{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1c62ff5336a2b3d5", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/scripts/restore.ts:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/scripts/restore.ts:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dee3d65a1812d8a", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/scripts/dump-openapi.ts:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/scripts/dump-openapi.ts:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de5e0987efdbdc4f", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/billing/sap-push-adapter.ts:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/billing/sap-push-adapter.ts:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c64a43d183ea7f0", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/db/seed.ts:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/db/seed.ts:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84e259781829bd58", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/db/migrate.ts:34", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/db/migrate.ts:34"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-306777472bcae0b2", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/jobs/sap-sync.ts:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/jobs/sap-sync.ts:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60846bba24841d2e", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/CommandPalette.tsx:95", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/CommandPalette.tsx:95"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f3120fbf2c8a14e", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/MailDialog.tsx:79", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/MailDialog.tsx:79"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5401dbaa57afb47", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/pages/Tickets.tsx:120", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/pages/Tickets.tsx:120"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9980d9104825b19", "name": "Dockerfile runs as root: apps/api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b871edb737ffa672", "name": "Docker base image is tag-pinned but not digest-pinned: node:24-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7673561931a5dd33", "name": "Dockerfile runs as root: apps/web/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/web/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3550c1234504a00", "name": "Docker base image is tag-pinned but not digest-pinned: node:24-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-335aed05d35e1128", "name": "Docker base image is tag-pinned but not digest-pinned: caddy:2-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: caddy:2-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47e0e4d4faaa1474", "name": "Insecure pattern 'node_child_process' in apps/api/src/scripts/restore.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/api/src/scripts/restore.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-366cee243c47d4b3", "name": "Insecure pattern 'node_child_process' in apps/api/src/backup/service.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/api/src/backup/service.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f32a7076d65570e1", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/MailDialog.tsx:79", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/MailDialog.tsx:79"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff295ea7a888dd6a", "name": "Very large file: packages/api-client/src/schema.d.ts (3534 lines)", "shortDescription": {"text": "Very large file: packages/api-client/src/schema.d.ts (3534 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 89 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b06b8d86f24c77f9", "name": "Node manifest has dependencies but no lockfile: apps/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-892d4f964c9036e2", "name": "Node manifest has dependencies but no lockfile: packages/api-client/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/api-client/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 21 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 13 placeholder/mock markers across 6 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-efe3a45f72486101", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/pages/TicketDetail.tsx:396", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/pages/TicketDetail.tsx:396"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DEV`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-117ec9b90c70ae72", "name": "Dangling fetch: POST https://login.microsoftonline.com/${env.ENTRA_TENANT_ID}/oauth2/v2.0/token (apps/api/src/mail/graph", "shortDescription": {"text": "Dangling fetch: POST https://login.microsoftonline.com/${env.ENTRA_TENANT_ID}/oauth2/v2.0/token (apps/api/src/mail/graph-client.ts:21)"}, "fullDescription": {"text": "`apps/api/src/mail/graph-client.ts:21` calls `POST https://login.microsoftonline.com/${env.ENTRA_TENANT_ID}/oauth2/v2.0/token` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/https:/login.microsoftonline.com/<p>/oauth2/v2.0/token`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9683c5df1e9ea1fb", "name": "Dangling fetch: POST https://graph.microsoft.com/v1.0/users/${encodeURIComponent(env.GRAPH_SENDER_MAILBOX)}/sendMail (ap", "shortDescription": {"text": "Dangling fetch: POST https://graph.microsoft.com/v1.0/users/${encodeURIComponent(env.GRAPH_SENDER_MAILBOX)}/sendMail (apps/api/src/mail/graph-client.ts:64)"}, "fullDescription": {"text": "`apps/api/src/mail/graph-client.ts:64` calls `POST https://graph.microsoft.com/v1.0/users/${encodeURIComponent(env.GRAPH_SENDER_MAILBOX)}/sendMail` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/https:/graph.microsoft.com/v1.0/users/<p>/sendmail`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b98f40915415824", "name": "Dangling fetch: POST /api/v1/tickets/${ticketId}/attachments (apps/web/src/pages/TicketDetail.tsx:396)", "shortDescription": {"text": "Dangling fetch: POST /api/v1/tickets/${ticketId}/attachments (apps/web/src/pages/TicketDetail.tsx:396)"}, "fullDescription": {"text": "`apps/web/src/pages/TicketDetail.tsx:396` calls `POST /api/v1/tickets/${ticketId}/attachments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/v1/tickets/<p>/attachments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2b60e633b923e343", "name": "Unused endpoint: GET /tickets/:ticketId/mail/report.pdf", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId/mail/report.pdf"}, "fullDescription": {"text": "`apps/api/src/modules/mail/routes.ts` declares `GET /tickets/:ticketId/mail/report.pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c95ab77b6e1d2f13", "name": "Unused endpoint: GET /tickets/:ticketId/mail/report-preview", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId/mail/report-preview"}, "fullDescription": {"text": "`apps/api/src/modules/mail/routes.ts` declares `GET /tickets/:ticketId/mail/report-preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9989f786847f099", "name": "Unused endpoint: POST /tickets/:ticketId/mail/report", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/mail/report"}, "fullDescription": {"text": "`apps/api/src/modules/mail/routes.ts` declares `POST /tickets/:ticketId/mail/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05d986c7c8404c34", "name": "Unused endpoint: POST /tickets/:ticketId/mail/creation-notice", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/mail/creation-notice"}, "fullDescription": {"text": "`apps/api/src/modules/mail/routes.ts` declares `POST /tickets/:ticketId/mail/creation-notice` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b674971718b141f", "name": "Unused endpoint: GET /tickets/:ticketId/mail/log", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId/mail/log"}, "fullDescription": {"text": "`apps/api/src/modules/mail/routes.ts` declares `GET /tickets/:ticketId/mail/log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-841e50bf821e4158", "name": "Unused endpoint: GET /users", "shortDescription": {"text": "Unused endpoint: GET /users"}, "fullDescription": {"text": "`apps/api/src/modules/users/routes.ts` declares `GET /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab48f335a5cddfd6", "name": "Unused endpoint: GET /masterdata/customers", "shortDescription": {"text": "Unused endpoint: GET /masterdata/customers"}, "fullDescription": {"text": "`apps/api/src/modules/masterdata/routes.ts` declares `GET /masterdata/customers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71ec98066eaaf888", "name": "Unused endpoint: GET /masterdata/customers/:cardCode", "shortDescription": {"text": "Unused endpoint: GET /masterdata/customers/:cardCode"}, "fullDescription": {"text": "`apps/api/src/modules/masterdata/routes.ts` declares `GET /masterdata/customers/:cardCode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3241955d20d913e4", "name": "Unused endpoint: GET /masterdata/items", "shortDescription": {"text": "Unused endpoint: GET /masterdata/items"}, "fullDescription": {"text": "`apps/api/src/modules/masterdata/routes.ts` declares `GET /masterdata/items` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ac7d80d4a18cab9", "name": "Unused endpoint: GET /masterdata/items/:itemCode", "shortDescription": {"text": "Unused endpoint: GET /masterdata/items/:itemCode"}, "fullDescription": {"text": "`apps/api/src/modules/masterdata/routes.ts` declares `GET /masterdata/items/:itemCode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-074d276e3adc0971", "name": "Unused endpoint: GET /masterdata/leistungsarten", "shortDescription": {"text": "Unused endpoint: GET /masterdata/leistungsarten"}, "fullDescription": {"text": "`apps/api/src/modules/masterdata/routes.ts` declares `GET /masterdata/leistungsarten` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76fe223a158845f6", "name": "Unused endpoint: GET /auth/login", "shortDescription": {"text": "Unused endpoint: GET /auth/login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `GET /auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1480187b44a5fd90", "name": "Unused endpoint: GET /auth/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/callback"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `GET /auth/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2d21770371f71a3", "name": "Unused endpoint: POST /auth/dev-login", "shortDescription": {"text": "Unused endpoint: POST /auth/dev-login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `POST /auth/dev-login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac42422b23e45104", "name": "Unused endpoint: GET /auth/me", "shortDescription": {"text": "Unused endpoint: GET /auth/me"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `GET /auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d68fdb93852f50da", "name": "Unused endpoint: GET /events/stream", "shortDescription": {"text": "Unused endpoint: GET /events/stream"}, "fullDescription": {"text": "`apps/api/src/modules/events/routes.ts` declares `GET /events/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c236625afb6a8cb", "name": "Unused endpoint: GET /ready", "shortDescription": {"text": "Unused endpoint: GET /ready"}, "fullDescription": {"text": "`apps/api/src/modules/health/routes.ts` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbdf86b5d7794f15", "name": "Unused endpoint: POST /tickets/:ticketId/billing/handover", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/billing/handover"}, "fullDescription": {"text": "`apps/api/src/modules/billing/routes.ts` declares `POST /tickets/:ticketId/billing/handover` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc721ab201e809a1", "name": "Unused endpoint: GET /admin/api-clients", "shortDescription": {"text": "Unused endpoint: GET /admin/api-clients"}, "fullDescription": {"text": "`apps/api/src/modules/admin/api-clients.ts` declares `GET /admin/api-clients` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e850a876e8eeecb", "name": "Unused endpoint: POST /admin/api-clients", "shortDescription": {"text": "Unused endpoint: POST /admin/api-clients"}, "fullDescription": {"text": "`apps/api/src/modules/admin/api-clients.ts` declares `POST /admin/api-clients` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32d9a78e05b1a0be", "name": "Unused endpoint: DELETE /admin/api-clients/:clientId", "shortDescription": {"text": "Unused endpoint: DELETE /admin/api-clients/:clientId"}, "fullDescription": {"text": "`apps/api/src/modules/admin/api-clients.ts` declares `DELETE /admin/api-clients/:clientId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0aba7f1883cb96f2", "name": "Unused endpoint: GET /admin/users", "shortDescription": {"text": "Unused endpoint: GET /admin/users"}, "fullDescription": {"text": "`apps/api/src/modules/admin/users.ts` declares `GET /admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c1cc08ace5445e9", "name": "Unused endpoint: PATCH /admin/users/:userId", "shortDescription": {"text": "Unused endpoint: PATCH /admin/users/:userId"}, "fullDescription": {"text": "`apps/api/src/modules/admin/users.ts` declares `PATCH /admin/users/:userId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecd4ac639e91d0ff", "name": "Unused endpoint: POST /admin/backups", "shortDescription": {"text": "Unused endpoint: POST /admin/backups"}, "fullDescription": {"text": "`apps/api/src/modules/admin/backups.ts` declares `POST /admin/backups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11f4d638ad454260", "name": "Unused endpoint: GET /admin/backups", "shortDescription": {"text": "Unused endpoint: GET /admin/backups"}, "fullDescription": {"text": "`apps/api/src/modules/admin/backups.ts` declares `GET /admin/backups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64ebfd94ba3122ea", "name": "Unused endpoint: GET /admin/backups/:backupId/download", "shortDescription": {"text": "Unused endpoint: GET /admin/backups/:backupId/download"}, "fullDescription": {"text": "`apps/api/src/modules/admin/backups.ts` declares `GET /admin/backups/:backupId/download` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7250dec2d537f9c4", "name": "Unused endpoint: POST /admin/masterdata/sync", "shortDescription": {"text": "Unused endpoint: POST /admin/masterdata/sync"}, "fullDescription": {"text": "`apps/api/src/modules/admin/routes.ts` declares `POST /admin/masterdata/sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7392e7b4f7d94ebc", "name": "Unused endpoint: GET /admin/masterdata/sync-runs", "shortDescription": {"text": "Unused endpoint: GET /admin/masterdata/sync-runs"}, "fullDescription": {"text": "`apps/api/src/modules/admin/routes.ts` declares `GET /admin/masterdata/sync-runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba2899e4b3fac8b5", "name": "Unused endpoint: GET /admin/zeiteintrag-typen", "shortDescription": {"text": "Unused endpoint: GET /admin/zeiteintrag-typen"}, "fullDescription": {"text": "`apps/api/src/modules/admin/routes.ts` declares `GET /admin/zeiteintrag-typen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01d6fd385ab13ab2", "name": "Unused endpoint: POST /admin/zeiteintrag-typen", "shortDescription": {"text": "Unused endpoint: POST /admin/zeiteintrag-typen"}, "fullDescription": {"text": "`apps/api/src/modules/admin/routes.ts` declares `POST /admin/zeiteintrag-typen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-278846e3a464dc3d", "name": "Unused endpoint: PATCH /admin/zeiteintrag-typen/:typId", "shortDescription": {"text": "Unused endpoint: PATCH /admin/zeiteintrag-typen/:typId"}, "fullDescription": {"text": "`apps/api/src/modules/admin/routes.ts` declares `PATCH /admin/zeiteintrag-typen/:typId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-679ff83f76450c1e", "name": "Unused endpoint: GET /tickets", "shortDescription": {"text": "Unused endpoint: GET /tickets"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `GET /tickets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d637add0a9918774", "name": "Unused endpoint: POST /tickets", "shortDescription": {"text": "Unused endpoint: POST /tickets"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `POST /tickets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6f712e572f41727", "name": "Unused endpoint: GET /tickets/:ticketId", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `GET /tickets/:ticketId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f26ca3dbed1c568", "name": "Unused endpoint: PATCH /tickets/:ticketId", "shortDescription": {"text": "Unused endpoint: PATCH /tickets/:ticketId"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `PATCH /tickets/:ticketId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66722f5d6a8f3ea2", "name": "Unused endpoint: POST /tickets/:ticketId/status", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/status"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `POST /tickets/:ticketId/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ca2fb2a0e604a33", "name": "Unused endpoint: POST /tickets/:ticketId/assign", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/assign"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `POST /tickets/:ticketId/assign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e80ee5eb9f39c34", "name": "Unused endpoint: GET /tickets/:ticketId/audit", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId/audit"}, "fullDescription": {"text": "`apps/api/src/modules/tickets/routes.ts` declares `GET /tickets/:ticketId/audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0a7c6603bc902e1", "name": "Unused endpoint: GET /zeiteintrag-typen", "shortDescription": {"text": "Unused endpoint: GET /zeiteintrag-typen"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/time-entries.ts` declares `GET /zeiteintrag-typen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c84339aa341518e9", "name": "Unused endpoint: GET /tickets/:ticketId/time-entries", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId/time-entries"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/time-entries.ts` declares `GET /tickets/:ticketId/time-entries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-842f2cf1f01d4a3c", "name": "Unused endpoint: POST /tickets/:ticketId/time-entries", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/time-entries"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/time-entries.ts` declares `POST /tickets/:ticketId/time-entries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1a06aea79035487", "name": "Unused endpoint: PATCH /time-entries/:timeEntryId", "shortDescription": {"text": "Unused endpoint: PATCH /time-entries/:timeEntryId"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/time-entries.ts` declares `PATCH /time-entries/:timeEntryId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e93c12d0359c4538", "name": "Unused endpoint: DELETE /time-entries/:timeEntryId", "shortDescription": {"text": "Unused endpoint: DELETE /time-entries/:timeEntryId"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/time-entries.ts` declares `DELETE /time-entries/:timeEntryId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-131d7ba1ada3be3a", "name": "Unused endpoint: GET /tickets/:ticketId/positions", "shortDescription": {"text": "Unused endpoint: GET /tickets/:ticketId/positions"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/positions.ts` declares `GET /tickets/:ticketId/positions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e94c79ec4880b619", "name": "Unused endpoint: POST /tickets/:ticketId/positions", "shortDescription": {"text": "Unused endpoint: POST /tickets/:ticketId/positions"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/positions.ts` declares `POST /tickets/:ticketId/positions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a67686db5319c5c0", "name": "Unused endpoint: PATCH /tickets/:ticketId/positions/:positionId", "shortDescription": {"text": "Unused endpoint: PATCH /tickets/:ticketId/positions/:positionId"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/positions.ts` declares `PATCH /tickets/:ticketId/positions/:positionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6678c7a76d7048e", "name": "Unused endpoint: DELETE /tickets/:ticketId/positions/:positionId", "shortDescription": {"text": "Unused endpoint: DELETE /tickets/:ticketId/positions/:positionId"}, "fullDescription": {"text": "`apps/api/src/modules/erfassung/positions.ts` declares `DELETE /tickets/:ticketId/positions/:positionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a98c4983bfb91dc1", "name": "Unused endpoint: GET /kasse/unbilled-tickets", "shortDescription": {"text": "Unused endpoint: GET /kasse/unbilled-tickets"}, "fullDescription": {"text": "`apps/api/src/modules/kasse/routes.ts` declares `GET /kasse/unbilled-tickets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b71f1fc7ee8d28f3", "name": "Unused endpoint: POST /kasse/tickets/:ticketId/confirm", "shortDescription": {"text": "Unused endpoint: POST /kasse/tickets/:ticketId/confirm"}, "fullDescription": {"text": "`apps/api/src/modules/kasse/routes.ts` declares `POST /kasse/tickets/:ticketId/confirm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23079"}, "properties": {"repository": "xxiten/nexxus", "repoUrl": "https://github.com/xxiten/nexxus", "branch": "main"}, "results": [{"ruleId": "scanner-1c62ff5336a2b3d5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/scripts/restore.ts:33"}, "properties": {"repobilityId": "1c241a9947d4d422", "scanner": "scanner-primary", "fingerprint": "1c62ff5336a2b3d5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6dee3d65a1812d8a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/scripts/dump-openapi.ts:14"}, "properties": {"repobilityId": "1011792e12c82e67", "scanner": "scanner-primary", "fingerprint": "6dee3d65a1812d8a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de5e0987efdbdc4f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/billing/sap-push-adapter.ts:29"}, "properties": {"repobilityId": "7e28072f2b02bde1", "scanner": "scanner-primary", "fingerprint": "de5e0987efdbdc4f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4c64a43d183ea7f0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/db/seed.ts:24"}, "properties": {"repobilityId": "f2fdc56da7066198", "scanner": "scanner-primary", "fingerprint": "4c64a43d183ea7f0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-84e259781829bd58", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/db/migrate.ts:34"}, "properties": {"repobilityId": "4c947c823da5fa9d", "scanner": "scanner-primary", "fingerprint": "84e259781829bd58", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-306777472bcae0b2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/jobs/sap-sync.ts:30"}, "properties": {"repobilityId": "7d64b648895035d5", "scanner": "scanner-primary", "fingerprint": "306777472bcae0b2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-60846bba24841d2e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/CommandPalette.tsx:95"}, "properties": {"repobilityId": "6397c6bea18e8bb0", "scanner": "scanner-primary", "fingerprint": "60846bba24841d2e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8f3120fbf2c8a14e", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/MailDialog.tsx:79"}, "properties": {"repobilityId": "ffaae4edab8bcaa5", "scanner": "scanner-primary", "fingerprint": "8f3120fbf2c8a14e", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-f5401dbaa57afb47", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/pages/Tickets.tsx:120"}, "properties": {"repobilityId": "3c12865792cdc294", "scanner": "scanner-primary", "fingerprint": "f5401dbaa57afb47", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d9980d9104825b19", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "properties": {"repobilityId": "e591b11d8a0c1fe7", "scanner": "scanner-primary", "fingerprint": "d9980d9104825b19", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b871edb737ffa672", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-slim"}, "properties": {"repobilityId": "8c59beb1d09403d2", "scanner": "scanner-primary", "fingerprint": "b871edb737ffa672", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7673561931a5dd33", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/web/Dockerfile"}, "properties": {"repobilityId": "d68d7937b96d047d", "scanner": "scanner-primary", "fingerprint": "7673561931a5dd33", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e3550c1234504a00", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-slim"}, "properties": {"repobilityId": "9a18e022ada71233", "scanner": "scanner-primary", "fingerprint": "e3550c1234504a00", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-335aed05d35e1128", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: caddy:2-alpine"}, "properties": {"repobilityId": "324648feb349ec5f", "scanner": "scanner-primary", "fingerprint": "335aed05d35e1128", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-47e0e4d4faaa1474", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/api/src/scripts/restore.ts:11"}, "properties": {"repobilityId": "41d9aabf2e374a3e", "scanner": "scanner-primary", "fingerprint": "47e0e4d4faaa1474", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/src/scripts/restore.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-366cee243c47d4b3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/api/src/backup/service.ts:6"}, "properties": {"repobilityId": "c229b08e87431de6", "scanner": "scanner-primary", "fingerprint": "366cee243c47d4b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/src/backup/service.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-f32a7076d65570e1", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/MailDialog.tsx:79"}, "properties": {"repobilityId": "2070f0897b0b27b3", "scanner": "scanner-primary", "fingerprint": "f32a7076d65570e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/MailDialog.tsx"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ff295ea7a888dd6a", "level": "note", "message": {"text": "Very large file: packages/api-client/src/schema.d.ts (3534 lines)"}, "properties": {"repobilityId": "f619f2272a9eb637", "scanner": "scanner-primary", "fingerprint": "ff295ea7a888dd6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6609957a0ac139af", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b06b8d86f24c77f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "properties": {"repobilityId": "ce77cd34ed0306d4", "scanner": "scanner-primary", "fingerprint": "b06b8d86f24c77f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-892d4f964c9036e2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/api-client/package.json"}, "properties": {"repobilityId": "e1c2e42c288c295a", "scanner": "scanner-primary", "fingerprint": "892d4f964c9036e2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api-client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "00a5ec35a5bf4094", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f99dcbf96449f0e5", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f089da2bcc1974d6", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "72ec16508f2cd804", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "90106857f1443208", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8e03c0ff040c431e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-efe3a45f72486101", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/pages/TicketDetail.tsx:396"}, "properties": {"repobilityId": "2e8513ad361ffa71", "scanner": "scanner-primary", "fingerprint": "efe3a45f72486101", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-117ec9b90c70ae72", "level": "error", "message": {"text": "Dangling fetch: POST https://login.microsoftonline.com/${env.ENTRA_TENANT_ID}/oauth2/v2.0/token (apps/api/src/mail/graph-client.ts:21)"}, "properties": {"repobilityId": "344b0e4cb1cce74b", "scanner": "scanner-primary", "fingerprint": "117ec9b90c70ae72", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-9683c5df1e9ea1fb", "level": "error", "message": {"text": "Dangling fetch: POST https://graph.microsoft.com/v1.0/users/${encodeURIComponent(env.GRAPH_SENDER_MAILBOX)}/sendMail (apps/api/src/mail/graph-client.ts:64)"}, "properties": {"repobilityId": "9019acde8b3dba6c", "scanner": "scanner-primary", "fingerprint": "9683c5df1e9ea1fb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1b98f40915415824", "level": "error", "message": {"text": "Dangling fetch: POST /api/v1/tickets/${ticketId}/attachments (apps/web/src/pages/TicketDetail.tsx:396)"}, "properties": {"repobilityId": "3c95425b8ff4346d", "scanner": "scanner-primary", "fingerprint": "1b98f40915415824", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-2b60e633b923e343", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId/mail/report.pdf"}, "properties": {"repobilityId": "3cf5b6024419c6bd", "scanner": "scanner-primary", "fingerprint": "2b60e633b923e343", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c95ab77b6e1d2f13", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId/mail/report-preview"}, "properties": {"repobilityId": "f704ce1d1d0b5933", "scanner": "scanner-primary", "fingerprint": "c95ab77b6e1d2f13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9989f786847f099", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/mail/report"}, "properties": {"repobilityId": "cb03bda5dd7d191a", "scanner": "scanner-primary", "fingerprint": "f9989f786847f099", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05d986c7c8404c34", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/mail/creation-notice"}, "properties": {"repobilityId": "dcd6f8c305b605df", "scanner": "scanner-primary", "fingerprint": "05d986c7c8404c34", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b674971718b141f", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId/mail/log"}, "properties": {"repobilityId": "5e8479f4d534fac2", "scanner": "scanner-primary", "fingerprint": "8b674971718b141f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-841e50bf821e4158", "level": "note", "message": {"text": "Unused endpoint: GET /users"}, "properties": {"repobilityId": "77c0f1c511542020", "scanner": "scanner-primary", "fingerprint": "841e50bf821e4158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab48f335a5cddfd6", "level": "note", "message": {"text": "Unused endpoint: GET /masterdata/customers"}, "properties": {"repobilityId": "260f92da94716dac", "scanner": "scanner-primary", "fingerprint": "ab48f335a5cddfd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71ec98066eaaf888", "level": "note", "message": {"text": "Unused endpoint: GET /masterdata/customers/:cardCode"}, "properties": {"repobilityId": "3bb85f881360a354", "scanner": "scanner-primary", "fingerprint": "71ec98066eaaf888", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3241955d20d913e4", "level": "note", "message": {"text": "Unused endpoint: GET /masterdata/items"}, "properties": {"repobilityId": "b3503c19782eaaf1", "scanner": "scanner-primary", "fingerprint": "3241955d20d913e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ac7d80d4a18cab9", "level": "note", "message": {"text": "Unused endpoint: GET /masterdata/items/:itemCode"}, "properties": {"repobilityId": "778ec4527ef04a0a", "scanner": "scanner-primary", "fingerprint": "8ac7d80d4a18cab9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-074d276e3adc0971", "level": "note", "message": {"text": "Unused endpoint: GET /masterdata/leistungsarten"}, "properties": {"repobilityId": "de2ff131c64748bc", "scanner": "scanner-primary", "fingerprint": "074d276e3adc0971", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76fe223a158845f6", "level": "note", "message": {"text": "Unused endpoint: GET /auth/login"}, "properties": {"repobilityId": "8733e0b76913e833", "scanner": "scanner-primary", "fingerprint": "76fe223a158845f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1480187b44a5fd90", "level": "note", "message": {"text": "Unused endpoint: GET /auth/callback"}, "properties": {"repobilityId": "bfd746fc2afcaca1", "scanner": "scanner-primary", "fingerprint": "1480187b44a5fd90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2d21770371f71a3", "level": "note", "message": {"text": "Unused endpoint: POST /auth/dev-login"}, "properties": {"repobilityId": "c846ad98671c4016", "scanner": "scanner-primary", "fingerprint": "b2d21770371f71a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "2087c04607468e27", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac42422b23e45104", "level": "note", "message": {"text": "Unused endpoint: GET /auth/me"}, "properties": {"repobilityId": "16d08d1b44e0587e", "scanner": "scanner-primary", "fingerprint": "ac42422b23e45104", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d68fdb93852f50da", "level": "note", "message": {"text": "Unused endpoint: GET /events/stream"}, "properties": {"repobilityId": "75774e5e13b23593", "scanner": "scanner-primary", "fingerprint": "d68fdb93852f50da", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c236625afb6a8cb", "level": "note", "message": {"text": "Unused endpoint: GET /ready"}, "properties": {"repobilityId": "aa701a42d3a19e69", "scanner": "scanner-primary", "fingerprint": "8c236625afb6a8cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dbdf86b5d7794f15", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/billing/handover"}, "properties": {"repobilityId": "ba66d677c1fd7cbc", "scanner": "scanner-primary", "fingerprint": "dbdf86b5d7794f15", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dc721ab201e809a1", "level": "note", "message": {"text": "Unused endpoint: GET /admin/api-clients"}, "properties": {"repobilityId": "0ac917c16cd2fbb5", "scanner": "scanner-primary", "fingerprint": "dc721ab201e809a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e850a876e8eeecb", "level": "note", "message": {"text": "Unused endpoint: POST /admin/api-clients"}, "properties": {"repobilityId": "2e71cb11131dcb73", "scanner": "scanner-primary", "fingerprint": "6e850a876e8eeecb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32d9a78e05b1a0be", "level": "note", "message": {"text": "Unused endpoint: DELETE /admin/api-clients/:clientId"}, "properties": {"repobilityId": "1498fd48cf479e0a", "scanner": "scanner-primary", "fingerprint": "32d9a78e05b1a0be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0aba7f1883cb96f2", "level": "note", "message": {"text": "Unused endpoint: GET /admin/users"}, "properties": {"repobilityId": "aa01f0182edb67a5", "scanner": "scanner-primary", "fingerprint": "0aba7f1883cb96f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c1cc08ace5445e9", "level": "note", "message": {"text": "Unused endpoint: PATCH /admin/users/:userId"}, "properties": {"repobilityId": "d1515836d053bbcb", "scanner": "scanner-primary", "fingerprint": "6c1cc08ace5445e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ecd4ac639e91d0ff", "level": "note", "message": {"text": "Unused endpoint: POST /admin/backups"}, "properties": {"repobilityId": "50510b2cabbbedea", "scanner": "scanner-primary", "fingerprint": "ecd4ac639e91d0ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11f4d638ad454260", "level": "note", "message": {"text": "Unused endpoint: GET /admin/backups"}, "properties": {"repobilityId": "78c45de6ea2e823f", "scanner": "scanner-primary", "fingerprint": "11f4d638ad454260", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64ebfd94ba3122ea", "level": "note", "message": {"text": "Unused endpoint: GET /admin/backups/:backupId/download"}, "properties": {"repobilityId": "ef998858d65d39dc", "scanner": "scanner-primary", "fingerprint": "64ebfd94ba3122ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7250dec2d537f9c4", "level": "note", "message": {"text": "Unused endpoint: POST /admin/masterdata/sync"}, "properties": {"repobilityId": "e20bc826ce378540", "scanner": "scanner-primary", "fingerprint": "7250dec2d537f9c4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7392e7b4f7d94ebc", "level": "note", "message": {"text": "Unused endpoint: GET /admin/masterdata/sync-runs"}, "properties": {"repobilityId": "5245ab8a805535d0", "scanner": "scanner-primary", "fingerprint": "7392e7b4f7d94ebc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba2899e4b3fac8b5", "level": "note", "message": {"text": "Unused endpoint: GET /admin/zeiteintrag-typen"}, "properties": {"repobilityId": "013a48fa4b5d0be2", "scanner": "scanner-primary", "fingerprint": "ba2899e4b3fac8b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01d6fd385ab13ab2", "level": "note", "message": {"text": "Unused endpoint: POST /admin/zeiteintrag-typen"}, "properties": {"repobilityId": "37b0e95a4e992b00", "scanner": "scanner-primary", "fingerprint": "01d6fd385ab13ab2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-278846e3a464dc3d", "level": "note", "message": {"text": "Unused endpoint: PATCH /admin/zeiteintrag-typen/:typId"}, "properties": {"repobilityId": "d50529d8ed3cce18", "scanner": "scanner-primary", "fingerprint": "278846e3a464dc3d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-679ff83f76450c1e", "level": "note", "message": {"text": "Unused endpoint: GET /tickets"}, "properties": {"repobilityId": "d3afbd261500bce6", "scanner": "scanner-primary", "fingerprint": "679ff83f76450c1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d637add0a9918774", "level": "note", "message": {"text": "Unused endpoint: POST /tickets"}, "properties": {"repobilityId": "bc108b33444111b2", "scanner": "scanner-primary", "fingerprint": "d637add0a9918774", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6f712e572f41727", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId"}, "properties": {"repobilityId": "7ec603783f5635cb", "scanner": "scanner-primary", "fingerprint": "a6f712e572f41727", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f26ca3dbed1c568", "level": "note", "message": {"text": "Unused endpoint: PATCH /tickets/:ticketId"}, "properties": {"repobilityId": "fe6104ecae0139f0", "scanner": "scanner-primary", "fingerprint": "6f26ca3dbed1c568", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-66722f5d6a8f3ea2", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/status"}, "properties": {"repobilityId": "5f8285ea500e3177", "scanner": "scanner-primary", "fingerprint": "66722f5d6a8f3ea2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ca2fb2a0e604a33", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/assign"}, "properties": {"repobilityId": "e740a868ce2d287a", "scanner": "scanner-primary", "fingerprint": "2ca2fb2a0e604a33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e80ee5eb9f39c34", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId/audit"}, "properties": {"repobilityId": "eb97ece8cab40c2f", "scanner": "scanner-primary", "fingerprint": "0e80ee5eb9f39c34", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0a7c6603bc902e1", "level": "note", "message": {"text": "Unused endpoint: GET /zeiteintrag-typen"}, "properties": {"repobilityId": "cbefbb9c680cffc1", "scanner": "scanner-primary", "fingerprint": "c0a7c6603bc902e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c84339aa341518e9", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId/time-entries"}, "properties": {"repobilityId": "40ab1e4c9f9bf95c", "scanner": "scanner-primary", "fingerprint": "c84339aa341518e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-842f2cf1f01d4a3c", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/time-entries"}, "properties": {"repobilityId": "dafd4dd764490323", "scanner": "scanner-primary", "fingerprint": "842f2cf1f01d4a3c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1a06aea79035487", "level": "note", "message": {"text": "Unused endpoint: PATCH /time-entries/:timeEntryId"}, "properties": {"repobilityId": "1c129af45ef30b3b", "scanner": "scanner-primary", "fingerprint": "c1a06aea79035487", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e93c12d0359c4538", "level": "note", "message": {"text": "Unused endpoint: DELETE /time-entries/:timeEntryId"}, "properties": {"repobilityId": "0886bcf2c260aeeb", "scanner": "scanner-primary", "fingerprint": "e93c12d0359c4538", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-131d7ba1ada3be3a", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/:ticketId/positions"}, "properties": {"repobilityId": "fe0a1e945201415e", "scanner": "scanner-primary", "fingerprint": "131d7ba1ada3be3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e94c79ec4880b619", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/:ticketId/positions"}, "properties": {"repobilityId": "19e3e4d797d16c7f", "scanner": "scanner-primary", "fingerprint": "e94c79ec4880b619", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a67686db5319c5c0", "level": "note", "message": {"text": "Unused endpoint: PATCH /tickets/:ticketId/positions/:positionId"}, "properties": {"repobilityId": "29ac551ab3af6788", "scanner": "scanner-primary", "fingerprint": "a67686db5319c5c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f6678c7a76d7048e", "level": "note", "message": {"text": "Unused endpoint: DELETE /tickets/:ticketId/positions/:positionId"}, "properties": {"repobilityId": "e2ecedfa520b2dbb", "scanner": "scanner-primary", "fingerprint": "f6678c7a76d7048e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a98c4983bfb91dc1", "level": "note", "message": {"text": "Unused endpoint: GET /kasse/unbilled-tickets"}, "properties": {"repobilityId": "cf223172390a5260", "scanner": "scanner-primary", "fingerprint": "a98c4983bfb91dc1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b71f1fc7ee8d28f3", "level": "note", "message": {"text": "Unused endpoint: POST /kasse/tickets/:ticketId/confirm"}, "properties": {"repobilityId": "5cb04887ae26c094", "scanner": "scanner-primary", "fingerprint": "b71f1fc7ee8d28f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}