{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4ce12f30ee8f2640", "name": "Possibly dead Python function: safe_import", "shortDescription": {"text": "Possibly dead Python function: safe_import"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2525cfefbb33f21", "name": "Possibly dead Python function: do_search", "shortDescription": {"text": "Possibly dead Python function: do_search"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cef50c292c51626b", "name": "Possibly dead Python function: do_glob", "shortDescription": {"text": "Possibly dead Python function: do_glob"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-349e26dca3fa84d3", "name": "Possibly dead Python function: do_copy", "shortDescription": {"text": "Possibly dead Python function: do_copy"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0aa3138251ea36d3", "name": "Possibly dead Python function: replace_var", "shortDescription": {"text": "Possibly dead Python function: replace_var"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d0e86854af18c87", "name": "Possibly dead Python function: serve", "shortDescription": {"text": "Possibly dead Python function: serve"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8232868ae323f9f5", "name": "Possibly dead Python function: serve_public", "shortDescription": {"text": "Possibly dead Python function: serve_public"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-096506d58e6704f3", "name": "Possibly dead Python function: dev_public", "shortDescription": {"text": "Possibly dead Python function: dev_public"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-111fddbdc8e912f8", "name": "Possibly dead Python function: configure_sqlite_pragmas", "shortDescription": {"text": "Possibly dead Python function: configure_sqlite_pragmas"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3799d858fba486df", "name": "Possibly dead Python function: run_async", "shortDescription": {"text": "Possibly dead Python function: run_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e07810845fe86b3f", "name": "Possibly dead Python function: run_async", "shortDescription": {"text": "Possibly dead Python function: run_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de6b5cd29311e7d8", "name": "Possibly dead Python function: do_logout", "shortDescription": {"text": "Possibly dead Python function: do_logout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f617260d7bd6d75a", "name": "Possibly dead Python function: disconnect", "shortDescription": {"text": "Possibly dead Python function: disconnect"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9250d51e083833f4", "name": "Possibly dead Python function: receive", "shortDescription": {"text": "Possibly dead Python function: receive"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebe2f1da944dec31", "name": "Possibly dead Python function: goal_progress", "shortDescription": {"text": "Possibly dead Python function: goal_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f114968824e1328", "name": "Possibly dead Python function: replace_var", "shortDescription": {"text": "Possibly dead Python function: replace_var"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b6f8f83d6d38618", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.14-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.14-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8261a033e6cb9a2", "name": "Insecure pattern 'exec_used' in zebra-tasks/zebra_tasks/compute/python_exec.py:172", "shortDescription": {"text": "Insecure pattern 'exec_used' in zebra-tasks/zebra_tasks/compute/python_exec.py:172"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb0395642c4aea19", "name": "Insecure pattern 'direct_innerhtml_assignment' in zebra-agent-web/static/js/workflow-diagram.js:90", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in zebra-agent-web/static/js/workflow-diagram.js:90"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5199c5afb61f1cf", "name": "Very large file: zebra-tasks/tests/test_agent_loop_actions.py (1394 lines)", "shortDescription": {"text": "Very large file: zebra-tasks/tests/test_agent_loop_actions.py (1394 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3da0934b2848852", "name": "Very large file: zebra-agent-web/zebra_agent_web/api/views.py (1552 lines)", "shortDescription": {"text": "Very large file: zebra-agent-web/zebra_agent_web/api/views.py (1552 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f712a9aa0f95e8cd", "name": "Very large file: zebra-agent-web/zebra_agent_web/api/web_views.py (2240 lines)", "shortDescription": {"text": "Very large file: zebra-agent-web/zebra_agent_web/api/web_views.py (2240 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 34 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 12 placeholder/mock markers across 3 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08adca2df55f36ee", "name": "Agent instruction/config may expose a secret: zebra-tasks/AGENTS.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: zebra-tasks/AGENTS.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-319d44f812ec0bf9", "name": "Agent authority lacks a verifier contract: specs/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: specs/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f4dde80c8c23c4f", "name": "Agent authority lacks a verifier contract: .claude/commands/cicd.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/cicd.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df8d7aecf447de62", "name": "Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-021b572fe2fa6b9c", "name": "Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ac5809991699615", "name": "Agent authority lacks a verifier contract: .claude/commands/opsx/propose.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/propose.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2209d9ef8cd8a3ad", "name": "Agent authority lacks a verifier contract: .claude/skills/openspec-propose/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-propose/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14b94de34d897ad4", "name": "Agent authority lacks a verifier contract: .claude/skills/openspec-apply-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-apply-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a585f74bb40a5f1", "name": "Agent authority lacks a verifier contract: .claude/skills/openspec-archive-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-archive-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-525d12f44750fc63", "name": "Legacy-named symbol `subdir1_copy` in zebra-tasks/tests/test_filesystem.py:353", "shortDescription": {"text": "Legacy-named symbol `subdir1_copy` in zebra-tasks/tests/test_filesystem.py:353"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-075763101ae88566", "name": "Commented-code block (5 lines) in zebra-tasks/zebra_tasks/agent/record_metrics.py:149", "shortDescription": {"text": "Commented-code block (5 lines) in zebra-tasks/zebra_tasks/agent/record_metrics.py:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a16fa04ae8fa9a97", "name": "Legacy-named symbol `file_copy` in zebra-tasks/zebra_tasks/filesystem/copy.py:38", "shortDescription": {"text": "Legacy-named symbol `file_copy` in zebra-tasks/zebra_tasks/filesystem/copy.py:38"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9a85ad1df74f4f9", "name": "Legacy-named symbol `model_copy` in zebra-py/tests/test_recovery.py:112", "shortDescription": {"text": "Legacy-named symbol `model_copy` in zebra-py/tests/test_recovery.py:112"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d716807b9d7274de", "name": "Legacy-named symbol `model_copy` in zebra-py/zebra/core/engine.py:161", "shortDescription": {"text": "Legacy-named symbol `model_copy` in zebra-py/zebra/core/engine.py:161"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c417d0a6de712982", "name": "Commented-code block (5 lines) in zebra-py/zebra/tasks/base.py:265", "shortDescription": {"text": "Commented-code block (5 lines) in zebra-py/zebra/tasks/base.py:265"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9799614eb4896f12", "name": "`fetch()` without try/.catch or AbortSignal \u2014 zebra-agent-web/static/js/webauthn.js:44", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 zebra-agent-web/static/js/webauthn.js:44"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-034ccf585f178e28", "name": "Legacy-named symbol `model_copy` in zebra-agent-web/tests/unit/test_human_tasks.py:320", "shortDescription": {"text": "Legacy-named symbol `model_copy` in zebra-agent-web/tests/unit/test_human_tasks.py:320"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-812e9a8abcdd44d9", "name": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent-web/zebra_agent_web/ethics_audit_store.py:40", "shortDescription": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent-web/zebra_agent_web/ethics_audit_store.py:40"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-854cc57689077b57", "name": "Commented-code block (8 lines) in zebra-agent-web/zebra_agent_web/settings.py:91", "shortDescription": {"text": "Commented-code block (8 lines) in zebra-agent-web/zebra_agent_web/settings.py:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a086009ab425440", "name": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent-web/zebra_agent_web/trust_store.py:114", "shortDescription": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent-web/zebra_agent_web/trust_store.py:114"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1949ab73a308245f", "name": "Legacy-named symbol `test_wizard_edit_mode_pre_populates_and_creates_v2` in zebra-agent/tests/test_values_profile_wizard", "shortDescription": {"text": "Legacy-named symbol `test_wizard_edit_mode_pre_populates_and_creates_v2` in zebra-agent/tests/test_values_profile_wizard.py:149"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1e9e00391b9c1e5", "name": "Legacy-named symbol `fetched_v1` in zebra-agent/tests/test_profile_store.py:97", "shortDescription": {"text": "Legacy-named symbol `fetched_v1` in zebra-agent/tests/test_profile_store.py:97"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17dff523a5355449", "name": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent/zebra_agent/storage/memory.py:250", "shortDescription": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent/zebra_agent/storage/memory.py:250"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df975bcdd9c8bd81", "name": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent/zebra_agent/storage/ethics_audit.py:27", "shortDescription": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent/zebra_agent/storage/ethics_audit.py:27"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9836457f7ec50c4", "name": "23 env vars used in code but missing from .env.example", "shortDescription": {"text": "23 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DJANGO_ALLOWED_HOSTS`, `DJANGO_DEBUG`, `DJANGO_SECRET_KEY`, `KIMI_API_KEY`, `KIMI_BASE_URL`, `PGDATABASE`, `PGHOST`, `PGPASSWORD` + 15 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nzebra-tasks/zebra_tasks/llm/_testing.py:complete, zebra-tasks/zebra_tasks/llm/_testing.py:stream, zebra-tasks/zebra_tasks/llm/base.py:complete, zebra-tasks/zebra_tasks/llm/base.py:stream\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nzebra-tasks/zebra_tasks/agent/save_values_profile.py:run, zebra-tasks/zebra_tasks/agent/load_values_profile.py:run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nzebra-tasks/zebra_tasks/filesystem/info.py:run, zebra-tasks/zebra_tasks/filesystem/info.py:run, zebra-tasks/zebra_tasks/filesystem/info.py:run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nzebra-agent-web/zebra_agent_web/middleware.py:middleware, zebra-agent-web/zebra_agent_web/middleware.py:middleware, zebra-agent-web/zebra_agent_web/middleware.py:middleware, zebra-agent-web/zebra_agent_web/middleware.py:middleware\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nzebra-agent-web/zebra_agent_web/ethics_audit_store.py:list_entries, zebra-agent/zebra_agent/storage/interfaces.py:list_entries, zebra-agent/zebra_agent/storage/interfaces.py:list, zebra-agent/zebra_agent/storage/interfaces.py:list\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee32339d68a02206", "name": "Django view `health_check` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:74", "shortDescription": {"text": "Django view `health_check` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:74"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8441a9e6f9f17475", "name": "Django view `metrics_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:116", "shortDescription": {"text": "Django view `metrics_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:116"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d11146b7e8be0c8", "name": "Django view `execute_goal` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:364", "shortDescription": {"text": "Django view `execute_goal` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:364"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-260bbd9cd94d4c84", "name": "Django view `dream_cycle` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:414", "shortDescription": {"text": "Django view `dream_cycle` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:414"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2da7d82982f0cc41", "name": "Django view `run_rate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:514", "shortDescription": {"text": "Django view `run_rate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:514"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33c02e369dd4f044", "name": "Django view `run_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:556", "shortDescription": {"text": "Django view `run_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:556"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55c83dea37d72673", "name": "Django view `run_diagram` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:679", "shortDescription": {"text": "Django view `run_diagram` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:679"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50cd4d21296f92ad", "name": "Django view `budget_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:731", "shortDescription": {"text": "Django view `budget_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:731"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e465109b23d940e", "name": "Django view `process_detail` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:764", "shortDescription": {"text": "Django view `process_detail` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:764"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89b0296a230ddb92", "name": "Django view `process_pending_tasks` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:816", "shortDescription": {"text": "Django view `process_pending_tasks` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:816"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32d82dd1095aac94", "name": "Django view `task_complete` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:878", "shortDescription": {"text": "Django view `task_complete` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:878"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ed0680946b9c999", "name": "Django view `process_cancel` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:971", "shortDescription": {"text": "Django view `process_cancel` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:971"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d31ad35ae1569819", "name": "Django view `kill_switch_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1026", "shortDescription": {"text": "Django view `kill_switch_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1026"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bcfbd82632a4054", "name": "Django view `process_delete` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1054", "shortDescription": {"text": "Django view `process_delete` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1054"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34476fc1d8fa5d34", "name": "Django view `delete_user_data` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1088", "shortDescription": {"text": "Django view `delete_user_data` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1088"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c81ba32f0d6096d4", "name": "Django view `version_info` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1148", "shortDescription": {"text": "Django view `version_info` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1148"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0b4bbd22282612e", "name": "Django view `ethics_audit_list` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1186", "shortDescription": {"text": "Django view `ethics_audit_list` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1186"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7911073ad6655214", "name": "Django view `export_data` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1306", "shortDescription": {"text": "Django view `export_data` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1306"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cab4d5365744d75a", "name": "Django view `ethics_audit_detail` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1338", "shortDescription": {"text": "Django view `ethics_audit_detail` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1338"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faf1875bdba05b47", "name": "Django view `trust_levels` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1383", "shortDescription": {"text": "Django view `trust_levels` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1383"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb3dbedfe4f502ca", "name": "Django view `trust_set_level` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1391", "shortDescription": {"text": "Django view `trust_set_level` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1391"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d9f291b264ea8b3", "name": "Django view `trust_changes` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1425", "shortDescription": {"text": "Django view `trust_changes` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1425"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1aa692c576010826", "name": "Django view `trust_pause_all` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1449", "shortDescription": {"text": "Django view `trust_pause_all` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1449"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-168f54bea97f8d59", "name": "Django view `trust_freeing_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1467", "shortDescription": {"text": "Django view `trust_freeing_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1467"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fe70bcfa89b7e52", "name": "Django view `trust_freeing_initiate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1477", "shortDescription": {"text": "Django view `trust_freeing_initiate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1477"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-536489864efeb1a7", "name": "Django view `trust_freeing_confirm` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1490", "shortDescription": {"text": "Django view `trust_freeing_confirm` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1490"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c681d03ff8a1a7a3", "name": "Django view `trust_freeing_cancel` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1503", "shortDescription": {"text": "Django view `trust_freeing_cancel` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1503"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-714d8cf8fd9d2414", "name": "Django view `trust_suggestions` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1530", "shortDescription": {"text": "Django view `trust_suggestions` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1530"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-685caae3e9454f1d", "name": "Django view `trust_suggestion_resolve` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1539", "shortDescription": {"text": "Django view `trust_suggestion_resolve` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1539"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cced8b13955e57a", "name": "Django view `begin_authenticate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:175", "shortDescription": {"text": "Django view `begin_authenticate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:175"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb8fa5d422e93881", "name": "Django view `complete_authenticate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:195", "shortDescription": {"text": "Django view `complete_authenticate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:195"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6df34796b49863f0", "name": "Django view `setup_page` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:269", "shortDescription": {"text": "Django view `setup_page` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:269"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d9cd52b13fc0e64", "name": "Django view `setup_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/web_views.py:54", "shortDescription": {"text": "Django view `setup_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/web_views.py:54"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-669f51fed2c2b481", "name": "Dangling fetch: GET /api/runs/${this.runId}/diagram/ (zebra-agent-web/static/js/workflow-diagram.js:76)", "shortDescription": {"text": "Dangling fetch: GET /api/runs/${this.runId}/diagram/ (zebra-agent-web/static/js/workflow-diagram.js:76)"}, "fullDescription": {"text": "`zebra-agent-web/static/js/workflow-diagram.js:76` calls `GET /api/runs/${this.runId}/diagram/` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/runs/<p>/diagram`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce2b53a5ca6f724d", "name": "Unused endpoint: ANY /auth/", "shortDescription": {"text": "Unused endpoint: ANY /auth/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /auth/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce0a9b4397331ef4", "name": "Unused endpoint: ANY /api/", "shortDescription": {"text": "Unused endpoint: ANY /api/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /api/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4052362b696d7d09", "name": "Unused endpoint: ANY /setup/", "shortDescription": {"text": "Unused endpoint: ANY /setup/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /setup/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b1a82635b61f711", "name": "Unused endpoint: ANY /run/", "shortDescription": {"text": "Unused endpoint: ANY /run/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /run/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b78225acca5e2672", "name": "Unused endpoint: ANY /run/execute/", "shortDescription": {"text": "Unused endpoint: ANY /run/execute/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /run/execute/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7cae0a8b1c5257a", "name": "Unused endpoint: ANY /run/queue/", "shortDescription": {"text": "Unused endpoint: ANY /run/queue/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /run/queue/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4122ff290b2b608", "name": "Unused endpoint: ANY /activity/", "shortDescription": {"text": "Unused endpoint: ANY /activity/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /activity/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4cefe1dcf3987081", "name": "Unused endpoint: ANY /workflows/", "shortDescription": {"text": "Unused endpoint: ANY /workflows/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /workflows/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b61259dc3256eb6", "name": "Unused endpoint: ANY /workflows/create/", "shortDescription": {"text": "Unused endpoint: ANY /workflows/create/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /workflows/create/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-496f8e603251202c", "name": "Unused endpoint: ANY /workflows/<str:workflow_name>/", "shortDescription": {"text": "Unused endpoint: ANY /workflows/<str:workflow_name>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /workflows/<str:workflow_name>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9d2a789d79631fa", "name": "Unused endpoint: ANY /workflows/<str:workflow_name>/delete/", "shortDescription": {"text": "Unused endpoint: ANY /workflows/<str:workflow_name>/delete/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /workflows/<str:workflow_name>/delete/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3e45e00eecc2c32", "name": "Unused endpoint: ANY /processes/<str:process_id>/cancel/", "shortDescription": {"text": "Unused endpoint: ANY /processes/<str:process_id>/cancel/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /processes/<str:process_id>/cancel/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-259984e36d252911", "name": "Unused endpoint: ANY /processes/bulk-cancel/", "shortDescription": {"text": "Unused endpoint: ANY /processes/bulk-cancel/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /processes/bulk-cancel/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32a1744da29e1f5e", "name": "Unused endpoint: ANY /tasks/<str:task_id>/", "shortDescription": {"text": "Unused endpoint: ANY /tasks/<str:task_id>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /tasks/<str:task_id>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-808e5f2c87d4d281", "name": "Unused endpoint: ANY /tasks/<str:task_id>/submit/", "shortDescription": {"text": "Unused endpoint: ANY /tasks/<str:task_id>/submit/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /tasks/<str:task_id>/submit/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1a8fdae6e51d778", "name": "Unused endpoint: ANY /profile/values/", "shortDescription": {"text": "Unused endpoint: ANY /profile/values/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /profile/values/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e910106328c17f6", "name": "Unused endpoint: ANY /trust/", "shortDescription": {"text": "Unused endpoint: ANY /trust/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /trust/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f46de138e01cd9b", "name": "Unused endpoint: ANY /trust/pause-all/", "shortDescription": {"text": "Unused endpoint: ANY /trust/pause-all/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /trust/pause-all/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14360b6c7776ead0", "name": "Unused endpoint: ANY /trust/freeing/<str:action>/", "shortDescription": {"text": "Unused endpoint: ANY /trust/freeing/<str:action>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /trust/freeing/<str:action>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45b0db73a083bc09", "name": "Unused endpoint: ANY /trust/<str:domain>/set/", "shortDescription": {"text": "Unused endpoint: ANY /trust/<str:domain>/set/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /trust/<str:domain>/set/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c57553c4b7cb6573", "name": "Unused endpoint: ANY /trust/suggestions/<str:suggestion_id>/resolve/", "shortDescription": {"text": "Unused endpoint: ANY /trust/suggestions/<str:suggestion_id>/resolve/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /trust/suggestions/<str:suggestion_id>/resolve/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3cf44edeefb0394", "name": "Unused endpoint: ANY /knowledge/", "shortDescription": {"text": "Unused endpoint: ANY /knowledge/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /knowledge/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e0668c2dec92d29", "name": "Unused endpoint: ANY /knowledge/create/", "shortDescription": {"text": "Unused endpoint: ANY /knowledge/create/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /knowledge/create/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a80942a78c50ea1d", "name": "Unused endpoint: ANY /knowledge/<str:entry_id>/edit/", "shortDescription": {"text": "Unused endpoint: ANY /knowledge/<str:entry_id>/edit/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /knowledge/<str:entry_id>/edit/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e828e429654e8ac2", "name": "Unused endpoint: ANY /knowledge/<str:entry_id>/delete/", "shortDescription": {"text": "Unused endpoint: ANY /knowledge/<str:entry_id>/delete/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /knowledge/<str:entry_id>/delete/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a36b1c83d3196abf", "name": "Unused endpoint: ANY /runs/<str:run_id>/", "shortDescription": {"text": "Unused endpoint: ANY /runs/<str:run_id>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /runs/<str:run_id>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b03cb89c6e180147", "name": "Unused endpoint: ANY /runs/<str:run_id>/rate/", "shortDescription": {"text": "Unused endpoint: ANY /runs/<str:run_id>/rate/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /runs/<str:run_id>/rate/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add005db34ce5af7", "name": "Unused endpoint: ANY /runs/<str:run_id>/feedback/", "shortDescription": {"text": "Unused endpoint: ANY /runs/<str:run_id>/feedback/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /runs/<str:run_id>/feedback/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8cbc8261ddb9a4a", "name": "Unused endpoint: ANY /ethics-audit/", "shortDescription": {"text": "Unused endpoint: ANY /ethics-audit/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /ethics-audit/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-951bacbc5f8e26e4", "name": "Unused endpoint: ANY /tasks/", "shortDescription": {"text": "Unused endpoint: ANY /tasks/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /tasks/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ade9cacefab823fc", "name": "Unused endpoint: ANY /runs/in-progress/", "shortDescription": {"text": "Unused endpoint: ANY /runs/in-progress/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /runs/in-progress/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3be4832ed96ef2fa", "name": "Unused endpoint: ANY /runs/", "shortDescription": {"text": "Unused endpoint: ANY /runs/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/urls.py` declares `ANY /runs/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-809d04b31639aaf9", "name": "Unused endpoint: ANY /auth/setup/", "shortDescription": {"text": "Unused endpoint: ANY /auth/setup/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/auth_urls.py` declares `ANY /auth/setup/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2517dae61e646158", "name": "Unused endpoint: ANY /auth/login/", "shortDescription": {"text": "Unused endpoint: ANY /auth/login/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/auth_urls.py` declares `ANY /auth/login/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aeeb94f5cc9f0484", "name": "Unused endpoint: ANY /auth/logout/", "shortDescription": {"text": "Unused endpoint: ANY /auth/logout/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/auth_urls.py` declares `ANY /auth/logout/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a05ddd55ad6ae178", "name": "Unused endpoint: ANY /ws/goal/<str:run_id>/", "shortDescription": {"text": "Unused endpoint: ANY /ws/goal/<str:run_id>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/routing.py` declares `ANY /ws/goal/<str:run_id>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c97b39b196381943", "name": "Unused endpoint: ANY /api/health/", "shortDescription": {"text": "Unused endpoint: ANY /api/health/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/health/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-884d9676cdee51a2", "name": "Unused endpoint: ANY /api/metrics/", "shortDescription": {"text": "Unused endpoint: ANY /api/metrics/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/metrics/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de1d686b5bb4af58", "name": "Unused endpoint: ANY /api/version/", "shortDescription": {"text": "Unused endpoint: ANY /api/version/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/version/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-188f2fafd8e03049", "name": "Unused endpoint: ANY /api/workflows/", "shortDescription": {"text": "Unused endpoint: ANY /api/workflows/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/workflows/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ef2e2126f5c53a9", "name": "Unused endpoint: ANY /api/workflows/<str:workflow_name>/", "shortDescription": {"text": "Unused endpoint: ANY /api/workflows/<str:workflow_name>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/workflows/<str:workflow_name>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-715aabe6c780aa99", "name": "Unused endpoint: ANY /api/workflows/<str:workflow_name>/stats/", "shortDescription": {"text": "Unused endpoint: ANY /api/workflows/<str:workflow_name>/stats/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/workflows/<str:workflow_name>/stats/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bc213c3132d3598", "name": "Unused endpoint: ANY /api/goals/", "shortDescription": {"text": "Unused endpoint: ANY /api/goals/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/goals/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-250424efa2a752d7", "name": "Unused endpoint: ANY /api/dream-cycle/", "shortDescription": {"text": "Unused endpoint: ANY /api/dream-cycle/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/dream-cycle/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c89957e263b2aa00", "name": "Unused endpoint: ANY /api/runs/", "shortDescription": {"text": "Unused endpoint: ANY /api/runs/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/runs/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40f69d9526868de2", "name": "Unused endpoint: ANY /api/runs/<str:run_id>/", "shortDescription": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/runs/<str:run_id>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52ccb46a01b2a64e", "name": "Unused endpoint: ANY /api/runs/<str:run_id>/rate/", "shortDescription": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/rate/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/runs/<str:run_id>/rate/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8aa4cc753543445", "name": "Unused endpoint: ANY /api/runs/<str:run_id>/status/", "shortDescription": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/status/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/runs/<str:run_id>/status/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e03421b7ddb1ca13", "name": "Unused endpoint: ANY /api/runs/<str:run_id>/diagram/", "shortDescription": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/diagram/"}, "fullDescription": {"text": "`zebra-agent-web/zebra_agent_web/api/urls.py` declares `ANY /api/runs/<str:run_id>/diagram/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24575"}, "properties": {"repository": "bgidley/zebra", "repoUrl": "https://github.com/bgidley/zebra", "branch": "main"}, "results": [{"ruleId": "scanner-4ce12f30ee8f2640", "level": "note", "message": {"text": "Possibly dead Python function: safe_import"}, "properties": {"repobilityId": "368a5cba3c85fdae", "scanner": "scanner-primary", "fingerprint": "4ce12f30ee8f2640", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-tasks/zebra_tasks/compute/python_exec.py:215"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2525cfefbb33f21", "level": "note", "message": {"text": "Possibly dead Python function: do_search"}, "properties": {"repobilityId": "9a2e66580fbbabfc", "scanner": "scanner-primary", "fingerprint": "f2525cfefbb33f21", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-tasks/zebra_tasks/filesystem/search.py:259"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cef50c292c51626b", "level": "note", "message": {"text": "Possibly dead Python function: do_glob"}, "properties": {"repobilityId": "5233d137c5b39be1", "scanner": "scanner-primary", "fingerprint": "cef50c292c51626b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-tasks/zebra_tasks/filesystem/info.py:503"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-349e26dca3fa84d3", "level": "note", "message": {"text": "Possibly dead Python function: do_copy"}, "properties": {"repobilityId": "96cccd4991fd9d66", "scanner": "scanner-primary", "fingerprint": "349e26dca3fa84d3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-tasks/zebra_tasks/filesystem/copy.py:229"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0aa3138251ea36d3", "level": "note", "message": {"text": "Possibly dead Python function: replace_var"}, "properties": {"repobilityId": "6ddd6a0618c8f87c", "scanner": "scanner-primary", "fingerprint": "0aa3138251ea36d3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-py/zebra/tasks/base.py:187"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d0e86854af18c87", "level": "note", "message": {"text": "Possibly dead Python function: serve"}, "properties": {"repobilityId": "14ba9a32ffb07e31", "scanner": "scanner-primary", "fingerprint": "1d0e86854af18c87", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/cli.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8232868ae323f9f5", "level": "note", "message": {"text": "Possibly dead Python function: serve_public"}, "properties": {"repobilityId": "a6384e407164081b", "scanner": "scanner-primary", "fingerprint": "8232868ae323f9f5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/cli.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-096506d58e6704f3", "level": "note", "message": {"text": "Possibly dead Python function: dev_public"}, "properties": {"repobilityId": "0d49da7cca46eb2f", "scanner": "scanner-primary", "fingerprint": "096506d58e6704f3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/cli.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-111fddbdc8e912f8", "level": "note", "message": {"text": "Possibly dead Python function: configure_sqlite_pragmas"}, "properties": {"repobilityId": "ea2f6d3ffadce86f", "scanner": "scanner-primary", "fingerprint": "111fddbdc8e912f8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/e2e_settings.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3799d858fba486df", "level": "note", "message": {"text": "Possibly dead Python function: run_async"}, "properties": {"repobilityId": "8cf4eee5a8a185df", "scanner": "scanner-primary", "fingerprint": "3799d858fba486df", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/agent_engine.py:291"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e07810845fe86b3f", "level": "note", "message": {"text": "Possibly dead Python function: run_async"}, "properties": {"repobilityId": "8cf4eee5a8a185df", "scanner": "scanner-primary", "fingerprint": "e07810845fe86b3f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/engine.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de6b5cd29311e7d8", "level": "note", "message": {"text": "Possibly dead Python function: do_logout"}, "properties": {"repobilityId": "815f167527973bd0", "scanner": "scanner-primary", "fingerprint": "de6b5cd29311e7d8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/auth_views.py:257"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f617260d7bd6d75a", "level": "note", "message": {"text": "Possibly dead Python function: disconnect"}, "properties": {"repobilityId": "87a37be95663a882", "scanner": "scanner-primary", "fingerprint": "f617260d7bd6d75a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/consumers.py:36"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9250d51e083833f4", "level": "note", "message": {"text": "Possibly dead Python function: receive"}, "properties": {"repobilityId": "cee25c787206e974", "scanner": "scanner-primary", "fingerprint": "9250d51e083833f4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/consumers.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebe2f1da944dec31", "level": "note", "message": {"text": "Possibly dead Python function: goal_progress"}, "properties": {"repobilityId": "f7582abf21996bd3", "scanner": "scanner-primary", "fingerprint": "ebe2f1da944dec31", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/consumers.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f114968824e1328", "level": "note", "message": {"text": "Possibly dead Python function: replace_var"}, "properties": {"repobilityId": "6ddd6a0618c8f87c", "scanner": "scanner-primary", "fingerprint": "6f114968824e1328", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/web_views.py:1600"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b6f8f83d6d38618", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.14-slim"}, "properties": {"repobilityId": "ca8d7ab3eb3f1234", "scanner": "scanner-primary", "fingerprint": "6b6f8f83d6d38618", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-6b6f8f83d6d38618", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.14-slim"}, "properties": {"repobilityId": "825c091f6098db3c", "scanner": "scanner-primary", "fingerprint": "6b6f8f83d6d38618", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-c8261a033e6cb9a2", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in zebra-tasks/zebra_tasks/compute/python_exec.py:172"}, "properties": {"repobilityId": "73e045a59745e1ad", "scanner": "scanner-primary", "fingerprint": "c8261a033e6cb9a2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-tasks/zebra_tasks/compute/python_exec.py"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-fb0395642c4aea19", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in zebra-agent-web/static/js/workflow-diagram.js:90"}, "properties": {"repobilityId": "b64ce35c98d46c3e", "scanner": "scanner-primary", "fingerprint": "fb0395642c4aea19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/static/js/workflow-diagram.js"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-b5199c5afb61f1cf", "level": "note", "message": {"text": "Very large file: zebra-tasks/tests/test_agent_loop_actions.py (1394 lines)"}, "properties": {"repobilityId": "ac3cd79281721781", "scanner": "scanner-primary", "fingerprint": "b5199c5afb61f1cf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d3da0934b2848852", "level": "note", "message": {"text": "Very large file: zebra-agent-web/zebra_agent_web/api/views.py (1552 lines)"}, "properties": {"repobilityId": "82ff7dc6f10b0027", "scanner": "scanner-primary", "fingerprint": "d3da0934b2848852", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f712a9aa0f95e8cd", "level": "note", "message": {"text": "Very large file: zebra-agent-web/zebra_agent_web/api/web_views.py (2240 lines)"}, "properties": {"repobilityId": "ca1f809e869e36cc", "scanner": "scanner-primary", "fingerprint": "f712a9aa0f95e8cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ad7d519f7d13c94f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "85d4264de6abde80", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "97c688862e81ca8a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08adca2df55f36ee", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: zebra-tasks/AGENTS.md"}, "properties": {"repobilityId": "092eb276ba0b0332", "scanner": "scanner-primary", "fingerprint": "08adca2df55f36ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-tasks/AGENTS.md"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-319d44f812ec0bf9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: specs/AGENTS.md"}, "properties": {"repobilityId": "fc0e41c383de4b47", "scanner": "scanner-primary", "fingerprint": "319d44f812ec0bf9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f4dde80c8c23c4f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/cicd.md"}, "properties": {"repobilityId": "0ed2bfa4d7a2888e", "scanner": "scanner-primary", "fingerprint": "1f4dde80c8c23c4f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/cicd.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df8d7aecf447de62", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md"}, "properties": {"repobilityId": "222623e99b9cb4f7", "scanner": "scanner-primary", "fingerprint": "df8d7aecf447de62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/opsx/archive.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-021b572fe2fa6b9c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md"}, "properties": {"repobilityId": "5ba922ec1bca34d1", "scanner": "scanner-primary", "fingerprint": "021b572fe2fa6b9c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/opsx/apply.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ac5809991699615", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/propose.md"}, "properties": {"repobilityId": "e37a98f3a92694cb", "scanner": "scanner-primary", "fingerprint": "3ac5809991699615", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/opsx/propose.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2209d9ef8cd8a3ad", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-propose/SKILL.md"}, "properties": {"repobilityId": "7de6b20ae203c780", "scanner": "scanner-primary", "fingerprint": "2209d9ef8cd8a3ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/openspec-propose/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14b94de34d897ad4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-apply-change/SKILL.md"}, "properties": {"repobilityId": "ff525910a58aad1b", "scanner": "scanner-primary", "fingerprint": "14b94de34d897ad4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/openspec-apply-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a585f74bb40a5f1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-archive-change/SKILL.md"}, "properties": {"repobilityId": "1499167b45dee6be", "scanner": "scanner-primary", "fingerprint": "8a585f74bb40a5f1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/openspec-archive-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-525d12f44750fc63", "level": "note", "message": {"text": "Legacy-named symbol `subdir1_copy` in zebra-tasks/tests/test_filesystem.py:353"}, "properties": {"repobilityId": "5381bd42c2600107", "scanner": "scanner-primary", "fingerprint": "525d12f44750fc63", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-075763101ae88566", "level": "none", "message": {"text": "Commented-code block (5 lines) in zebra-tasks/zebra_tasks/agent/record_metrics.py:149"}, "properties": {"repobilityId": "a4218bbbe92bb04a", "scanner": "scanner-primary", "fingerprint": "075763101ae88566", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a16fa04ae8fa9a97", "level": "note", "message": {"text": "Legacy-named symbol `file_copy` in zebra-tasks/zebra_tasks/filesystem/copy.py:38"}, "properties": {"repobilityId": "a998426924e8462a", "scanner": "scanner-primary", "fingerprint": "a16fa04ae8fa9a97", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e9a85ad1df74f4f9", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in zebra-py/tests/test_recovery.py:112"}, "properties": {"repobilityId": "eeae58b49c88f4eb", "scanner": "scanner-primary", "fingerprint": "e9a85ad1df74f4f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d716807b9d7274de", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in zebra-py/zebra/core/engine.py:161"}, "properties": {"repobilityId": "df455f8f08fba074", "scanner": "scanner-primary", "fingerprint": "d716807b9d7274de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c417d0a6de712982", "level": "none", "message": {"text": "Commented-code block (5 lines) in zebra-py/zebra/tasks/base.py:265"}, "properties": {"repobilityId": "4bd7415d6f2ecad5", "scanner": "scanner-primary", "fingerprint": "c417d0a6de712982", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9799614eb4896f12", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 zebra-agent-web/static/js/webauthn.js:44"}, "properties": {"repobilityId": "ddc50cd0f835b4ae", "scanner": "scanner-primary", "fingerprint": "9799614eb4896f12", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-034ccf585f178e28", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in zebra-agent-web/tests/unit/test_human_tasks.py:320"}, "properties": {"repobilityId": "740eaa1117522e4f", "scanner": "scanner-primary", "fingerprint": "034ccf585f178e28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-812e9a8abcdd44d9", "level": "note", "message": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent-web/zebra_agent_web/ethics_audit_store.py:40"}, "properties": {"repobilityId": "4a29ed3e5b68068d", "scanner": "scanner-primary", "fingerprint": "812e9a8abcdd44d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-854cc57689077b57", "level": "none", "message": {"text": "Commented-code block (8 lines) in zebra-agent-web/zebra_agent_web/settings.py:91"}, "properties": {"repobilityId": "77be29e5879db356", "scanner": "scanner-primary", "fingerprint": "854cc57689077b57", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a086009ab425440", "level": "note", "message": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent-web/zebra_agent_web/trust_store.py:114"}, "properties": {"repobilityId": "47f16851c4758595", "scanner": "scanner-primary", "fingerprint": "8a086009ab425440", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-1949ab73a308245f", "level": "note", "message": {"text": "Legacy-named symbol `test_wizard_edit_mode_pre_populates_and_creates_v2` in zebra-agent/tests/test_values_profile_wizard.py:149"}, "properties": {"repobilityId": "17e2766d37ba2b9a", "scanner": "scanner-primary", "fingerprint": "1949ab73a308245f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e1e9e00391b9c1e5", "level": "note", "message": {"text": "Legacy-named symbol `fetched_v1` in zebra-agent/tests/test_profile_store.py:97"}, "properties": {"repobilityId": "4e38b9a4b88af85a", "scanner": "scanner-primary", "fingerprint": "e1e9e00391b9c1e5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-17dff523a5355449", "level": "note", "message": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent/zebra_agent/storage/memory.py:250"}, "properties": {"repobilityId": "6a62096ed41d2872", "scanner": "scanner-primary", "fingerprint": "17dff523a5355449", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-df975bcdd9c8bd81", "level": "note", "message": {"text": "Stub function `close` (body is just `pass`/`return`) \u2014 zebra-agent/zebra_agent/storage/ethics_audit.py:27"}, "properties": {"repobilityId": "98e9fba4e4b14827", "scanner": "scanner-primary", "fingerprint": "df975bcdd9c8bd81", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-a9836457f7ec50c4", "level": "note", "message": {"text": "23 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "71ec3608d30f8bcd", "scanner": "scanner-primary", "fingerprint": "a9836457f7ec50c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "2a24982752be6e81", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2f5638115844468e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "a48b1fd5cbff20b0", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "62ec9d5068a075be", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3645a3adc98ddcbd", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "22bda4c8a07b81a8", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "0789f6bf68ad241b", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "3ecbc35524768b50", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "abcb4eb491c3fa7a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ed7395ecc9a4ddbc", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "63a1d572e2700fa7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "6f7264b61da74092", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "65c7f2223b3a5864", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "09a4026b2cba7cf1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "7bb8dc6c82002c0d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "40bc9a88cc378274", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fa0537398569e6d8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2e8b5bbdabe245d6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "337adbc5baf4e752", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "473884bf65f41563", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-ee32339d68a02206", "level": "warning", "message": {"text": "Django view `health_check` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:74"}, "properties": {"repobilityId": "78890653d409c7de", "scanner": "scanner-primary", "fingerprint": "ee32339d68a02206", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-8441a9e6f9f17475", "level": "warning", "message": {"text": "Django view `metrics_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:116"}, "properties": {"repobilityId": "cb3e55930f8ddc4b", "scanner": "scanner-primary", "fingerprint": "8441a9e6f9f17475", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-2d11146b7e8be0c8", "level": "warning", "message": {"text": "Django view `execute_goal` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:364"}, "properties": {"repobilityId": "d11a88217b22992e", "scanner": "scanner-primary", "fingerprint": "2d11146b7e8be0c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-260bbd9cd94d4c84", "level": "warning", "message": {"text": "Django view `dream_cycle` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:414"}, "properties": {"repobilityId": "e513a93def561d8a", "scanner": "scanner-primary", "fingerprint": "260bbd9cd94d4c84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 414}}}]}, {"ruleId": "scanner-2da7d82982f0cc41", "level": "warning", "message": {"text": "Django view `run_rate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:514"}, "properties": {"repobilityId": "ce2473013b203af6", "scanner": "scanner-primary", "fingerprint": "2da7d82982f0cc41", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 514}}}]}, {"ruleId": "scanner-33c02e369dd4f044", "level": "warning", "message": {"text": "Django view `run_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:556"}, "properties": {"repobilityId": "59460ad8966b9621", "scanner": "scanner-primary", "fingerprint": "33c02e369dd4f044", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 556}}}]}, {"ruleId": "scanner-55c83dea37d72673", "level": "warning", "message": {"text": "Django view `run_diagram` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:679"}, "properties": {"repobilityId": "565092c0c48c5a26", "scanner": "scanner-primary", "fingerprint": "55c83dea37d72673", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 679}}}]}, {"ruleId": "scanner-50cd4d21296f92ad", "level": "warning", "message": {"text": "Django view `budget_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:731"}, "properties": {"repobilityId": "ade094cf1a55c8e8", "scanner": "scanner-primary", "fingerprint": "50cd4d21296f92ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 731}}}]}, {"ruleId": "scanner-8e465109b23d940e", "level": "warning", "message": {"text": "Django view `process_detail` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:764"}, "properties": {"repobilityId": "6b5caed65fe55911", "scanner": "scanner-primary", "fingerprint": "8e465109b23d940e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 764}}}]}, {"ruleId": "scanner-89b0296a230ddb92", "level": "warning", "message": {"text": "Django view `process_pending_tasks` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:816"}, "properties": {"repobilityId": "d85c64b8b67087ff", "scanner": "scanner-primary", "fingerprint": "89b0296a230ddb92", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 816}}}]}, {"ruleId": "scanner-32d82dd1095aac94", "level": "warning", "message": {"text": "Django view `task_complete` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:878"}, "properties": {"repobilityId": "daeaec8513e473e3", "scanner": "scanner-primary", "fingerprint": "32d82dd1095aac94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 878}}}]}, {"ruleId": "scanner-0ed0680946b9c999", "level": "warning", "message": {"text": "Django view `process_cancel` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:971"}, "properties": {"repobilityId": "5128342afc072576", "scanner": "scanner-primary", "fingerprint": "0ed0680946b9c999", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 971}}}]}, {"ruleId": "scanner-d31ad35ae1569819", "level": "warning", "message": {"text": "Django view `kill_switch_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1026"}, "properties": {"repobilityId": "51bc266c2078a1e5", "scanner": "scanner-primary", "fingerprint": "d31ad35ae1569819", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1026}}}]}, {"ruleId": "scanner-8bcfbd82632a4054", "level": "warning", "message": {"text": "Django view `process_delete` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1054"}, "properties": {"repobilityId": "6cf5280f539e0241", "scanner": "scanner-primary", "fingerprint": "8bcfbd82632a4054", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1054}}}]}, {"ruleId": "scanner-34476fc1d8fa5d34", "level": "warning", "message": {"text": "Django view `delete_user_data` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1088"}, "properties": {"repobilityId": "f93c9324a6acab25", "scanner": "scanner-primary", "fingerprint": "34476fc1d8fa5d34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1088}}}]}, {"ruleId": "scanner-c81ba32f0d6096d4", "level": "warning", "message": {"text": "Django view `version_info` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1148"}, "properties": {"repobilityId": "0ac8e1989b080752", "scanner": "scanner-primary", "fingerprint": "c81ba32f0d6096d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1148}}}]}, {"ruleId": "scanner-a0b4bbd22282612e", "level": "warning", "message": {"text": "Django view `ethics_audit_list` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1186"}, "properties": {"repobilityId": "7adacabdd7363753", "scanner": "scanner-primary", "fingerprint": "a0b4bbd22282612e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1186}}}]}, {"ruleId": "scanner-7911073ad6655214", "level": "warning", "message": {"text": "Django view `export_data` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1306"}, "properties": {"repobilityId": "52a5067f482bddb8", "scanner": "scanner-primary", "fingerprint": "7911073ad6655214", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1306}}}]}, {"ruleId": "scanner-cab4d5365744d75a", "level": "warning", "message": {"text": "Django view `ethics_audit_detail` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1338"}, "properties": {"repobilityId": "7416101dbe6f5958", "scanner": "scanner-primary", "fingerprint": "cab4d5365744d75a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1338}}}]}, {"ruleId": "scanner-faf1875bdba05b47", "level": "warning", "message": {"text": "Django view `trust_levels` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1383"}, "properties": {"repobilityId": "b280e3a1fcaf22bf", "scanner": "scanner-primary", "fingerprint": "faf1875bdba05b47", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1383}}}]}, {"ruleId": "scanner-eb3dbedfe4f502ca", "level": "warning", "message": {"text": "Django view `trust_set_level` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1391"}, "properties": {"repobilityId": "1b29441a3b98145e", "scanner": "scanner-primary", "fingerprint": "eb3dbedfe4f502ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1391}}}]}, {"ruleId": "scanner-4d9f291b264ea8b3", "level": "warning", "message": {"text": "Django view `trust_changes` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1425"}, "properties": {"repobilityId": "dc58ab5e98971325", "scanner": "scanner-primary", "fingerprint": "4d9f291b264ea8b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1425}}}]}, {"ruleId": "scanner-1aa692c576010826", "level": "warning", "message": {"text": "Django view `trust_pause_all` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1449"}, "properties": {"repobilityId": "852803c21fa9a008", "scanner": "scanner-primary", "fingerprint": "1aa692c576010826", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1449}}}]}, {"ruleId": "scanner-168f54bea97f8d59", "level": "warning", "message": {"text": "Django view `trust_freeing_status` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1467"}, "properties": {"repobilityId": "f1ea3c5f5a704866", "scanner": "scanner-primary", "fingerprint": "168f54bea97f8d59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1467}}}]}, {"ruleId": "scanner-1fe70bcfa89b7e52", "level": "warning", "message": {"text": "Django view `trust_freeing_initiate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1477"}, "properties": {"repobilityId": "d5823ee4df364ea3", "scanner": "scanner-primary", "fingerprint": "1fe70bcfa89b7e52", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1477}}}]}, {"ruleId": "scanner-536489864efeb1a7", "level": "warning", "message": {"text": "Django view `trust_freeing_confirm` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1490"}, "properties": {"repobilityId": "30104a4e70f2857b", "scanner": "scanner-primary", "fingerprint": "536489864efeb1a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1490}}}]}, {"ruleId": "scanner-c681d03ff8a1a7a3", "level": "warning", "message": {"text": "Django view `trust_freeing_cancel` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1503"}, "properties": {"repobilityId": "15825c32259fc244", "scanner": "scanner-primary", "fingerprint": "c681d03ff8a1a7a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1503}}}]}, {"ruleId": "scanner-714d8cf8fd9d2414", "level": "warning", "message": {"text": "Django view `trust_suggestions` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1530"}, "properties": {"repobilityId": "89a1ee4f93144173", "scanner": "scanner-primary", "fingerprint": "714d8cf8fd9d2414", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1530}}}]}, {"ruleId": "scanner-685caae3e9454f1d", "level": "warning", "message": {"text": "Django view `trust_suggestion_resolve` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/views.py:1539"}, "properties": {"repobilityId": "3d0e5484301a24d2", "scanner": "scanner-primary", "fingerprint": "685caae3e9454f1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/views.py"}, "region": {"startLine": 1539}}}]}, {"ruleId": "scanner-0cced8b13955e57a", "level": "warning", "message": {"text": "Django view `begin_authenticate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:175"}, "properties": {"repobilityId": "9c126dc3896e1a65", "scanner": "scanner-primary", "fingerprint": "0cced8b13955e57a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/auth_views.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-fb8fa5d422e93881", "level": "warning", "message": {"text": "Django view `complete_authenticate` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:195"}, "properties": {"repobilityId": "476182d4b6b7a5d2", "scanner": "scanner-primary", "fingerprint": "fb8fa5d422e93881", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/auth_views.py"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-6df34796b49863f0", "level": "warning", "message": {"text": "Django view `setup_page` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/auth_views.py:269"}, "properties": {"repobilityId": "8f29c78a82d695a9", "scanner": "scanner-primary", "fingerprint": "6df34796b49863f0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/auth_views.py"}, "region": {"startLine": 269}}}]}, {"ruleId": "scanner-6d9cd52b13fc0e64", "level": "warning", "message": {"text": "Django view `setup_view` may be unauthenticated \u2014 zebra-agent-web/zebra_agent_web/api/web_views.py:54"}, "properties": {"repobilityId": "72ec87f3ba2057d1", "scanner": "scanner-primary", "fingerprint": "6d9cd52b13fc0e64", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "zebra-agent-web/zebra_agent_web/api/web_views.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-669f51fed2c2b481", "level": "error", "message": {"text": "Dangling fetch: GET /api/runs/${this.runId}/diagram/ (zebra-agent-web/static/js/workflow-diagram.js:76)"}, "properties": {"repobilityId": "a8eb7dceddbfe51d", "scanner": "scanner-primary", "fingerprint": "669f51fed2c2b481", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ce2b53a5ca6f724d", "level": "note", "message": {"text": "Unused endpoint: ANY /auth/"}, "properties": {"repobilityId": "4b24d83d85250e5a", "scanner": "scanner-primary", "fingerprint": "ce2b53a5ca6f724d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce0a9b4397331ef4", "level": "note", "message": {"text": "Unused endpoint: ANY /api/"}, "properties": {"repobilityId": "4722e878c473d8a0", "scanner": "scanner-primary", "fingerprint": "ce0a9b4397331ef4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4052362b696d7d09", "level": "note", "message": {"text": "Unused endpoint: ANY /setup/"}, "properties": {"repobilityId": "a50bdea7cf2d6ce5", "scanner": "scanner-primary", "fingerprint": "4052362b696d7d09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "f77b48430a413747", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b1a82635b61f711", "level": "note", "message": {"text": "Unused endpoint: ANY /run/"}, "properties": {"repobilityId": "e0fe8d74e86339e5", "scanner": "scanner-primary", "fingerprint": "0b1a82635b61f711", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b78225acca5e2672", "level": "note", "message": {"text": "Unused endpoint: ANY /run/execute/"}, "properties": {"repobilityId": "aad5b7b068e92348", "scanner": "scanner-primary", "fingerprint": "b78225acca5e2672", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a7cae0a8b1c5257a", "level": "note", "message": {"text": "Unused endpoint: ANY /run/queue/"}, "properties": {"repobilityId": "9e9a3a8810ba3100", "scanner": "scanner-primary", "fingerprint": "a7cae0a8b1c5257a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d4122ff290b2b608", "level": "note", "message": {"text": "Unused endpoint: ANY /activity/"}, "properties": {"repobilityId": "bd99a80256557496", "scanner": "scanner-primary", "fingerprint": "d4122ff290b2b608", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4cefe1dcf3987081", "level": "note", "message": {"text": "Unused endpoint: ANY /workflows/"}, "properties": {"repobilityId": "0f674c49290c502a", "scanner": "scanner-primary", "fingerprint": "4cefe1dcf3987081", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b61259dc3256eb6", "level": "note", "message": {"text": "Unused endpoint: ANY /workflows/create/"}, "properties": {"repobilityId": "0dd3f6c7437d2ea5", "scanner": "scanner-primary", "fingerprint": "7b61259dc3256eb6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-496f8e603251202c", "level": "note", "message": {"text": "Unused endpoint: ANY /workflows/<str:workflow_name>/"}, "properties": {"repobilityId": "a99e9e54bcbc528d", "scanner": "scanner-primary", "fingerprint": "496f8e603251202c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b9d2a789d79631fa", "level": "note", "message": {"text": "Unused endpoint: ANY /workflows/<str:workflow_name>/delete/"}, "properties": {"repobilityId": "4dede98b57f5dd13", "scanner": "scanner-primary", "fingerprint": "b9d2a789d79631fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3e45e00eecc2c32", "level": "note", "message": {"text": "Unused endpoint: ANY /processes/<str:process_id>/cancel/"}, "properties": {"repobilityId": "2e1a9eba87412626", "scanner": "scanner-primary", "fingerprint": "c3e45e00eecc2c32", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-259984e36d252911", "level": "note", "message": {"text": "Unused endpoint: ANY /processes/bulk-cancel/"}, "properties": {"repobilityId": "0b3f5b5f2f8c499c", "scanner": "scanner-primary", "fingerprint": "259984e36d252911", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32a1744da29e1f5e", "level": "note", "message": {"text": "Unused endpoint: ANY /tasks/<str:task_id>/"}, "properties": {"repobilityId": "6322e799280c62bc", "scanner": "scanner-primary", "fingerprint": "32a1744da29e1f5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-808e5f2c87d4d281", "level": "note", "message": {"text": "Unused endpoint: ANY /tasks/<str:task_id>/submit/"}, "properties": {"repobilityId": "1b08fac309cb4624", "scanner": "scanner-primary", "fingerprint": "808e5f2c87d4d281", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a1a8fdae6e51d778", "level": "note", "message": {"text": "Unused endpoint: ANY /profile/values/"}, "properties": {"repobilityId": "0b03e3979f35f5be", "scanner": "scanner-primary", "fingerprint": "a1a8fdae6e51d778", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e910106328c17f6", "level": "note", "message": {"text": "Unused endpoint: ANY /trust/"}, "properties": {"repobilityId": "9d300f4af468a933", "scanner": "scanner-primary", "fingerprint": "6e910106328c17f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f46de138e01cd9b", "level": "note", "message": {"text": "Unused endpoint: ANY /trust/pause-all/"}, "properties": {"repobilityId": "617598850cb5aea4", "scanner": "scanner-primary", "fingerprint": "6f46de138e01cd9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14360b6c7776ead0", "level": "note", "message": {"text": "Unused endpoint: ANY /trust/freeing/<str:action>/"}, "properties": {"repobilityId": "73864e2f56ca4ee9", "scanner": "scanner-primary", "fingerprint": "14360b6c7776ead0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45b0db73a083bc09", "level": "note", "message": {"text": "Unused endpoint: ANY /trust/<str:domain>/set/"}, "properties": {"repobilityId": "9bac2287820c9ce4", "scanner": "scanner-primary", "fingerprint": "45b0db73a083bc09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c57553c4b7cb6573", "level": "note", "message": {"text": "Unused endpoint: ANY /trust/suggestions/<str:suggestion_id>/resolve/"}, "properties": {"repobilityId": "c969ad5dae93d9ac", "scanner": "scanner-primary", "fingerprint": "c57553c4b7cb6573", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3cf44edeefb0394", "level": "note", "message": {"text": "Unused endpoint: ANY /knowledge/"}, "properties": {"repobilityId": "612c2276ea8c1fa8", "scanner": "scanner-primary", "fingerprint": "c3cf44edeefb0394", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e0668c2dec92d29", "level": "note", "message": {"text": "Unused endpoint: ANY /knowledge/create/"}, "properties": {"repobilityId": "f945f99692026e12", "scanner": "scanner-primary", "fingerprint": "1e0668c2dec92d29", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a80942a78c50ea1d", "level": "note", "message": {"text": "Unused endpoint: ANY /knowledge/<str:entry_id>/edit/"}, "properties": {"repobilityId": "317c5a94cb152468", "scanner": "scanner-primary", "fingerprint": "a80942a78c50ea1d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e828e429654e8ac2", "level": "note", "message": {"text": "Unused endpoint: ANY /knowledge/<str:entry_id>/delete/"}, "properties": {"repobilityId": "a4fcb9f824c0ae67", "scanner": "scanner-primary", "fingerprint": "e828e429654e8ac2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a36b1c83d3196abf", "level": "note", "message": {"text": "Unused endpoint: ANY /runs/<str:run_id>/"}, "properties": {"repobilityId": "edf445819e7ab0da", "scanner": "scanner-primary", "fingerprint": "a36b1c83d3196abf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b03cb89c6e180147", "level": "note", "message": {"text": "Unused endpoint: ANY /runs/<str:run_id>/rate/"}, "properties": {"repobilityId": "f6fae45ff35a53b3", "scanner": "scanner-primary", "fingerprint": "b03cb89c6e180147", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-add005db34ce5af7", "level": "note", "message": {"text": "Unused endpoint: ANY /runs/<str:run_id>/feedback/"}, "properties": {"repobilityId": "9d5da2311f874c1d", "scanner": "scanner-primary", "fingerprint": "add005db34ce5af7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d8cbc8261ddb9a4a", "level": "note", "message": {"text": "Unused endpoint: ANY /ethics-audit/"}, "properties": {"repobilityId": "f5418a04a3a0324c", "scanner": "scanner-primary", "fingerprint": "d8cbc8261ddb9a4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-951bacbc5f8e26e4", "level": "note", "message": {"text": "Unused endpoint: ANY /tasks/"}, "properties": {"repobilityId": "cd9f55a319e60368", "scanner": "scanner-primary", "fingerprint": "951bacbc5f8e26e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ade9cacefab823fc", "level": "note", "message": {"text": "Unused endpoint: ANY /runs/in-progress/"}, "properties": {"repobilityId": "e04fb6714c37bac8", "scanner": "scanner-primary", "fingerprint": "ade9cacefab823fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3be4832ed96ef2fa", "level": "note", "message": {"text": "Unused endpoint: ANY /runs/"}, "properties": {"repobilityId": "1448340e91bb0705", "scanner": "scanner-primary", "fingerprint": "3be4832ed96ef2fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-809d04b31639aaf9", "level": "note", "message": {"text": "Unused endpoint: ANY /auth/setup/"}, "properties": {"repobilityId": "aa518b3a900eff89", "scanner": "scanner-primary", "fingerprint": "809d04b31639aaf9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2517dae61e646158", "level": "note", "message": {"text": "Unused endpoint: ANY /auth/login/"}, "properties": {"repobilityId": "85099606cfa68fbb", "scanner": "scanner-primary", "fingerprint": "2517dae61e646158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aeeb94f5cc9f0484", "level": "note", "message": {"text": "Unused endpoint: ANY /auth/logout/"}, "properties": {"repobilityId": "30c6adbd1991907a", "scanner": "scanner-primary", "fingerprint": "aeeb94f5cc9f0484", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a05ddd55ad6ae178", "level": "note", "message": {"text": "Unused endpoint: ANY /ws/goal/<str:run_id>/"}, "properties": {"repobilityId": "766c67349b6f16fe", "scanner": "scanner-primary", "fingerprint": "a05ddd55ad6ae178", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c97b39b196381943", "level": "note", "message": {"text": "Unused endpoint: ANY /api/health/"}, "properties": {"repobilityId": "fc40cce057212d00", "scanner": "scanner-primary", "fingerprint": "c97b39b196381943", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-884d9676cdee51a2", "level": "note", "message": {"text": "Unused endpoint: ANY /api/metrics/"}, "properties": {"repobilityId": "d75b7a55e162d1ef", "scanner": "scanner-primary", "fingerprint": "884d9676cdee51a2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-de1d686b5bb4af58", "level": "note", "message": {"text": "Unused endpoint: ANY /api/version/"}, "properties": {"repobilityId": "1effcb0dffa3526e", "scanner": "scanner-primary", "fingerprint": "de1d686b5bb4af58", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-188f2fafd8e03049", "level": "note", "message": {"text": "Unused endpoint: ANY /api/workflows/"}, "properties": {"repobilityId": "e8d8407a6a2f2977", "scanner": "scanner-primary", "fingerprint": "188f2fafd8e03049", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ef2e2126f5c53a9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/workflows/<str:workflow_name>/"}, "properties": {"repobilityId": "3d4c15748cf41f0c", "scanner": "scanner-primary", "fingerprint": "3ef2e2126f5c53a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-715aabe6c780aa99", "level": "note", "message": {"text": "Unused endpoint: ANY /api/workflows/<str:workflow_name>/stats/"}, "properties": {"repobilityId": "18af077c58f657d2", "scanner": "scanner-primary", "fingerprint": "715aabe6c780aa99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6bc213c3132d3598", "level": "note", "message": {"text": "Unused endpoint: ANY /api/goals/"}, "properties": {"repobilityId": "e2b988b084590434", "scanner": "scanner-primary", "fingerprint": "6bc213c3132d3598", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-250424efa2a752d7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/dream-cycle/"}, "properties": {"repobilityId": "8e9b03b6d720d966", "scanner": "scanner-primary", "fingerprint": "250424efa2a752d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c89957e263b2aa00", "level": "note", "message": {"text": "Unused endpoint: ANY /api/runs/"}, "properties": {"repobilityId": "923979e014642dda", "scanner": "scanner-primary", "fingerprint": "c89957e263b2aa00", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40f69d9526868de2", "level": "note", "message": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/"}, "properties": {"repobilityId": "5ec493f5b003d370", "scanner": "scanner-primary", "fingerprint": "40f69d9526868de2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52ccb46a01b2a64e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/rate/"}, "properties": {"repobilityId": "afa3d7180b590248", "scanner": "scanner-primary", "fingerprint": "52ccb46a01b2a64e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8aa4cc753543445", "level": "note", "message": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/status/"}, "properties": {"repobilityId": "c6b31bcf8e320c2d", "scanner": "scanner-primary", "fingerprint": "e8aa4cc753543445", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e03421b7ddb1ca13", "level": "note", "message": {"text": "Unused endpoint: ANY /api/runs/<str:run_id>/diagram/"}, "properties": {"repobilityId": "aeee96966c2de31e", "scanner": "scanner-primary", "fingerprint": "e03421b7ddb1ca13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}