{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d44455c165cfa36a", "name": "Stray `console.log` in TS/JS \u2014 wa-qr-local.js:76", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 wa-qr-local.js:76"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61ebd79c06cb43bc", "name": "Stray `console.log` in TS/JS \u2014 server.js:139", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:139"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf50b44f80391917", "name": "Stray `console.log` in TS/JS \u2014 whatsapp.js:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 whatsapp.js:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d92aafa27f1b0bb6", "name": "Insecure pattern 'cors_wildcard' in server.js:40", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in server.js:40"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd80c2be61cc854a", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/report.html:242", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/report.html:242"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9613c5f78a21cacd", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/zone-admin.html:404", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/zone-admin.html:404"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f773dfd8f20bd35", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:2923", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:2923"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae78842a7f7d3dbf", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/admin.html:470", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/admin.html:470"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f5c734853895d2d", "name": "Insecure pattern 'local_storage_auth_token' in public/admin.html:415", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in public/admin.html:415"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4ea747cb51c1d91", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/track.html:118", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/track.html:118"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-391dd1e2faaa9af7", "name": "Very large file: server.js (1907 lines)", "shortDescription": {"text": "Very large file: server.js (1907 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 7 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 28 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea5764e80d4ea8a9", "name": "Commented-code block (5 lines) in db.js:105", "shortDescription": {"text": "Commented-code block (5 lines) in db.js:105"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-006eca92ea91689f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 wa-qr-local.js:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 wa-qr-local.js:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-237db2326d87aa82", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:352", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:352"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3108fde870323c50", "name": "Commented-code block (5 lines) in whatsapp.js:11", "shortDescription": {"text": "Commented-code block (5 lines) in whatsapp.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa60b20d8915409a", "name": "Dangling fetch: GET /state (wa-qr-local.js:68)", "shortDescription": {"text": "Dangling fetch: GET /state (wa-qr-local.js:68)"}, "fullDescription": {"text": "`wa-qr-local.js:68` calls `GET /state` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/state`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1340c42d8e262210", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (server.js:1110)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (server.js:1110)"}, "fullDescription": {"text": "`server.js:1110` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2219c3bc8a93e7da", "name": "Unused endpoint: GET /api/push/key", "shortDescription": {"text": "Unused endpoint: GET /api/push/key"}, "fullDescription": {"text": "`server.js` declares `GET /api/push/key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c622e6243ccd6e0a", "name": "Unused endpoint: POST /api/push/subscribe", "shortDescription": {"text": "Unused endpoint: POST /api/push/subscribe"}, "fullDescription": {"text": "`server.js` declares `POST /api/push/subscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81560ec224758e3e", "name": "Unused endpoint: POST /api/push/test", "shortDescription": {"text": "Unused endpoint: POST /api/push/test"}, "fullDescription": {"text": "`server.js` declares `POST /api/push/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-974a3eaa1bc4d9bb", "name": "Unused endpoint: GET /api/live", "shortDescription": {"text": "Unused endpoint: GET /api/live"}, "fullDescription": {"text": "`server.js` declares `GET /api/live` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aa4b2518cbbbfa2", "name": "Unused endpoint: GET /api/config", "shortDescription": {"text": "Unused endpoint: GET /api/config"}, "fullDescription": {"text": "`server.js` declares `GET /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c95aff5c3c9effde", "name": "Unused endpoint: POST /api/admin/master-wa/reset", "shortDescription": {"text": "Unused endpoint: POST /api/admin/master-wa/reset"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/master-wa/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963710f42a2c8219", "name": "Unused endpoint: GET /api/status", "shortDescription": {"text": "Unused endpoint: GET /api/status"}, "fullDescription": {"text": "`server.js` declares `GET /api/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52c749f6e1f92c92", "name": "Unused endpoint: GET /wa-admin", "shortDescription": {"text": "Unused endpoint: GET /wa-admin"}, "fullDescription": {"text": "`server.js` declares `GET /wa-admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b37265900e79a8a", "name": "Unused endpoint: GET /api/stats", "shortDescription": {"text": "Unused endpoint: GET /api/stats"}, "fullDescription": {"text": "`server.js` declares `GET /api/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7f102b26f9924f1", "name": "Unused endpoint: GET /api/report", "shortDescription": {"text": "Unused endpoint: GET /api/report"}, "fullDescription": {"text": "`server.js` declares `GET /api/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f6a18c0257ac067", "name": "Unused endpoint: GET /api/recent-donors", "shortDescription": {"text": "Unused endpoint: GET /api/recent-donors"}, "fullDescription": {"text": "`server.js` declares `GET /api/recent-donors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2eca0afcf3464330", "name": "Unused endpoint: GET /api/areas", "shortDescription": {"text": "Unused endpoint: GET /api/areas"}, "fullDescription": {"text": "`server.js` declares `GET /api/areas` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7062efb491c8337e", "name": "Unused endpoint: GET /api/detect-area", "shortDescription": {"text": "Unused endpoint: GET /api/detect-area"}, "fullDescription": {"text": "`server.js` declares `GET /api/detect-area` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8de9ecb6c0a17e94", "name": "Unused endpoint: GET /api/radar", "shortDescription": {"text": "Unused endpoint: GET /api/radar"}, "fullDescription": {"text": "`server.js` declares `GET /api/radar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d30aa36f85b5752f", "name": "Unused endpoint: GET /api/activity", "shortDescription": {"text": "Unused endpoint: GET /api/activity"}, "fullDescription": {"text": "`server.js` declares `GET /api/activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83921af7889cbba2", "name": "Unused endpoint: GET /api/responses", "shortDescription": {"text": "Unused endpoint: GET /api/responses"}, "fullDescription": {"text": "`server.js` declares `GET /api/responses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a369f71214e9ef56", "name": "Unused endpoint: GET /api/leaderboard", "shortDescription": {"text": "Unused endpoint: GET /api/leaderboard"}, "fullDescription": {"text": "`server.js` declares `GET /api/leaderboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6211b796901a93e6", "name": "Unused endpoint: POST /api/respond", "shortDescription": {"text": "Unused endpoint: POST /api/respond"}, "fullDescription": {"text": "`server.js` declares `POST /api/respond` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8875f97da3041935", "name": "Unused endpoint: GET /api/donors", "shortDescription": {"text": "Unused endpoint: GET /api/donors"}, "fullDescription": {"text": "`server.js` declares `GET /api/donors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9a7211942a5aa1e", "name": "Unused endpoint: POST /api/admin/reveal-phone", "shortDescription": {"text": "Unused endpoint: POST /api/admin/reveal-phone"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/reveal-phone` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69c8ae1ed4d1a92a", "name": "Unused endpoint: POST /api/admin/donor/:id/update", "shortDescription": {"text": "Unused endpoint: POST /api/admin/donor/:id/update"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/donor/:id/update` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72637bbd01bba6a7", "name": "Unused endpoint: DELETE /api/admin/donor/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/admin/donor/:id"}, "fullDescription": {"text": "`server.js` declares `DELETE /api/admin/donor/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b7dceafbae2d81a", "name": "Unused endpoint: POST /api/donors/register", "shortDescription": {"text": "Unused endpoint: POST /api/donors/register"}, "fullDescription": {"text": "`server.js` declares `POST /api/donors/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b57f968fd784102a", "name": "Unused endpoint: PUT /api/donors/:id", "shortDescription": {"text": "Unused endpoint: PUT /api/donors/:id"}, "fullDescription": {"text": "`server.js` declares `PUT /api/donors/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4edf22d2be991c2", "name": "Unused endpoint: DELETE /api/donors/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/donors/:id"}, "fullDescription": {"text": "`server.js` declares `DELETE /api/donors/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ca9429067d5fb4a", "name": "Unused endpoint: POST /api/donors/:id/donated", "shortDescription": {"text": "Unused endpoint: POST /api/donors/:id/donated"}, "fullDescription": {"text": "`server.js` declares `POST /api/donors/:id/donated` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c60f4d5b3ed2d108", "name": "Unused endpoint: POST /api/scan", "shortDescription": {"text": "Unused endpoint: POST /api/scan"}, "fullDescription": {"text": "`server.js` declares `POST /api/scan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bdf2da19100b851", "name": "Unused endpoint: GET /api/donors/:id/profile", "shortDescription": {"text": "Unused endpoint: GET /api/donors/:id/profile"}, "fullDescription": {"text": "`server.js` declares `GET /api/donors/:id/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f3e0f214cd99b9d", "name": "Unused endpoint: POST /api/donors/:id/profile", "shortDescription": {"text": "Unused endpoint: POST /api/donors/:id/profile"}, "fullDescription": {"text": "`server.js` declares `POST /api/donors/:id/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9dd0c065927de3f0", "name": "Unused endpoint: GET /api/track/:id", "shortDescription": {"text": "Unused endpoint: GET /api/track/:id"}, "fullDescription": {"text": "`server.js` declares `GET /api/track/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fadcef1d5292cf8a", "name": "Unused endpoint: GET /api/requests", "shortDescription": {"text": "Unused endpoint: GET /api/requests"}, "fullDescription": {"text": "`server.js` declares `GET /api/requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36048192278dd1b4", "name": "Unused endpoint: POST /api/requests", "shortDescription": {"text": "Unused endpoint: POST /api/requests"}, "fullDescription": {"text": "`server.js` declares `POST /api/requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45dda789787e1520", "name": "Unused endpoint: POST /api/requests/:id/fulfill", "shortDescription": {"text": "Unused endpoint: POST /api/requests/:id/fulfill"}, "fullDescription": {"text": "`server.js` declares `POST /api/requests/:id/fulfill` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-233dfe5688058b76", "name": "Unused endpoint: POST /api/verify/start", "shortDescription": {"text": "Unused endpoint: POST /api/verify/start"}, "fullDescription": {"text": "`server.js` declares `POST /api/verify/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41c32115ddcf21ef", "name": "Unused endpoint: POST /api/verify/recheck", "shortDescription": {"text": "Unused endpoint: POST /api/verify/recheck"}, "fullDescription": {"text": "`server.js` declares `POST /api/verify/recheck` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75d6bc6d4787883f", "name": "Unused endpoint: GET /api/verify/status", "shortDescription": {"text": "Unused endpoint: GET /api/verify/status"}, "fullDescription": {"text": "`server.js` declares `GET /api/verify/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd7fde9b03331001", "name": "Unused endpoint: POST /api/wa-reply", "shortDescription": {"text": "Unused endpoint: POST /api/wa-reply"}, "fullDescription": {"text": "`server.js` declares `POST /api/wa-reply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba0cffaea20ce92c", "name": "Unused endpoint: POST /api/blast", "shortDescription": {"text": "Unused endpoint: POST /api/blast"}, "fullDescription": {"text": "`server.js` declares `POST /api/blast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9092f596d965bf72", "name": "Unused endpoint: POST /api/admin/reset-data", "shortDescription": {"text": "Unused endpoint: POST /api/admin/reset-data"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/reset-data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fcd06fe147cba29", "name": "Unused endpoint: GET /api/admin/requests", "shortDescription": {"text": "Unused endpoint: GET /api/admin/requests"}, "fullDescription": {"text": "`server.js` declares `GET /api/admin/requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bb526babdcbe3e3", "name": "Unused endpoint: POST /api/admin/requests/:id/escalate", "shortDescription": {"text": "Unused endpoint: POST /api/admin/requests/:id/escalate"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/requests/:id/escalate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87785d4931f0708d", "name": "Unused endpoint: POST /api/admin/requests/:id/fulfill", "shortDescription": {"text": "Unused endpoint: POST /api/admin/requests/:id/fulfill"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/requests/:id/fulfill` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47077de6719bc5d6", "name": "Unused endpoint: POST /api/admin/requests/:id/cancel", "shortDescription": {"text": "Unused endpoint: POST /api/admin/requests/:id/cancel"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/requests/:id/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f62dcbd3405d487", "name": "Unused endpoint: GET /api/admin/partners", "shortDescription": {"text": "Unused endpoint: GET /api/admin/partners"}, "fullDescription": {"text": "`server.js` declares `GET /api/admin/partners` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6176702d8a66c6aa", "name": "Unused endpoint: POST /api/admin/partners", "shortDescription": {"text": "Unused endpoint: POST /api/admin/partners"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/partners` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-198854d15223c9d5", "name": "Unused endpoint: POST /api/admin/partners/:id", "shortDescription": {"text": "Unused endpoint: POST /api/admin/partners/:id"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/partners/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07f0c05c8f387c9a", "name": "Unused endpoint: DELETE /api/admin/partners/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/admin/partners/:id"}, "fullDescription": {"text": "`server.js` declares `DELETE /api/admin/partners/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61c50e933c8f42e6", "name": "Unused endpoint: GET /api/admin/connectors", "shortDescription": {"text": "Unused endpoint: GET /api/admin/connectors"}, "fullDescription": {"text": "`server.js` declares `GET /api/admin/connectors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc6bd2f3c066b806", "name": "Unused endpoint: POST /api/admin/connectors", "shortDescription": {"text": "Unused endpoint: POST /api/admin/connectors"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/connectors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4230feb1a5cc92e0", "name": "Unused endpoint: POST /api/admin/connectors/:id", "shortDescription": {"text": "Unused endpoint: POST /api/admin/connectors/:id"}, "fullDescription": {"text": "`server.js` declares `POST /api/admin/connectors/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21643"}, "properties": {"repository": "troiwebz/rotary-bloodline", "repoUrl": "https://github.com/troiwebz/rotary-bloodline", "branch": "main"}, "results": [{"ruleId": "scanner-d44455c165cfa36a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 wa-qr-local.js:76"}, "properties": {"repobilityId": "c388c936b44c03f8", "scanner": "scanner-primary", "fingerprint": "d44455c165cfa36a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-61ebd79c06cb43bc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:139"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "61ebd79c06cb43bc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bf50b44f80391917", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 whatsapp.js:38"}, "properties": {"repobilityId": "b45d90f6e73eac0c", "scanner": "scanner-primary", "fingerprint": "bf50b44f80391917", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d92aafa27f1b0bb6", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in server.js:40"}, "properties": {"repobilityId": "0d9bca6c0839725e", "scanner": "scanner-primary", "fingerprint": "d92aafa27f1b0bb6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-fd80c2be61cc854a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/report.html:242"}, "properties": {"repobilityId": "4813880889c30dcb", "scanner": "scanner-primary", "fingerprint": "fd80c2be61cc854a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/report.html"}, "region": {"startLine": 242}}}]}, {"ruleId": "scanner-9613c5f78a21cacd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/zone-admin.html:404"}, "properties": {"repobilityId": "8c7db81d999fe77b", "scanner": "scanner-primary", "fingerprint": "9613c5f78a21cacd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/zone-admin.html"}, "region": {"startLine": 404}}}]}, {"ruleId": "scanner-4f773dfd8f20bd35", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:2923"}, "properties": {"repobilityId": "fcd975cc51168fca", "scanner": "scanner-primary", "fingerprint": "4f773dfd8f20bd35", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/index.html"}, "region": {"startLine": 2923}}}]}, {"ruleId": "scanner-ae78842a7f7d3dbf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/admin.html:470"}, "properties": {"repobilityId": "df5203f722eec321", "scanner": "scanner-primary", "fingerprint": "ae78842a7f7d3dbf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/admin.html"}, "region": {"startLine": 470}}}]}, {"ruleId": "scanner-5f5c734853895d2d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in public/admin.html:415"}, "properties": {"repobilityId": "791d819ace9dee32", "scanner": "scanner-primary", "fingerprint": "5f5c734853895d2d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/admin.html"}, "region": {"startLine": 415}}}]}, {"ruleId": "scanner-f4ea747cb51c1d91", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/track.html:118"}, "properties": {"repobilityId": "aeac4823787256d5", "scanner": "scanner-primary", "fingerprint": "f4ea747cb51c1d91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/track.html"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-391dd1e2faaa9af7", "level": "note", "message": {"text": "Very large file: server.js (1907 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "391dd1e2faaa9af7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d2be842aa93d930e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "5fae898f7b3e000b", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ee451842d57cef29", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "7e227c0f1cda17fb", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "73537602eabba923", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f0d16803a3aa891d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8c03822b55d3029c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea5764e80d4ea8a9", "level": "none", "message": {"text": "Commented-code block (5 lines) in db.js:105"}, "properties": {"repobilityId": "525a5c772080fd8b", "scanner": "scanner-primary", "fingerprint": "ea5764e80d4ea8a9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-006eca92ea91689f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 wa-qr-local.js:68"}, "properties": {"repobilityId": "f54397c29e8ad0e2", "scanner": "scanner-primary", "fingerprint": "006eca92ea91689f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-237db2326d87aa82", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:352"}, "properties": {"repobilityId": "ba2d8cbf1443bf65", "scanner": "scanner-primary", "fingerprint": "237db2326d87aa82", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3108fde870323c50", "level": "none", "message": {"text": "Commented-code block (5 lines) in whatsapp.js:11"}, "properties": {"repobilityId": "1e079be7f05eb36e", "scanner": "scanner-primary", "fingerprint": "3108fde870323c50", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa60b20d8915409a", "level": "error", "message": {"text": "Dangling fetch: GET /state (wa-qr-local.js:68)"}, "properties": {"repobilityId": "7ad07c1269d01f69", "scanner": "scanner-primary", "fingerprint": "fa60b20d8915409a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1340c42d8e262210", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (server.js:1110)"}, "properties": {"repobilityId": "18a4861f8b51b782", "scanner": "scanner-primary", "fingerprint": "1340c42d8e262210", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-2219c3bc8a93e7da", "level": "note", "message": {"text": "Unused endpoint: GET /api/push/key"}, "properties": {"repobilityId": "03917c9490bb05f7", "scanner": "scanner-primary", "fingerprint": "2219c3bc8a93e7da", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c622e6243ccd6e0a", "level": "note", "message": {"text": "Unused endpoint: POST /api/push/subscribe"}, "properties": {"repobilityId": "b74c3cda328c673e", "scanner": "scanner-primary", "fingerprint": "c622e6243ccd6e0a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81560ec224758e3e", "level": "note", "message": {"text": "Unused endpoint: POST /api/push/test"}, "properties": {"repobilityId": "11430a413b93ff85", "scanner": "scanner-primary", "fingerprint": "81560ec224758e3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-974a3eaa1bc4d9bb", "level": "note", "message": {"text": "Unused endpoint: GET /api/live"}, "properties": {"repobilityId": "e3505720938b0018", "scanner": "scanner-primary", "fingerprint": "974a3eaa1bc4d9bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7aa4b2518cbbbfa2", "level": "note", "message": {"text": "Unused endpoint: GET /api/config"}, "properties": {"repobilityId": "9470533ff4fbc2ce", "scanner": "scanner-primary", "fingerprint": "7aa4b2518cbbbfa2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c95aff5c3c9effde", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/master-wa/reset"}, "properties": {"repobilityId": "19122eb519645b57", "scanner": "scanner-primary", "fingerprint": "c95aff5c3c9effde", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-963710f42a2c8219", "level": "note", "message": {"text": "Unused endpoint: GET /api/status"}, "properties": {"repobilityId": "fa2554f166d66db7", "scanner": "scanner-primary", "fingerprint": "963710f42a2c8219", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52c749f6e1f92c92", "level": "note", "message": {"text": "Unused endpoint: GET /wa-admin"}, "properties": {"repobilityId": "87fca5342cb4e738", "scanner": "scanner-primary", "fingerprint": "52c749f6e1f92c92", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b37265900e79a8a", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats"}, "properties": {"repobilityId": "8735764fed7aaaaa", "scanner": "scanner-primary", "fingerprint": "3b37265900e79a8a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b7f102b26f9924f1", "level": "note", "message": {"text": "Unused endpoint: GET /api/report"}, "properties": {"repobilityId": "b221d6445b29bc0c", "scanner": "scanner-primary", "fingerprint": "b7f102b26f9924f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7f6a18c0257ac067", "level": "note", "message": {"text": "Unused endpoint: GET /api/recent-donors"}, "properties": {"repobilityId": "a45b57f127d57250", "scanner": "scanner-primary", "fingerprint": "7f6a18c0257ac067", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2eca0afcf3464330", "level": "note", "message": {"text": "Unused endpoint: GET /api/areas"}, "properties": {"repobilityId": "8f29205b665c4010", "scanner": "scanner-primary", "fingerprint": "2eca0afcf3464330", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7062efb491c8337e", "level": "note", "message": {"text": "Unused endpoint: GET /api/detect-area"}, "properties": {"repobilityId": "47e40bf9c0660368", "scanner": "scanner-primary", "fingerprint": "7062efb491c8337e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8de9ecb6c0a17e94", "level": "note", "message": {"text": "Unused endpoint: GET /api/radar"}, "properties": {"repobilityId": "807d5093466ff859", "scanner": "scanner-primary", "fingerprint": "8de9ecb6c0a17e94", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d30aa36f85b5752f", "level": "note", "message": {"text": "Unused endpoint: GET /api/activity"}, "properties": {"repobilityId": "8bfa9a4bcdcd3e5f", "scanner": "scanner-primary", "fingerprint": "d30aa36f85b5752f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83921af7889cbba2", "level": "note", "message": {"text": "Unused endpoint: GET /api/responses"}, "properties": {"repobilityId": "3b49973d37978223", "scanner": "scanner-primary", "fingerprint": "83921af7889cbba2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a369f71214e9ef56", "level": "note", "message": {"text": "Unused endpoint: GET /api/leaderboard"}, "properties": {"repobilityId": "452e937d4a05913b", "scanner": "scanner-primary", "fingerprint": "a369f71214e9ef56", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6211b796901a93e6", "level": "note", "message": {"text": "Unused endpoint: POST /api/respond"}, "properties": {"repobilityId": "0a82bc9785b62b52", "scanner": "scanner-primary", "fingerprint": "6211b796901a93e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8875f97da3041935", "level": "note", "message": {"text": "Unused endpoint: GET /api/donors"}, "properties": {"repobilityId": "78328e5022f4179e", "scanner": "scanner-primary", "fingerprint": "8875f97da3041935", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9a7211942a5aa1e", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/reveal-phone"}, "properties": {"repobilityId": "4e2c9032dc1f6248", "scanner": "scanner-primary", "fingerprint": "f9a7211942a5aa1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69c8ae1ed4d1a92a", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/donor/:id/update"}, "properties": {"repobilityId": "6010c753387d3c57", "scanner": "scanner-primary", "fingerprint": "69c8ae1ed4d1a92a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72637bbd01bba6a7", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/admin/donor/:id"}, "properties": {"repobilityId": "c41d1d398b44bd07", "scanner": "scanner-primary", "fingerprint": "72637bbd01bba6a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b7dceafbae2d81a", "level": "note", "message": {"text": "Unused endpoint: POST /api/donors/register"}, "properties": {"repobilityId": "03afb38ec6a2ac01", "scanner": "scanner-primary", "fingerprint": "0b7dceafbae2d81a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b57f968fd784102a", "level": "note", "message": {"text": "Unused endpoint: PUT /api/donors/:id"}, "properties": {"repobilityId": "ee2103a7ba44ee1c", "scanner": "scanner-primary", "fingerprint": "b57f968fd784102a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4edf22d2be991c2", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/donors/:id"}, "properties": {"repobilityId": "9267ce1918d0786d", "scanner": "scanner-primary", "fingerprint": "a4edf22d2be991c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6ca9429067d5fb4a", "level": "note", "message": {"text": "Unused endpoint: POST /api/donors/:id/donated"}, "properties": {"repobilityId": "e55bfb7f2d024b63", "scanner": "scanner-primary", "fingerprint": "6ca9429067d5fb4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c60f4d5b3ed2d108", "level": "note", "message": {"text": "Unused endpoint: POST /api/scan"}, "properties": {"repobilityId": "0f81c8f58be33739", "scanner": "scanner-primary", "fingerprint": "c60f4d5b3ed2d108", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4bdf2da19100b851", "level": "note", "message": {"text": "Unused endpoint: GET /api/donors/:id/profile"}, "properties": {"repobilityId": "8417e04a1ea58e44", "scanner": "scanner-primary", "fingerprint": "4bdf2da19100b851", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f3e0f214cd99b9d", "level": "note", "message": {"text": "Unused endpoint: POST /api/donors/:id/profile"}, "properties": {"repobilityId": "fd2cbddfeeac5fef", "scanner": "scanner-primary", "fingerprint": "8f3e0f214cd99b9d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9dd0c065927de3f0", "level": "note", "message": {"text": "Unused endpoint: GET /api/track/:id"}, "properties": {"repobilityId": "af0f56da7338198b", "scanner": "scanner-primary", "fingerprint": "9dd0c065927de3f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fadcef1d5292cf8a", "level": "note", "message": {"text": "Unused endpoint: GET /api/requests"}, "properties": {"repobilityId": "22f2e1b797a08577", "scanner": "scanner-primary", "fingerprint": "fadcef1d5292cf8a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-36048192278dd1b4", "level": "note", "message": {"text": "Unused endpoint: POST /api/requests"}, "properties": {"repobilityId": "7583fcd11eff2de4", "scanner": "scanner-primary", "fingerprint": "36048192278dd1b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45dda789787e1520", "level": "note", "message": {"text": "Unused endpoint: POST /api/requests/:id/fulfill"}, "properties": {"repobilityId": "4651088bcd32b905", "scanner": "scanner-primary", "fingerprint": "45dda789787e1520", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-233dfe5688058b76", "level": "note", "message": {"text": "Unused endpoint: POST /api/verify/start"}, "properties": {"repobilityId": "43fa43e26b3a9aed", "scanner": "scanner-primary", "fingerprint": "233dfe5688058b76", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41c32115ddcf21ef", "level": "note", "message": {"text": "Unused endpoint: POST /api/verify/recheck"}, "properties": {"repobilityId": "6c170b4cd639cf74", "scanner": "scanner-primary", "fingerprint": "41c32115ddcf21ef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-75d6bc6d4787883f", "level": "note", "message": {"text": "Unused endpoint: GET /api/verify/status"}, "properties": {"repobilityId": "5271719bf255b4fc", "scanner": "scanner-primary", "fingerprint": "75d6bc6d4787883f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd7fde9b03331001", "level": "note", "message": {"text": "Unused endpoint: POST /api/wa-reply"}, "properties": {"repobilityId": "66893f8213ccc180", "scanner": "scanner-primary", "fingerprint": "fd7fde9b03331001", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba0cffaea20ce92c", "level": "note", "message": {"text": "Unused endpoint: POST /api/blast"}, "properties": {"repobilityId": "931943e5a225f13e", "scanner": "scanner-primary", "fingerprint": "ba0cffaea20ce92c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9092f596d965bf72", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/reset-data"}, "properties": {"repobilityId": "7d349e960950428c", "scanner": "scanner-primary", "fingerprint": "9092f596d965bf72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fcd06fe147cba29", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/requests"}, "properties": {"repobilityId": "b4d281099d6213fb", "scanner": "scanner-primary", "fingerprint": "5fcd06fe147cba29", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bb526babdcbe3e3", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/requests/:id/escalate"}, "properties": {"repobilityId": "e1c8f57b9bde5261", "scanner": "scanner-primary", "fingerprint": "2bb526babdcbe3e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87785d4931f0708d", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/requests/:id/fulfill"}, "properties": {"repobilityId": "b710988e0e9aaa44", "scanner": "scanner-primary", "fingerprint": "87785d4931f0708d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47077de6719bc5d6", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/requests/:id/cancel"}, "properties": {"repobilityId": "4ee8e96556bba63d", "scanner": "scanner-primary", "fingerprint": "47077de6719bc5d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f62dcbd3405d487", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/partners"}, "properties": {"repobilityId": "aace55b6218ce612", "scanner": "scanner-primary", "fingerprint": "8f62dcbd3405d487", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6176702d8a66c6aa", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/partners"}, "properties": {"repobilityId": "f9292237fd13b8ed", "scanner": "scanner-primary", "fingerprint": "6176702d8a66c6aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-198854d15223c9d5", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/partners/:id"}, "properties": {"repobilityId": "4361562331f7b661", "scanner": "scanner-primary", "fingerprint": "198854d15223c9d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07f0c05c8f387c9a", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/admin/partners/:id"}, "properties": {"repobilityId": "71590b0bb5790576", "scanner": "scanner-primary", "fingerprint": "07f0c05c8f387c9a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61c50e933c8f42e6", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/connectors"}, "properties": {"repobilityId": "9cb081b890c003fa", "scanner": "scanner-primary", "fingerprint": "61c50e933c8f42e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc6bd2f3c066b806", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/connectors"}, "properties": {"repobilityId": "a023cc7ae5e8b70a", "scanner": "scanner-primary", "fingerprint": "bc6bd2f3c066b806", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4230feb1a5cc92e0", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/connectors/:id"}, "properties": {"repobilityId": "0bf92c570d9bdecb", "scanner": "scanner-primary", "fingerprint": "4230feb1a5cc92e0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}