Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

wrodrigobr/Leaklab

https://github.com/wrodrigobr/Leaklab · scanned 2026-06-16 01:01 UTC (2 months, 1 week ago)

257 raw signals (0 security + 257 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 232 actionable findings from 1 signal source. 25 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 232 findings

Severity distribution — click a segment to filter

Active filters: layer: api × excluding tests × Reset all

Severity: Critical 0 High 35 Medium 38 Low 99 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 232 Crowd 0 Layer: Software 13 Frontend 37 Security 30 Network 1 Hardware 3 Cicd 1 Quality 63 Api 84

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 46.2/100 with 100.0% coverage. It contains 4495 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 257 findings — concentrated in quality (85), api (84), frontend (37). Risk profile is high: 0 critical, 35 high, 43 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 84 of 232 actionable findings. 257 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /admin/users/${id} (frontend/src/lib/api.ts:2008)

`frontend/src/lib/api.ts:2008` calls `DELETE /admin/users/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/admin/users/` If this points at an external API, prefix it with `https://` so the matcher s…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /coach/student/${studentId}/baseline (frontend/src/lib/api.ts:1709)

`frontend/src/lib/api.ts:1709` calls `DELETE /coach/student/${studentId}/baseline` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//baseline` If this points at an external API, prefix it wit…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /coach/student/${studentId}/hand-annotations/${decisionId} (frontend/src/lib/api.ts:1679)

`frontend/src/lib/api.ts:1679` calls `DELETE /coach/student/${studentId}/hand-annotations/${decisionId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//hand-annotations/` If this points…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /coach/student/${studentId}/study-overrides/${encodeURIComponent(cardSpot)} (frontend/src/lib/api.ts:1659)

`frontend/src/lib/api.ts:1659` calls `DELETE /coach/student/${studentId}/study-overrides/${encodeURIComponent(cardSpot)}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//study-overrides/…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /coach/templates/${templateId} (frontend/src/lib/api.ts:1748)

`frontend/src/lib/api.ts:1748` calls `DELETE /coach/templates/${templateId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/templates/` If this points at an external API, prefix it with `https://` …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /history/tournament/${tournamentId} (frontend/src/lib/api.ts:464)

`frontend/src/lib/api.ts:464` calls `DELETE /history/tournament/${tournamentId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/history/tournament/` If this points at an external API, prefix it with `htt…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/${coachId}/contact-thread (frontend/src/lib/api.ts:2178)

`frontend/src/lib/api.ts:2178` calls `GET /coach/${coachId}/contact-thread` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach//contact-thread` If this points at an external API, prefix it with `https:…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/activity-feed?limit=${limit} (frontend/src/lib/api.ts:1714)

`frontend/src/lib/api.ts:1714` calls `GET /coach/student/${studentId}/activity-feed?limit=${limit}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//activity-feed` If this points at an exter…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/breakdown?days=${days} (frontend/src/lib/api.ts:1626)

`frontend/src/lib/api.ts:1626` calls `GET /coach/student/${studentId}/breakdown?days=${days}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//breakdown` If this points at an external API, p…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/hand-annotations (frontend/src/lib/api.ts:1664)

`frontend/src/lib/api.ts:1664` calls `GET /coach/student/${studentId}/hand-annotations` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//hand-annotations` If this points at an external API, …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/history?days=${days} (frontend/src/lib/api.ts:1620)

`frontend/src/lib/api.ts:1620` calls `GET /coach/student/${studentId}/history?days=${days}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//history` If this points at an external API, prefi…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/level (frontend/src/lib/api.ts:1617)

`frontend/src/lib/api.ts:1617` calls `GET /coach/student/${studentId}/level` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//level` If this points at an external API, prefix it with `https:…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/messages (frontend/src/lib/api.ts:1752)

`frontend/src/lib/api.ts:1752` calls `GET /coach/student/${studentId}/messages` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//messages` If this points at an external API, prefix it with `…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/progress-report (frontend/src/lib/api.ts:1717)

`frontend/src/lib/api.ts:1717` calls `GET /coach/student/${studentId}/progress-report` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//progress-report` If this points at an external API, pr…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/replay/${tournamentId}/${handId} (frontend/src/lib/api.ts:1642)

`frontend/src/lib/api.ts:1642` calls `GET /coach/student/${studentId}/replay/${tournamentId}/${handId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//replay//` If this points at an …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/stats?days=${days} (frontend/src/lib/api.ts:1623)

`frontend/src/lib/api.ts:1623` calls `GET /coach/student/${studentId}/stats?days=${days}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//stats` If this points at an external API, prefix it…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coach/student/${studentId}/study-overrides (frontend/src/lib/api.ts:1645)

`frontend/src/lib/api.ts:1645` calls `GET /coach/student/${studentId}/study-overrides` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//study-overrides` If this points at an external API, pr…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /coaches/${coachUserId} (frontend/src/lib/api.ts:1823)

`frontend/src/lib/api.ts:1823` calls `GET /coaches/${coachUserId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coaches/` If this points at an external API, prefix it with `https://` so the matcher ski…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /player/session-review/${tournamentId} (frontend/src/lib/api.ts:1142)

`frontend/src/lib/api.ts:1142` calls `GET /player/session-review/${tournamentId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/player/session-review/` If this points at an external API, prefix it with …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /player/spots/drill/${decision_id}/analysis (frontend/src/lib/api.ts:830)

`frontend/src/lib/api.ts:830` calls `GET /player/spots/drill/${decision_id}/analysis` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/player/spots/drill//analysis` If this points at an external API, prefi…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /replay/${decisionId}/gto (frontend/src/lib/api.ts:2278)

`frontend/src/lib/api.ts:2278` calls `GET /replay/${decisionId}/gto` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/replay//gto` If this points at an external API, prefix it with `https://` so the matche…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET /replay/${tournamentId}/${handId} (frontend/src/lib/api.ts:444)

`frontend/src/lib/api.ts:444` calls `GET /replay/${tournamentId}/${handId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/replay//` If this points at an external API, prefix it with `https://` so the…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: PATCH /admin/finance/coaches/${paymentId}/pay (frontend/src/lib/api.ts:2019)

`frontend/src/lib/api.ts:2019` calls `PATCH /admin/finance/coaches/${paymentId}/pay` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/admin/finance/coaches//pay` If this points at an external API, prefix i…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: PATCH /admin/users/${id} (frontend/src/lib/api.ts:2002)

`frontend/src/lib/api.ts:2002` calls `PATCH /admin/users/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/admin/users/` If this points at an external API, prefix it with `https://` so the matcher sk…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /admin/coach-applications/${id}/approve (frontend/src/lib/api.ts:2027)

`frontend/src/lib/api.ts:2027` calls `POST /admin/coach-applications/${id}/approve` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/admin/coach-applications//approve` If this points at an external API, pr…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /admin/coach-applications/${id}/reject (frontend/src/lib/api.ts:2033)

`frontend/src/lib/api.ts:2033` calls `POST /admin/coach-applications/${id}/reject` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/admin/coach-applications//reject` If this points at an external API, pref…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /admin/support-tickets/${ticketId}/reply (frontend/src/lib/api.ts:2304)

`frontend/src/lib/api.ts:2304` calls `POST /admin/support-tickets/${ticketId}/reply` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/admin/support-tickets//reply` If this points at an external API, prefix…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /coach/${coachId}/contact (frontend/src/lib/api.ts:2172)

`frontend/src/lib/api.ts:2172` calls `POST /coach/${coachId}/contact` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach//contact` If this points at an external API, prefix it with `https://` so the ma…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /coach/student/${studentId}/baseline (frontend/src/lib/api.ts:1703)

`frontend/src/lib/api.ts:1703` calls `POST /coach/student/${studentId}/baseline` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//baseline` If this points at an external API, prefix it with …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /coach/student/${studentId}/hand-annotations (frontend/src/lib/api.ts:1673)

`frontend/src/lib/api.ts:1673` calls `POST /coach/student/${studentId}/hand-annotations` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//hand-annotations` If this points at an external API,…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /coach/student/${studentId}/messages (frontend/src/lib/api.ts:1755)

`frontend/src/lib/api.ts:1755` calls `POST /coach/student/${studentId}/messages` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//messages` If this points at an external API, prefix it with …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /coach/student/${studentId}/study-overrides (frontend/src/lib/api.ts:1653)

`frontend/src/lib/api.ts:1653` calls `POST /coach/student/${studentId}/study-overrides` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/coach/student//study-overrides` If this points at an external API, p…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /player/hands/${handId}/request-gto (frontend/src/lib/api.ts:447)

`frontend/src/lib/api.ts:447` calls `POST /player/hands/${handId}/request-gto` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/player/hands//request-gto` If this points at an external API, prefix it with …

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: POST /player/notifications/${id}/read (frontend/src/lib/api.ts:1013)

`frontend/src/lib/api.ts:1013` calls `POST /player/notifications/${id}/read` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/player/notifications//read` If this points at an external API, prefix it with `…

Dangling fetchHelper:request

low System graph api Wiring conf 1.00 Unused endpoint: ANY /analyze

`backend/api/app.py` declares `ANY /analyze` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /analyze/guest

`backend/api/app.py` declares `ANY /analyze/guest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /analyze/hand-coach

`backend/api/app.py` declares `ANY /analyze/hand-coach` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /analyze/replay-coach

`backend/api/app.py` declares `ANY /analyze/replay-coach` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/<int:coach_id>/contact

`backend/api/app.py` declares `ANY /coach/<int:coach_id>/contact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/<int:coach_id>/contact-thread

`backend/api/app.py` declares `ANY /coach/<int:coach_id>/contact-thread` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/my-review

`backend/api/app.py` declares `ANY /coach/my-review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/activity-feed

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/activity-feed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/baseline

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/baseline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/breakdown

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/breakdown` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/hand-annotations

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/hand-annotations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/hand-annotations/<int:decision_id>

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/hand-annotations/<int:decision_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or docu…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/history

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/level

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/level` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/messages

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/progress-report

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/progress-report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/replay/<tournament_id>/<hand_id>

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/replay/<tournament_id>/<hand_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or docume…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/stats

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/study-overrides

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/study-overrides` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/study-overrides/<path:card_spot>

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/study-overrides/<path:card_spot>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or docume…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/study-plan

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/study-plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/tournament/<tournament_id>

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/tournament/<tournament_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting …

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/student/<int:student_id>/worst-decisions

`backend/api/app.py` declares `ANY /coach/student/<int:student_id>/worst-decisions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/students-legacy

`backend/api/app.py` declares `ANY /coach/students-legacy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coach/templates/<int:template_id>

`backend/api/app.py` declares `ANY /coach/templates/<int:template_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coaches

`backend/api/app.py` declares `ANY /coaches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coaches/<int:coach_user_id>

`backend/api/app.py` declares `ANY /coaches/<int:coach_user_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /coaches/<int:coach_user_id>/reviews

`backend/api/app.py` declares `ANY /coaches/<int:coach_user_id>/reviews` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /gto/status

`backend/api/app.py` declares `ANY /gto/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/evolution

`backend/api/app.py` declares `ANY /history/evolution` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/tournament/<tournament_id>

`backend/api/app.py` declares `ANY /history/tournament/<tournament_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/tournament/<tournament_id>/narrative

`backend/api/app.py` declares `ANY /history/tournament/<tournament_id>/narrative` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/tournament/<tournament_id>/phase_analysis

`backend/api/app.py` declares `ANY /history/tournament/<tournament_id>/phase_analysis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/tournament/<tournament_id>/report.pdf

`backend/api/app.py` declares `ANY /history/tournament/<tournament_id>/report.pdf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/tournament/<tournament_id>/texture_analysis

`backend/api/app.py` declares `ANY /history/tournament/<tournament_id>/texture_analysis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /history/tournaments/compare

`backend/api/app.py` declares `ANY /history/tournaments/compare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/ev-leaks

`backend/api/app.py` declares `ANY /player/ev-leaks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/gto-alignment

`backend/api/app.py` declares `ANY /player/gto-alignment` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/gto-alignment-matrix

`backend/api/app.py` declares `ANY /player/gto-alignment-matrix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/gto-position

`backend/api/app.py` declares `ANY /player/gto-position` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/gto-quality

`backend/api/app.py` declares `ANY /player/gto-quality` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/leak-finder

`backend/api/app.py` declares `ANY /player/leak-finder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/leak-roi

`backend/api/app.py` declares `ANY /player/leak-roi` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/notifications/<int:notif_id>/read

`backend/api/app.py` declares `ANY /player/notifications/<int:notif_id>/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/results-vs-gto

`backend/api/app.py` declares `ANY /player/results-vs-gto` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/session-review/<int:tournament_id>

`backend/api/app.py` declares `ANY /player/session-review/<int:tournament_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/sparring/hand

`backend/api/app.py` declares `ANY /player/sparring/hand` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/spots/drill

`backend/api/app.py` declares `ANY /player/spots/drill` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /player/spots/drill/<int:decision_id>/analysis

`backend/api/app.py` declares `ANY /player/spots/drill/<int:decision_id>/analysis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: ANY /study/plan

`backend/api/app.py` declares `ANY /study/plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/babd7f35-f449-4c33-bcff-58bce0d99f30/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/babd7f35-f449-4c33-bcff-58bce0d99f30/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.