditor.tsx (2296 lines)", "shortDescription": {"text": "Very large file: maker/src/pages/ZoneEditor.tsx (2296 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3036d70d2146842b", "name": "Node manifest has dependencies but no lockfile: scripts/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: scripts/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 189 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 102 placeholder/mock markers across 20 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8290a68e8ddccbc4", "name": "Agent authority lacks a verifier contract: .claude/agent-memory/web-uat-tester/compose_web_inputs.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agent-memory/web-uat-tester/compose_web_inputs.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d88e21ebeb89b8c", "name": "Agent authority lacks a verifier contract: .claude/skills/frontend-design/DESIGN_SYSTEM.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/frontend-design/DESIGN_SYSTEM.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac681a259ad9302d", "name": "Agent authority lacks a verifier contract: .claude/skills/elevenlabs-sfx/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/elevenlabs-sfx/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0655dd21e7dd4555", "name": "Agent instruction/config may expose a secret: .claude/skills/nano-banana-builder/references/configuration.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/nano-banana-builder/references/configuration.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afe250d4747fdf0c", "name": "Agent authority lacks a verifier contract: .claude/skills/nano-banana-builder/references/configuration.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/nano-banana-builder/references/configuration.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5b21e43f2d6863d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/wasmJsMain/resources/neomud-audio.js:53", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/wasmJsMain/resources/neomud-audio.js:53"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e971e253465bbf85", "name": "Commented-code block (5 lines) in scripts/slim-assets.mjs:175", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/slim-assets.mjs:175"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9171086a34024efa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/game-relay.mjs:95", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/game-relay.mjs:95"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d85a82935330d5f9", "name": "Commented-code block (7 lines) in maker/server/db.ts:61", "shortDescription": {"text": "Commented-code block (7 lines) in maker/server/db.ts:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5605261bb413e18", "name": "Commented-code block (5 lines) in maker/server/__tests__/projectsQuota.test.ts:80", "shortDescription": {"text": "Commented-code block (5 lines) in maker/server/__tests__/projectsQuota.test.ts:80"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-725f9ffdfe54b345", "name": "Commented-code block (6 lines) in maker/server/middleware/auth.ts:105", "shortDescription": {"text": "Commented-code block (6 lines) in maker/server/middleware/auth.ts:105"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-662da55208497f55", "name": "`fetch()` without try/.catch or AbortSignal \u2014 maker/server/lib/logger.ts:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 maker/server/lib/logger.ts:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdba7b7bc1d8a411", "name": "Commented-code block (5 lines) in maker/server/routes/export.ts:82", "shortDescription": {"text": "Commented-code block (5 lines) in maker/server/routes/export.ts:82"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3b5e5e2a199bf68", "name": "`fetch()` without try/.catch or AbortSignal \u2014 maker/server/routes/generate.ts:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 maker/server/routes/generate.ts:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f6628bc8ad01661", "name": "Commented-code block (5 lines) in maker/server/routes/playtest.ts:106", "shortDescription": {"text": "Commented-code block (5 lines) in maker/server/routes/playtest.ts:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40100a4dc73045e9", "name": "Commented-code block (6 lines) in maker/server/routes/publish.ts:91", "shortDescription": {"text": "Commented-code block (6 lines) in maker/server/routes/publish.ts:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16ac173fc28b11ae", "name": "Commented-code block (6 lines) in maker/src/api.ts:105", "shortDescription": {"text": "Commented-code block (6 lines) in maker/src/api.ts:105"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d5e273cadf2864c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 maker/src/api.ts:166", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 maker/src/api.ts:166"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbad0de0b98dc982", "name": "Commented-code block (5 lines) in maker/src/__tests__/api.test.ts:104", "shortDescription": {"text": "Commented-code block (5 lines) in maker/src/__tests__/api.test.ts:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ef5ba695d2cf004", "name": "Commented-code block (6 lines) in maker/src/__tests__/ZoneEditor.test.tsx:385", "shortDescription": {"text": "Commented-code block (6 lines) in maker/src/__tests__/ZoneEditor.test.tsx:385"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c9a1751a1e2cb74", "name": "Commented-code block (5 lines) in maker/src/components/MapCanvas.tsx:125", "shortDescription": {"text": "Commented-code block (5 lines) in maker/src/components/MapCanvas.tsx:125"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-177eb01cd1b8432b", "name": "Commented-code block (10 lines) in maker/src/components/Layout.tsx:107", "shortDescription": {"text": "Commented-code block (10 lines) in maker/src/components/Layout.tsx:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3295e001a225ea7d", "name": "Commented-code block (5 lines) in maker/src/components/MenuBar.tsx:174", "shortDescription": {"text": "Commented-code block (5 lines) in maker/src/components/MenuBar.tsx:174"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0db80f22420ac5a", "name": "Commented-code block (6 lines) in maker/src/pages/ZoneEditor.tsx:1428", "shortDescription": {"text": "Commented-code block (6 lines) in maker/src/pages/ZoneEditor.tsx:1428"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e31742712ae6bffc", "name": "Frontend route `/project/:name` has no Link/navigate to it \u2014 maker/src/__tests__/MenuBar.test.tsx", "shortDescription": {"text": "Frontend route `/project/:name` has no Link/navigate to it \u2014 maker/src/__tests__/MenuBar.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb3d62ca8ff9d392", "name": "Unused endpoint: GET /api/auth/mode", "shortDescription": {"text": "Unused endpoint: GET /api/auth/mode"}, "fullDescription": {"text": "`maker/server/app.ts` declares `GET /api/auth/mode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dde3adb27bf7eebe", "name": "Unused endpoint: USE /api", "shortDescription": {"text": "Unused endpoint: USE /api"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /api` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e2ab93c44650ae3", "name": "Unused endpoint: USE /api/projects/import", "shortDescription": {"text": "Unused endpoint: USE /api/projects/import"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /api/projects/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-728e92394c568abf", "name": "Unused endpoint: USE /api/projects", "shortDescription": {"text": "Unused endpoint: USE /api/projects"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /api/projects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bb956714e743215", "name": "Unused endpoint: USE /api/sign-urls", "shortDescription": {"text": "Unused endpoint: USE /api/sign-urls"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /api/sign-urls` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22a7cc6bf48c507b", "name": "Unused endpoint: USE /export", "shortDescription": {"text": "Unused endpoint: USE /export"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d1c70ac0e5ff085", "name": "Unused endpoint: USE /settings", "shortDescription": {"text": "Unused endpoint: USE /settings"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76b87f037ae282ca", "name": "Unused endpoint: USE /pc-sprites", "shortDescription": {"text": "Unused endpoint: USE /pc-sprites"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /pc-sprites` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1768d9c69a38ed5", "name": "Unused endpoint: USE /default-sfx", "shortDescription": {"text": "Unused endpoint: USE /default-sfx"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /default-sfx` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1932af12eee90287", "name": "Unused endpoint: USE /generate", "shortDescription": {"text": "Unused endpoint: USE /generate"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953095ec69bb641d", "name": "Unused endpoint: USE /asset-mgmt", "shortDescription": {"text": "Unused endpoint: USE /asset-mgmt"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /asset-mgmt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8544f0438153226e", "name": "Unused endpoint: USE /playtest", "shortDescription": {"text": "Unused endpoint: USE /playtest"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /playtest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a2c5c4bad4de8a5", "name": "Unused endpoint: USE /publish", "shortDescription": {"text": "Unused endpoint: USE /publish"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /publish` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b59435b3211a9df", "name": "Unused endpoint: USE /assets", "shortDescription": {"text": "Unused endpoint: USE /assets"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /assets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1dd0bcd9ccd8a41", "name": "Unused endpoint: USE /api/projects/:name", "shortDescription": {"text": "Unused endpoint: USE /api/projects/:name"}, "fullDescription": {"text": "`maker/server/app.ts` declares `USE /api/projects/:name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77a21e69b379a5bf", "name": "Unused endpoint: GET /{*path}", "shortDescription": {"text": "Unused endpoint: GET /{*path}"}, "fullDescription": {"text": "`maker/server/app.ts` declares `GET /{*path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6236b283b79811b8", "name": "Unused endpoint: POST /upload", "shortDescription": {"text": "Unused endpoint: POST /upload"}, "fullDescription": {"text": "`maker/server/routes/assets.ts` declares `POST /upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-051c8cfc37cdcc32", "name": "Unused endpoint: POST /undo", "shortDescription": {"text": "Unused endpoint: POST /undo"}, "fullDescription": {"text": "`maker/server/routes/assets.ts` declares `POST /undo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8affeb0d6aeff6df", "name": "Unused endpoint: POST /clear", "shortDescription": {"text": "Unused endpoint: POST /clear"}, "fullDescription": {"text": "`maker/server/routes/assets.ts` declares `POST /clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afc064028ae39ea9", "name": "Unused endpoint: GET /history", "shortDescription": {"text": "Unused endpoint: GET /history"}, "fullDescription": {"text": "`maker/server/routes/assets.ts` declares `GET /history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-589ebfdd645350a0", "name": "Unused endpoint: GET /json", "shortDescription": {"text": "Unused endpoint: GET /json"}, "fullDescription": {"text": "`maker/server/routes/export.ts` declares `GET /json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14dee14ca62f46f5", "name": "Unused endpoint: GET /nmd", "shortDescription": {"text": "Unused endpoint: GET /nmd"}, "fullDescription": {"text": "`maker/server/routes/export.ts` declares `GET /nmd` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc5a92b082e15c69", "name": "Unused endpoint: GET /validate", "shortDescription": {"text": "Unused endpoint: GET /validate"}, "fullDescription": {"text": "`maker/server/routes/export.ts` declares `GET /validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e8673c0ae4344b9", "name": "Unused endpoint: GET /package", "shortDescription": {"text": "Unused endpoint: GET /package"}, "fullDescription": {"text": "`maker/server/routes/export.ts` declares `GET /package` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`maker/server/routes/signUrls.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45f114055f72c285", "name": "Unused endpoint: GET /items", "shortDescription": {"text": "Unused endpoint: GET /items"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /items` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1506f0b5d0e0cbe8", "name": "Unused endpoint: GET /items/:id", "shortDescription": {"text": "Unused endpoint: GET /items/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /items/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e2aebb8dfde31c6", "name": "Unused endpoint: POST /items", "shortDescription": {"text": "Unused endpoint: POST /items"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `POST /items` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdc60d8cc400ae6f", "name": "Unused endpoint: PUT /items/:id", "shortDescription": {"text": "Unused endpoint: PUT /items/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `PUT /items/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38d7c846122a79ea", "name": "Unused endpoint: DELETE /items/:id", "shortDescription": {"text": "Unused endpoint: DELETE /items/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `DELETE /items/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad9f14e31f59a0dc", "name": "Unused endpoint: GET /npcs", "shortDescription": {"text": "Unused endpoint: GET /npcs"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /npcs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4d44cd295b1a16c", "name": "Unused endpoint: GET /npcs/:id", "shortDescription": {"text": "Unused endpoint: GET /npcs/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /npcs/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf675cef6c6cac58", "name": "Unused endpoint: POST /npcs", "shortDescription": {"text": "Unused endpoint: POST /npcs"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `POST /npcs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b2b5be42e361ba3", "name": "Unused endpoint: PUT /npcs/:id", "shortDescription": {"text": "Unused endpoint: PUT /npcs/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `PUT /npcs/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-394eb7d541d68795", "name": "Unused endpoint: DELETE /npcs/:id", "shortDescription": {"text": "Unused endpoint: DELETE /npcs/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `DELETE /npcs/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-228e6fe290d69046", "name": "Unused endpoint: GET /character-classes", "shortDescription": {"text": "Unused endpoint: GET /character-classes"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /character-classes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bcea47425095855d", "name": "Unused endpoint: GET /character-classes/:id", "shortDescription": {"text": "Unused endpoint: GET /character-classes/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /character-classes/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b155831c4c4bc21d", "name": "Unused endpoint: POST /character-classes", "shortDescription": {"text": "Unused endpoint: POST /character-classes"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `POST /character-classes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bae027a09aa4648f", "name": "Unused endpoint: PUT /character-classes/:id", "shortDescription": {"text": "Unused endpoint: PUT /character-classes/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `PUT /character-classes/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e61b6e95aa328292", "name": "Unused endpoint: DELETE /character-classes/:id", "shortDescription": {"text": "Unused endpoint: DELETE /character-classes/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `DELETE /character-classes/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bb7ca6597383f72", "name": "Unused endpoint: GET /races", "shortDescription": {"text": "Unused endpoint: GET /races"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /races` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e485086d37c4b9b", "name": "Unused endpoint: GET /races/:id", "shortDescription": {"text": "Unused endpoint: GET /races/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /races/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdb316b1fb38fda2", "name": "Unused endpoint: POST /races", "shortDescription": {"text": "Unused endpoint: POST /races"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `POST /races` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-340c0a34814dd1e4", "name": "Unused endpoint: PUT /races/:id", "shortDescription": {"text": "Unused endpoint: PUT /races/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `PUT /races/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c4b9aa25cc0daea", "name": "Unused endpoint: DELETE /races/:id", "shortDescription": {"text": "Unused endpoint: DELETE /races/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `DELETE /races/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c5c6900e4670966", "name": "Unused endpoint: GET /skills", "shortDescription": {"text": "Unused endpoint: GET /skills"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47bcd95181aca757", "name": "Unused endpoint: GET /skills/:id", "shortDescription": {"text": "Unused endpoint: GET /skills/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `GET /skills/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce7fe565b4caff57", "name": "Unused endpoint: POST /skills", "shortDescription": {"text": "Unused endpoint: POST /skills"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `POST /skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e85dad2ac0cab7a", "name": "Unused endpoint: PUT /skills/:id", "shortDescription": {"text": "Unused endpoint: PUT /skills/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `PUT /skills/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86a5b45740b4360d", "name": "Unused endpoint: DELETE /skills/:id", "shortDescription": {"text": "Unused endpoint: DELETE /skills/:id"}, "fullDescription": {"text": "`maker/server/routes/entities.ts` declares `DELETE /skills/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18462"}, "properties": {"repository": "roomsmith-games/NeoMud", "repoUrl": "https://github.com/roomsmith-games/NeoMud", "branch": "main"}, "results": [{"ruleId": "scanner-bb09249c9ae70fd7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate_placeholders.js:45"}, "properties": {"repobilityId": "1c46f31c8f5c69ff", "scanner": "scanner-primary", "fingerprint": "bb09249c9ae70fd7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6b2056441091f090", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/vite.config.ts:12"}, "properties": {"repobilityId": "cc83eb01a192701f", "scanner": "scanner-primary", "fingerprint": "6b2056441091f090", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bc34b51f65331bef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/scripts/kill-port.ts:26"}, "properties": {"repobilityId": "d1b933c9b31d5a4a", "scanner": "scanner-primary", "fingerprint": "bc34b51f65331bef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2bed435d61234854", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/scripts/rebuild-default-world.ts:40"}, "properties": {"repobilityId": "55f9678eaf7d8b65", "scanner": "scanner-primary", "fingerprint": "2bed435d61234854", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b569601ceafc41be", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/import.ts:91"}, "properties": {"repobilityId": "b30c6c958378382a", "scanner": "scanner-primary", "fingerprint": "b569601ceafc41be", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ad147977549c110b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/index.ts:9"}, "properties": {"repobilityId": "bd6c296d87882114", "scanner": "scanner-primary", "fingerprint": "ad147977549c110b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c2c8f05d4f4ae383", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/app.ts:155"}, "properties": {"repobilityId": "0a032c219128ce0e", "scanner": "scanner-primary", "fingerprint": "c2c8f05d4f4ae383", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0ee41292d16b5154", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/middleware/auth.ts:24"}, "properties": {"repobilityId": "8607ec93d9aedeec", "scanner": "scanner-primary", "fingerprint": "0ee41292d16b5154", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-28772ebf5253b1bb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 maker/server/lib/logger.ts:50"}, "properties": {"repobilityId": "db0a9f7a50f8531c", "scanner": "scanner-primary", "fingerprint": "28772ebf5253b1bb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-49f4760097041ba8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: amazoncorretto:21"}, "properties": {"repobilityId": "967cb20f93388fe3", "scanner": "scanner-primary", "fingerprint": "49f4760097041ba8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-fc8428a62ed3b640", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: amazoncorretto:21-alpine-jdk"}, "properties": {"repobilityId": "702b6d81f9a6c29f", "scanner": "scanner-primary", "fingerprint": "fc8428a62ed3b640", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-2f3717eab62efbd3", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "914c73ae9a7949b9", "scanner": "scanner-primary", "fingerprint": "2f3717eab62efbd3", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-2f3717eab62efbd3", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "496807e3920822d7", "scanner": "scanner-primary", "fingerprint": "2f3717eab62efbd3", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/Dockerfile"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-50fc9f68d7cc1808", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in client/src/wasmJsMain/resources/index.html:237"}, "properties": {"repobilityId": "c9b9b2507f32f205", "scanner": "scanner-primary", "fingerprint": "50fc9f68d7cc1808", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "client/src/wasmJsMain/resources/index.html"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-b90b0b8d312d032f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/slim-assets.mjs:40"}, "properties": {"repobilityId": "20d2e6a65b859162", "scanner": "scanner-primary", "fingerprint": "b90b0b8d312d032f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/slim-assets.mjs"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-c78fe5f3247a154a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate-icons.mjs:14"}, "properties": {"repobilityId": "e2c5d8657efe45f0", "scanner": "scanner-primary", "fingerprint": "c78fe5f3247a154a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-icons.mjs"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-8add705302faa2da", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/process-icons.mjs:8"}, "properties": {"repobilityId": "4a9c44a7c9faa681", "scanner": "scanner-primary", "fingerprint": "8add705302faa2da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/process-icons.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-00f6f9b5917c1458", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/remove-bg.mjs:33"}, "properties": {"repobilityId": "ed650e16cd153374", "scanner": "scanner-primary", "fingerprint": "00f6f9b5917c1458", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/remove-bg.mjs"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-a0e2c7e6b6315a52", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/icons-to-webp.mjs:8"}, "properties": {"repobilityId": "aca04f4acc91a5cf", "scanner": "scanner-primary", "fingerprint": "a0e2c7e6b6315a52", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/icons-to-webp.mjs"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-1f87ee400f4b8be1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in maker/scripts/kill-port.ts:7"}, "properties": {"repobilityId": "b6f66dc4bfc650f6", "scanner": "scanner-primary", "fingerprint": "1f87ee400f4b8be1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/scripts/kill-port.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-e1ea5caee57b36fd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in maker/scripts/rebuild-default-world.ts:11"}, "properties": {"repobilityId": "d67762e5db2d454b", "scanner": "scanner-primary", "fingerprint": "e1ea5caee57b36fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/scripts/rebuild-default-world.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-513582ed7d6e7d04", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in maker/server/db.ts:3"}, "properties": {"repobilityId": "9b3f570271652e71", "scanner": "scanner-primary", "fingerprint": "513582ed7d6e7d04", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/server/db.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-e9ee957d2ecf34ea", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in maker/server/projectContext.ts:4"}, "properties": {"repobilityId": "0e5246404dfaa206", "scanner": "scanner-primary", "fingerprint": "e9ee957d2ecf34ea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/server/projectContext.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-c09e7fc6533e8125", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in maker/server/__tests__/helpers.ts:5"}, "properties": {"repobilityId": "3c83e79db24cc8a6", "scanner": "scanner-primary", "fingerprint": "c09e7fc6533e8125", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/server/__tests__/helpers.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-16997e334bef3822", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61ec89713434ca4a", "scanner": "scanner-primary", "fingerprint": "16997e334bef3822", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-wasm.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-16997e334bef3822", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b138ea196e3775d7", "scanner": "scanner-primary", "fingerprint": "16997e334bef3822", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-wasm.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-16997e334bef3822", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61ec89713434ca4a", "scanner": "scanner-primary", "fingerprint": "16997e334bef3822", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-wasm.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-23a267c296140259", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9a5f1eb3b073330e", "scanner": "scanner-primary", "fingerprint": "23a267c296140259", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-server.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-23a267c296140259", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ad6c9abd0efa1d97", "scanner": "scanner-primary", "fingerprint": "23a267c296140259", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-server.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-23a267c296140259", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e475de0fcd1f4930", "scanner": "scanner-primary", "fingerprint": "23a267c296140259", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-server.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-23a267c296140259", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ea27ddfb9a3903e7", "scanner": "scanner-primary", "fingerprint": "23a267c296140259", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-server.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-fdabfc974b395133", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d8672acbd59b06a5", "scanner": "scanner-primary", "fingerprint": "fdabfc974b395133", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-server.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfe71888c7a47541", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7141cfcfa0f98626", "scanner": "scanner-primary", "fingerprint": "bfe71888c7a47541", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-maker.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-bfe71888c7a47541", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ea35eddd51d9323b", "scanner": "scanner-primary", "fingerprint": "bfe71888c7a47541", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-maker.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-bfe71888c7a47541", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "196ff8ef45b98dbe", "scanner": "scanner-primary", "fingerprint": "bfe71888c7a47541", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-maker.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-bfe71888c7a47541", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "196ff8ef45b98dbe", "scanner": "scanner-primary", "fingerprint": "bfe71888c7a47541", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-maker.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-5cd3df80e6327a22", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c0ce6052322e16ee", "scanner": "scanner-primary", "fingerprint": "5cd3df80e6327a22", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-maker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "077af29254e3eabc", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6db6c93b9bdd257b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c71c4053464cd39c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d08151bb856f4436", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d08151bb856f4436", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fe2e61ddb0553a1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee1a875c0e156adf", "scanner": "scanner-primary", "fingerprint": "3fe2e61ddb0553a1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/promote-server.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-3fe2e61ddb0553a1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5c79ccf8291bb6c", "scanner": "scanner-primary", "fingerprint": "3fe2e61ddb0553a1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/promote-server.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-3fe2e61ddb0553a1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4437ad7f594970f2", "scanner": "scanner-primary", "fingerprint": "3fe2e61ddb0553a1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/promote-server.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-d268c9cea4abb0d6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ce2968e884587c27", "scanner": "scanner-primary", "fingerprint": "d268c9cea4abb0d6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/promote-server.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8296e87bd908e8d", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "8ad066b062a05951", "scanner": "scanner-primary", "fingerprint": "b8296e87bd908e8d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "maker/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9df4da8105b91ec", "level": "note", "message": {"text": "Very large file: maker/src/pages/NpcEditor.tsx (1423 lines)"}, "properties": {"repobilityId": "a80e4962a898c4b2", "scanner": "scanner-primary", "fingerprint": "f9df4da8105b91ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-84f7a3ee5876183c", "level": "note", "message": {"text": "Very large file: maker/src/pages/ZoneEditor.tsx (2296 lines)"}, "properties": {"repobilityId": "1cfa74e906f0fe87", "scanner": "scanner-primary", "fingerprint": "84f7a3ee5876183c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3036d70d2146842b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: scripts/package.json"}, "properties": {"repobilityId": "3a2a86cb93b8e276", "scanner": "scanner-primary", "fingerprint": "3036d70d2146842b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "3733e3db1ba74da3", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "4f66ded1c14e641e", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "5acef28cbf6d4d58", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "77f52c6b13c8cf32", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "cb721c8a127bb809", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "917f86291cde909c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8290a68e8ddccbc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agent-memory/web-uat-tester/compose_web_inputs.md"}, "properties": {"repobilityId": "4bde7156817fd48c", "scanner": "scanner-primary", "fingerprint": "8290a68e8ddccbc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agent-memory/web-uat-tester/compose_web_inputs.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d88e21ebeb89b8c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/frontend-design/DESIGN_SYSTEM.md"}, "properties": {"repobilityId": "43df4f13622909a8", "scanner": "scanner-primary", "fingerprint": "0d88e21ebeb89b8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/frontend-design/DESIGN_SYSTEM.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac681a259ad9302d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/elevenlabs-sfx/SKILL.md"}, "properties": {"repobilityId": "63b5e43d7ed81538", "scanner": "scanner-primary", "fingerprint": "ac681a259ad9302d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/elevenlabs-sfx/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0655dd21e7dd4555", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/nano-banana-builder/references/configuration.md"}, "properties": {"repobilityId": "19142906c004761a", "scanner": "scanner-primary", "fingerprint": "0655dd21e7dd4555", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/nano-banana-builder/references/configuration.md"}, "region": {"startLine": 393}}}]}, {"ruleId": "scanner-afe250d4747fdf0c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/nano-banana-builder/references/configuration.md"}, "properties": {"repobilityId": "ab0d7923eac9775d", "scanner": "scanner-primary", "fingerprint": "afe250d4747fdf0c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/nano-banana-builder/references/configuration.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5b21e43f2d6863d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/wasmJsMain/resources/neomud-audio.js:53"}, "properties": {"repobilityId": "d02b3a41600ca066", "scanner": "scanner-primary", "fingerprint": "f5b21e43f2d6863d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e971e253465bbf85", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/slim-assets.mjs:175"}, "properties": {"repobilityId": "6f116564575eb3fd", "scanner": "scanner-primary", "fingerprint": "e971e253465bbf85", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9171086a34024efa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/game-relay.mjs:95"}, "properties": {"repobilityId": "4513d70980521277", "scanner": "scanner-primary", "fingerprint": "9171086a34024efa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d85a82935330d5f9", "level": "none", "message": {"text": "Commented-code block (7 lines) in maker/server/db.ts:61"}, "properties": {"repobilityId": "3f0d48a8632d5a8b", "scanner": "scanner-primary", "fingerprint": "d85a82935330d5f9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5605261bb413e18", "level": "none", "message": {"text": "Commented-code block (5 lines) in maker/server/__tests__/projectsQuota.test.ts:80"}, "properties": {"repobilityId": "8c58632dea908d29", "scanner": "scanner-primary", "fingerprint": "a5605261bb413e18", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-725f9ffdfe54b345", "level": "none", "message": {"text": "Commented-code block (6 lines) in maker/server/middleware/auth.ts:105"}, "properties": {"repobilityId": "90081ac9a446bf4d", "scanner": "scanner-primary", "fingerprint": "725f9ffdfe54b345", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-662da55208497f55", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 maker/server/lib/logger.ts:68"}, "properties": {"repobilityId": "c7c2d8f9c1cb4467", "scanner": "scanner-primary", "fingerprint": "662da55208497f55", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bdba7b7bc1d8a411", "level": "none", "message": {"text": "Commented-code block (5 lines) in maker/server/routes/export.ts:82"}, "properties": {"repobilityId": "72d1cf4d3c116aae", "scanner": "scanner-primary", "fingerprint": "bdba7b7bc1d8a411", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f3b5e5e2a199bf68", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 maker/server/routes/generate.ts:62"}, "properties": {"repobilityId": "6798c74183ade946", "scanner": "scanner-primary", "fingerprint": "f3b5e5e2a199bf68", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5f6628bc8ad01661", "level": "none", "message": {"text": "Commented-code block (5 lines) in maker/server/routes/playtest.ts:106"}, "properties": {"repobilityId": "8e41a156b2da9b8d", "scanner": "scanner-primary", "fingerprint": "5f6628bc8ad01661", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40100a4dc73045e9", "level": "none", "message": {"text": "Commented-code block (6 lines) in maker/server/routes/publish.ts:91"}, "properties": {"repobilityId": "28bf4cb3f3ee8273", "scanner": "scanner-primary", "fingerprint": "40100a4dc73045e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-16ac173fc28b11ae", "level": "none", "message": {"text": "Commented-code block (6 lines) in maker/src/api.ts:105"}, "properties": {"repobilityId": "dd1394661d3eb101", "scanner": "scanner-primary", "fingerprint": "16ac173fc28b11ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d5e273cadf2864c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 maker/src/api.ts:166"}, "properties": {"repobilityId": "4a8628138556a7f2", "scanner": "scanner-primary", "fingerprint": "5d5e273cadf2864c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bbad0de0b98dc982", "level": "none", "message": {"text": "Commented-code block (5 lines) in maker/src/__tests__/api.test.ts:104"}, "properties": {"repobilityId": "62495516b4d7207c", "scanner": "scanner-primary", "fingerprint": "bbad0de0b98dc982", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5ef5ba695d2cf004", "level": "none", "message": {"text": "Commented-code block (6 lines) in maker/src/__tests__/ZoneEditor.test.tsx:385"}, "properties": {"repobilityId": "a4fc4f5fde0f59af", "scanner": "scanner-primary", "fingerprint": "5ef5ba695d2cf004", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c9a1751a1e2cb74", "level": "none", "message": {"text": "Commented-code block (5 lines) in maker/src/components/MapCanvas.tsx:125"}, "properties": {"repobilityId": "e39e5c8af3605961", "scanner": "scanner-primary", "fingerprint": "2c9a1751a1e2cb74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-177eb01cd1b8432b", "level": "none", "message": {"text": "Commented-code block (10 lines) in maker/src/components/Layout.tsx:107"}, "properties": {"repobilityId": "2733032cf744b880", "scanner": "scanner-primary", "fingerprint": "177eb01cd1b8432b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3295e001a225ea7d", "level": "none", "message": {"text": "Commented-code block (5 lines) in maker/src/components/MenuBar.tsx:174"}, "properties": {"repobilityId": "e845ec141b186fcd", "scanner": "scanner-primary", "fingerprint": "3295e001a225ea7d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0db80f22420ac5a", "level": "none", "message": {"text": "Commented-code block (6 lines) in maker/src/pages/ZoneEditor.tsx:1428"}, "properties": {"repobilityId": "06b9b8881e9c943f", "scanner": "scanner-primary", "fingerprint": "d0db80f22420ac5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e31742712ae6bffc", "level": "warning", "message": {"text": "Frontend route `/project/:name` has no Link/navigate to it \u2014 maker/src/__tests__/MenuBar.test.tsx"}, "properties": {"repobilityId": "eafab007d6347f48", "scanner": "scanner-primary", "fingerprint": "e31742712ae6bffc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-eb3d62ca8ff9d392", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/mode"}, "properties": {"repobilityId": "f321456ffb38f96f", "scanner": "scanner-primary", "fingerprint": "eb3d62ca8ff9d392", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dde3adb27bf7eebe", "level": "note", "message": {"text": "Unused endpoint: USE /api"}, "properties": {"repobilityId": "39f1d0868c370f73", "scanner": "scanner-primary", "fingerprint": "dde3adb27bf7eebe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7e2ab93c44650ae3", "level": "note", "message": {"text": "Unused endpoint: USE /api/projects/import"}, "properties": {"repobilityId": "4d7e7b79ed7b12f9", "scanner": "scanner-primary", "fingerprint": "7e2ab93c44650ae3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-728e92394c568abf", "level": "note", "message": {"text": "Unused endpoint: USE /api/projects"}, "properties": {"repobilityId": "f008181dee834754", "scanner": "scanner-primary", "fingerprint": "728e92394c568abf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bb956714e743215", "level": "note", "message": {"text": "Unused endpoint: USE /api/sign-urls"}, "properties": {"repobilityId": "6ddd3894a1568eac", "scanner": "scanner-primary", "fingerprint": "2bb956714e743215", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22a7cc6bf48c507b", "level": "note", "message": {"text": "Unused endpoint: USE /export"}, "properties": {"repobilityId": "67465b9a244bc8da", "scanner": "scanner-primary", "fingerprint": "22a7cc6bf48c507b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2d1c70ac0e5ff085", "level": "note", "message": {"text": "Unused endpoint: USE /settings"}, "properties": {"repobilityId": "264fb6b6956faa9f", "scanner": "scanner-primary", "fingerprint": "2d1c70ac0e5ff085", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76b87f037ae282ca", "level": "note", "message": {"text": "Unused endpoint: USE /pc-sprites"}, "properties": {"repobilityId": "cdabe47120426b5b", "scanner": "scanner-primary", "fingerprint": "76b87f037ae282ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1768d9c69a38ed5", "level": "note", "message": {"text": "Unused endpoint: USE /default-sfx"}, "properties": {"repobilityId": "1f4e8a3dad6b48ee", "scanner": "scanner-primary", "fingerprint": "f1768d9c69a38ed5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1932af12eee90287", "level": "note", "message": {"text": "Unused endpoint: USE /generate"}, "properties": {"repobilityId": "65949dd16ee2e821", "scanner": "scanner-primary", "fingerprint": "1932af12eee90287", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-953095ec69bb641d", "level": "note", "message": {"text": "Unused endpoint: USE /asset-mgmt"}, "properties": {"repobilityId": "d6e89f0fb482d978", "scanner": "scanner-primary", "fingerprint": "953095ec69bb641d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8544f0438153226e", "level": "note", "message": {"text": "Unused endpoint: USE /playtest"}, "properties": {"repobilityId": "2c17b7f2c5cb29e0", "scanner": "scanner-primary", "fingerprint": "8544f0438153226e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5a2c5c4bad4de8a5", "level": "note", "message": {"text": "Unused endpoint: USE /publish"}, "properties": {"repobilityId": "0f7db58663aa7fc7", "scanner": "scanner-primary", "fingerprint": "5a2c5c4bad4de8a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b59435b3211a9df", "level": "note", "message": {"text": "Unused endpoint: USE /assets"}, "properties": {"repobilityId": "5c65d4617f55a1d5", "scanner": "scanner-primary", "fingerprint": "3b59435b3211a9df", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b1dd0bcd9ccd8a41", "level": "note", "message": {"text": "Unused endpoint: USE /api/projects/:name"}, "properties": {"repobilityId": "c868efc87eeeb192", "scanner": "scanner-primary", "fingerprint": "b1dd0bcd9ccd8a41", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-77a21e69b379a5bf", "level": "note", "message": {"text": "Unused endpoint: GET /{*path}"}, "properties": {"repobilityId": "4f4bfd75bf6dc103", "scanner": "scanner-primary", "fingerprint": "77a21e69b379a5bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6236b283b79811b8", "level": "note", "message": {"text": "Unused endpoint: POST /upload"}, "properties": {"repobilityId": "e50b6395a8dcce7b", "scanner": "scanner-primary", "fingerprint": "6236b283b79811b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-051c8cfc37cdcc32", "level": "note", "message": {"text": "Unused endpoint: POST /undo"}, "properties": {"repobilityId": "2550eeee3c5eb68c", "scanner": "scanner-primary", "fingerprint": "051c8cfc37cdcc32", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8affeb0d6aeff6df", "level": "note", "message": {"text": "Unused endpoint: POST /clear"}, "properties": {"repobilityId": "825967dc1d8db049", "scanner": "scanner-primary", "fingerprint": "8affeb0d6aeff6df", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-afc064028ae39ea9", "level": "note", "message": {"text": "Unused endpoint: GET /history"}, "properties": {"repobilityId": "ff9de313fa3f0c69", "scanner": "scanner-primary", "fingerprint": "afc064028ae39ea9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-589ebfdd645350a0", "level": "note", "message": {"text": "Unused endpoint: GET /json"}, "properties": {"repobilityId": "b126c316b24c5c9d", "scanner": "scanner-primary", "fingerprint": "589ebfdd645350a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14dee14ca62f46f5", "level": "note", "message": {"text": "Unused endpoint: GET /nmd"}, "properties": {"repobilityId": "d046d5b0cbf63cfe", "scanner": "scanner-primary", "fingerprint": "14dee14ca62f46f5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fc5a92b082e15c69", "level": "note", "message": {"text": "Unused endpoint: GET /validate"}, "properties": {"repobilityId": "c8a7f5663d87fdb9", "scanner": "scanner-primary", "fingerprint": "fc5a92b082e15c69", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e8673c0ae4344b9", "level": "note", "message": {"text": "Unused endpoint: GET /package"}, "properties": {"repobilityId": "682a692763d3f672", "scanner": "scanner-primary", "fingerprint": "3e8673c0ae4344b9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "eb5882d022769404", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45f114055f72c285", "level": "note", "message": {"text": "Unused endpoint: GET /items"}, "properties": {"repobilityId": "d8b1c8cffebfc223", "scanner": "scanner-primary", "fingerprint": "45f114055f72c285", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1506f0b5d0e0cbe8", "level": "note", "message": {"text": "Unused endpoint: GET /items/:id"}, "properties": {"repobilityId": "25ca641c164c1045", "scanner": "scanner-primary", "fingerprint": "1506f0b5d0e0cbe8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7e2aebb8dfde31c6", "level": "note", "message": {"text": "Unused endpoint: POST /items"}, "properties": {"repobilityId": "d94883e05f47df97", "scanner": "scanner-primary", "fingerprint": "7e2aebb8dfde31c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fdc60d8cc400ae6f", "level": "note", "message": {"text": "Unused endpoint: PUT /items/:id"}, "properties": {"repobilityId": "c575309367652038", "scanner": "scanner-primary", "fingerprint": "fdc60d8cc400ae6f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-38d7c846122a79ea", "level": "note", "message": {"text": "Unused endpoint: DELETE /items/:id"}, "properties": {"repobilityId": "a13a92019d5d7fd7", "scanner": "scanner-primary", "fingerprint": "38d7c846122a79ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ad9f14e31f59a0dc", "level": "note", "message": {"text": "Unused endpoint: GET /npcs"}, "properties": {"repobilityId": "0c67601b9fee2a2d", "scanner": "scanner-primary", "fingerprint": "ad9f14e31f59a0dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4d44cd295b1a16c", "level": "note", "message": {"text": "Unused endpoint: GET /npcs/:id"}, "properties": {"repobilityId": "d17330dde3b78610", "scanner": "scanner-primary", "fingerprint": "c4d44cd295b1a16c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf675cef6c6cac58", "level": "note", "message": {"text": "Unused endpoint: POST /npcs"}, "properties": {"repobilityId": "fcbca2b5f5833308", "scanner": "scanner-primary", "fingerprint": "bf675cef6c6cac58", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b2b5be42e361ba3", "level": "note", "message": {"text": "Unused endpoint: PUT /npcs/:id"}, "properties": {"repobilityId": "64f21d5f0c0cd82c", "scanner": "scanner-primary", "fingerprint": "0b2b5be42e361ba3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-394eb7d541d68795", "level": "note", "message": {"text": "Unused endpoint: DELETE /npcs/:id"}, "properties": {"repobilityId": "2b51f0ad7cf3b7b6", "scanner": "scanner-primary", "fingerprint": "394eb7d541d68795", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-228e6fe290d69046", "level": "note", "message": {"text": "Unused endpoint: GET /character-classes"}, "properties": {"repobilityId": "9ab25b9541ebf4ca", "scanner": "scanner-primary", "fingerprint": "228e6fe290d69046", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bcea47425095855d", "level": "note", "message": {"text": "Unused endpoint: GET /character-classes/:id"}, "properties": {"repobilityId": "0a6d5b7eb366b04c", "scanner": "scanner-primary", "fingerprint": "bcea47425095855d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b155831c4c4bc21d", "level": "note", "message": {"text": "Unused endpoint: POST /character-classes"}, "properties": {"repobilityId": "6325acdb996dc8d5", "scanner": "scanner-primary", "fingerprint": "b155831c4c4bc21d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bae027a09aa4648f", "level": "note", "message": {"text": "Unused endpoint: PUT /character-classes/:id"}, "properties": {"repobilityId": "65a55dab88766320", "scanner": "scanner-primary", "fingerprint": "bae027a09aa4648f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e61b6e95aa328292", "level": "note", "message": {"text": "Unused endpoint: DELETE /character-classes/:id"}, "properties": {"repobilityId": "95e50b03a1a97ebb", "scanner": "scanner-primary", "fingerprint": "e61b6e95aa328292", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bb7ca6597383f72", "level": "note", "message": {"text": "Unused endpoint: GET /races"}, "properties": {"repobilityId": "16f25199060de4d2", "scanner": "scanner-primary", "fingerprint": "2bb7ca6597383f72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e485086d37c4b9b", "level": "note", "message": {"text": "Unused endpoint: GET /races/:id"}, "properties": {"repobilityId": "5e47b3870bcc27bd", "scanner": "scanner-primary", "fingerprint": "4e485086d37c4b9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bdb316b1fb38fda2", "level": "note", "message": {"text": "Unused endpoint: POST /races"}, "properties": {"repobilityId": "d5a7115967ff9af2", "scanner": "scanner-primary", "fingerprint": "bdb316b1fb38fda2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-340c0a34814dd1e4", "level": "note", "message": {"text": "Unused endpoint: PUT /races/:id"}, "properties": {"repobilityId": "25bee4e96dee0848", "scanner": "scanner-primary", "fingerprint": "340c0a34814dd1e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c4b9aa25cc0daea", "level": "note", "message": {"text": "Unused endpoint: DELETE /races/:id"}, "properties": {"repobilityId": "b5303300cd32ed2e", "scanner": "scanner-primary", "fingerprint": "9c4b9aa25cc0daea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c5c6900e4670966", "level": "note", "message": {"text": "Unused endpoint: GET /skills"}, "properties": {"repobilityId": "88417efe834b4c2f", "scanner": "scanner-primary", "fingerprint": "5c5c6900e4670966", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47bcd95181aca757", "level": "note", "message": {"text": "Unused endpoint: GET /skills/:id"}, "properties": {"repobilityId": "be4060e15382c61f", "scanner": "scanner-primary", "fingerprint": "47bcd95181aca757", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce7fe565b4caff57", "level": "note", "message": {"text": "Unused endpoint: POST /skills"}, "properties": {"repobilityId": "fa779446e6549b55", "scanner": "scanner-primary", "fingerprint": "ce7fe565b4caff57", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e85dad2ac0cab7a", "level": "note", "message": {"text": "Unused endpoint: PUT /skills/:id"}, "properties": {"repobilityId": "cdd2f67d7230788e", "scanner": "scanner-primary", "fingerprint": "3e85dad2ac0cab7a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86a5b45740b4360d", "level": "note", "message": {"text": "Unused endpoint: DELETE /skills/:id"}, "properties": {"repobilityId": "c1a4e46d430af10a", "scanner": "scanner-primary", "fingerprint": "86a5b45740b4360d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}