Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

santaKoA/mondial-2026

https://github.com/santaKoA/mondial-2026 · scanned 2026-06-16 00:02 UTC (2 months, 3 weeks ago)

77 raw signals (0 security + 77 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 3 weeks ago · v1 · 77 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 77 findings

Severity distribution — click a segment to filter

Active filters: layer: api × excluding tests × Reset all

Severity: Critical 0 High 2 Medium 14 Low 59 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 77 Crowd 0 Layer: Network 1 Hardware 6 Security 4 Cicd 1 Quality 15 Api 50

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 50.4/100 with 100.0% coverage. It contains 370 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 77 findings — concentrated in api (50), quality (15), hardware (6). Risk profile is high: 0 critical, 2 high, 14 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 50 of 77 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /groups/{group_id}

`backend/routers/admin.py` declares `DELETE /groups/{group_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /groups/{group_id}/members/{user_id}

`backend/routers/leaderboard.py` declares `DELETE /groups/{group_id}/members/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who con…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /test-matches/{match_id}

`backend/routers/admin.py` declares `DELETE /test-matches/{match_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /users/{user_id}

`backend/routers/admin.py` declares `DELETE /users/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /

`backend/routers/leaderboard.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/groups

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/search-fixtures

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/search-fixtures` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/sync/status

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/sync/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/teams

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/test-matches

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/test-matches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/test-matches/cards

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/test-matches/cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/admin/users

`frontend/src/pages/AdminPage.jsx` declares `GET /api/admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/config

`backend/main.py` declares `GET /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/health

`backend/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/matches

`frontend/src/pages/MatchesPage.jsx` declares `GET /api/matches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/matches/teams

`frontend/src/pages/UserProfilePage.jsx` declares `GET /api/matches/teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/special-predictions/my

`frontend/src/pages/SpecialPredictionsPage.jsx` declares `GET /api/special-predictions/my` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who …

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /groups

`backend/routers/leaderboard.py` declares `GET /groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /match/{match_id}

`backend/routers/predictions.py` declares `GET /match/{match_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /me

`backend/routers/auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /my

`backend/routers/predictions.py` declares `GET /my` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /search-fixtures

`backend/routers/admin.py` declares `GET /search-fixtures` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /sync/status

`backend/routers/admin.py` declares `GET /sync/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /teams

`backend/routers/admin.py` declares `GET /teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /test-matches

`backend/routers/admin.py` declares `GET /test-matches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /test-matches/cards

`backend/routers/admin.py` declares `GET /test-matches/cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /user/{user_id}

`backend/routers/predictions.py` declares `GET /user/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /users

`backend/routers/admin.py` declares `GET /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /

`backend/routers/special_predictions.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/admin/test-match

`frontend/src/pages/AdminPage.jsx` declares `POST /api/admin/test-match` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/login

`frontend/src/pages/JoinPage.jsx` declares `POST /api/auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/register

`frontend/src/pages/JoinPage.jsx` declares `POST /api/auth/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/special-predictions

`frontend/src/pages/SpecialPredictionsPage.jsx` declares `POST /api/special-predictions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /create-group

`backend/routers/auth.py` declares `POST /create-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /groups

`backend/routers/auth.py` declares `POST /groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /join

`backend/routers/auth.py` declares `POST /join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /join-group

`backend/routers/auth.py` declares `POST /join-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /link-fixtures

`backend/routers/admin.py` declares `POST /link-fixtures` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /login

`backend/routers/auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /register

`backend/routers/auth.py` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /special-predictions/correct

`backend/routers/admin.py` declares `POST /special-predictions/correct` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /sync

`backend/routers/admin.py` declares `POST /sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /test-match

`backend/routers/admin.py` declares `POST /test-match` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /test-matches/{match_id}/sync

`backend/routers/admin.py` declares `POST /test-matches/{match_id}/sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /{match_id}

`backend/routers/predictions.py` declares `POST /{match_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: PUT /api/auth/change-password

`frontend/src/components/ChangePasswordModal.jsx` declares `PUT /api/auth/change-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who …

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: PUT /change-password

`backend/routers/auth.py` declares `PUT /change-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: PUT /matches/{match_id}/result

`backend/routers/admin.py` declares `PUT /matches/{match_id}/result` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: PUT /matches/{match_id}/teams

`backend/routers/admin.py` declares `PUT /matches/{match_id}/teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: PUT /users/{user_id}/password

`backend/routers/admin.py` declares `PUT /users/{user_id}/password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/b478736a-fd3e-47c5-813a-46185c1e6c35/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/b478736a-fd3e-47c5-813a-46185c1e6c35/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.