{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7505feeacfeb37f9", "name": "Stray `console.log` in TS/JS \u2014 server/db.js:98", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/db.js:98"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-399be93ab03590d1", "name": "Stray `console.log` in TS/JS \u2014 server/images.js:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/images.js:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac132bd64f8f5170", "name": "Stray `console.log` in TS/JS \u2014 server/index.js:619", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:619"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-662da348442b75fd", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfec5f881eaeabe5", "name": "Privileged port 20 in use", "shortDescription": {"text": "Privileged port 20 in use"}, "fullDescription": {"text": "Port 20 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c81bc1e89a3c5b86", "name": "Docker base image is tag-pinned but not digest-pinned: node:26-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:26-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68a2b8f5c8cd6b53", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 35 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 21 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2fa6cdb62e5a69cf", "name": "Agent instruction/config may expose a secret: .claude/skills/smoke-test/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/smoke-test/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e5f1ac4d11a0571e", "name": "Commented-code block (6 lines) in web/public/sw.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in web/public/sw.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90ad104202708965", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web/public/sw.js:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/public/sw.js:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9495d114d8d027f7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api.ts:24", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api.ts:24"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a69b3d893f7c2f64", "name": "Commented-code block (7 lines) in server/db.js:78", "shortDescription": {"text": "Commented-code block (7 lines) in server/db.js:78"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f44e2a5f16bbe5c0", "name": "Commented-code block (6 lines) in server/security.js:26", "shortDescription": {"text": "Commented-code block (6 lines) in server/security.js:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ba51058eee5ca39f", "name": "Commented-code block (5 lines) in server/images.js:13", "shortDescription": {"text": "Commented-code block (5 lines) in server/images.js:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-265305ef61abcd40", "name": "Commented-code block (5 lines) in server/backup.js:5", "shortDescription": {"text": "Commented-code block (5 lines) in server/backup.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67d28fa8cd6bb12f", "name": "Unused endpoint: PUT /", "shortDescription": {"text": "Unused endpoint: PUT /"}, "fullDescription": {"text": "`web/public/sw.js` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c1545494ab6166c", "name": "Unused endpoint: GET /api/me", "shortDescription": {"text": "Unused endpoint: GET /api/me"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7846df531751481", "name": "Unused endpoint: PUT /api/profile", "shortDescription": {"text": "Unused endpoint: PUT /api/profile"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b711cd9aa491588", "name": "Unused endpoint: POST /api/setup", "shortDescription": {"text": "Unused endpoint: POST /api/setup"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-200ab2e98a288506", "name": "Unused endpoint: POST /api/login", "shortDescription": {"text": "Unused endpoint: POST /api/login"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a10936f69cf3bbb4", "name": "Unused endpoint: POST /api/logout", "shortDescription": {"text": "Unused endpoint: POST /api/logout"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a634a311fe81b48", "name": "Unused endpoint: POST /api/password", "shortDescription": {"text": "Unused endpoint: POST /api/password"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5ce9968f3e0376e", "name": "Unused endpoint: GET /api/security/activity", "shortDescription": {"text": "Unused endpoint: GET /api/security/activity"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/security/activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fadf77dd2bdfec96", "name": "Unused endpoint: POST /api/security/logout-all", "shortDescription": {"text": "Unused endpoint: POST /api/security/logout-all"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/security/logout-all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b81da6b336fb44", "name": "Unused endpoint: POST /api/totp/setup", "shortDescription": {"text": "Unused endpoint: POST /api/totp/setup"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/totp/setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7716d6f72e53c339", "name": "Unused endpoint: POST /api/totp/enable", "shortDescription": {"text": "Unused endpoint: POST /api/totp/enable"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/totp/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-691ccf6924bd3210", "name": "Unused endpoint: POST /api/totp/disable", "shortDescription": {"text": "Unused endpoint: POST /api/totp/disable"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/totp/disable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7a360b33b916002", "name": "Unused endpoint: POST /api/webauthn/register-options", "shortDescription": {"text": "Unused endpoint: POST /api/webauthn/register-options"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/webauthn/register-options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47f62a12a3fe76d1", "name": "Unused endpoint: POST /api/webauthn/register-verify", "shortDescription": {"text": "Unused endpoint: POST /api/webauthn/register-verify"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/webauthn/register-verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51a86a0424c0567a", "name": "Unused endpoint: POST /api/webauthn/login-options", "shortDescription": {"text": "Unused endpoint: POST /api/webauthn/login-options"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/webauthn/login-options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da7f206b864ec6ce", "name": "Unused endpoint: POST /api/webauthn/login-verify", "shortDescription": {"text": "Unused endpoint: POST /api/webauthn/login-verify"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/webauthn/login-verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e38eb6c50451774", "name": "Unused endpoint: GET /api/webauthn/credentials", "shortDescription": {"text": "Unused endpoint: GET /api/webauthn/credentials"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/webauthn/credentials` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5af7cbc45362c42", "name": "Unused endpoint: DELETE /api/webauthn/credentials/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/webauthn/credentials/:id"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/webauthn/credentials/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f9414727a771345", "name": "Unused endpoint: GET /api/tabs", "shortDescription": {"text": "Unused endpoint: GET /api/tabs"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/tabs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d77daa2e73d07f39", "name": "Unused endpoint: POST /api/tabs", "shortDescription": {"text": "Unused endpoint: POST /api/tabs"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/tabs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-630c23978f5596c2", "name": "Unused endpoint: PUT /api/tabs/reorder", "shortDescription": {"text": "Unused endpoint: PUT /api/tabs/reorder"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/tabs/reorder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2d41027dd915991", "name": "Unused endpoint: PUT /api/tabs/:id", "shortDescription": {"text": "Unused endpoint: PUT /api/tabs/:id"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/tabs/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4c984fd23f32479", "name": "Unused endpoint: DELETE /api/tabs/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/tabs/:id"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/tabs/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-680ed3f222a717c1", "name": "Unused endpoint: GET /api/entries", "shortDescription": {"text": "Unused endpoint: GET /api/entries"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/entries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35c57a5e0db141fe", "name": "Unused endpoint: POST /api/entries", "shortDescription": {"text": "Unused endpoint: POST /api/entries"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/entries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5ceac6d650d92a4", "name": "Unused endpoint: PUT /api/entries/:id", "shortDescription": {"text": "Unused endpoint: PUT /api/entries/:id"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/entries/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48f8d150f1c47f90", "name": "Unused endpoint: DELETE /api/entries/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/entries/:id"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/entries/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ca0c1df37507af1", "name": "Unused endpoint: GET /api/attachments", "shortDescription": {"text": "Unused endpoint: GET /api/attachments"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/attachments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-116ce88c108b09c2", "name": "Unused endpoint: DELETE /api/attachments/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/attachments/:id"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/attachments/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-06effe21dde5b135", "name": "Unused endpoint: GET /api/files/:name", "shortDescription": {"text": "Unused endpoint: GET /api/files/:name"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/files/:name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b37265900e79a8a", "name": "Unused endpoint: GET /api/stats", "shortDescription": {"text": "Unused endpoint: GET /api/stats"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08f07bbf5b46f8e2", "name": "Unused endpoint: GET /api/onthisday", "shortDescription": {"text": "Unused endpoint: GET /api/onthisday"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/onthisday` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7021e2828e598e4", "name": "Unused endpoint: GET /api/settings/ai", "shortDescription": {"text": "Unused endpoint: GET /api/settings/ai"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/settings/ai` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-746510edc38a57c5", "name": "Unused endpoint: PUT /api/settings/ai", "shortDescription": {"text": "Unused endpoint: PUT /api/settings/ai"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/settings/ai` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bff7a3526b94127", "name": "Unused endpoint: POST /api/ai/test", "shortDescription": {"text": "Unused endpoint: POST /api/ai/test"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/ai/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2d67d297fb8b348", "name": "Unused endpoint: GET /api/push/vapid-key", "shortDescription": {"text": "Unused endpoint: GET /api/push/vapid-key"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/push/vapid-key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c622e6243ccd6e0a", "name": "Unused endpoint: POST /api/push/subscribe", "shortDescription": {"text": "Unused endpoint: POST /api/push/subscribe"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/push/subscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97cb8b976bfc0553", "name": "Unused endpoint: POST /api/push/unsubscribe", "shortDescription": {"text": "Unused endpoint: POST /api/push/unsubscribe"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/push/unsubscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a32befe977c8bb3", "name": "Unused endpoint: GET /api/settings/reminder", "shortDescription": {"text": "Unused endpoint: GET /api/settings/reminder"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/settings/reminder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96ad3bdc41eb5bbc", "name": "Unused endpoint: PUT /api/settings/reminder", "shortDescription": {"text": "Unused endpoint: PUT /api/settings/reminder"}, "fullDescription": {"text": "`server/index.js` declares `PUT /api/settings/reminder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81560ec224758e3e", "name": "Unused endpoint: POST /api/push/test", "shortDescription": {"text": "Unused endpoint: POST /api/push/test"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/push/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-800f5cf6e957c0f2", "name": "Unused endpoint: GET /api/export", "shortDescription": {"text": "Unused endpoint: GET /api/export"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf6e0986788edfbc", "name": "Unused endpoint: GET /api/backup", "shortDescription": {"text": "Unused endpoint: GET /api/backup"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/backup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a731a39c5a710fad", "name": "Unused endpoint: POST /api/restore", "shortDescription": {"text": "Unused endpoint: POST /api/restore"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20694"}, "properties": {"repository": "t0n003c/dayleaf", "repoUrl": "https://github.com/t0n003c/dayleaf", "branch": "main"}, "results": [{"ruleId": "scanner-7505feeacfeb37f9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/db.js:98"}, "properties": {"repobilityId": "0c27e1750d84b73e", "scanner": "scanner-primary", "fingerprint": "7505feeacfeb37f9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-399be93ab03590d1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/images.js:92"}, "properties": {"repobilityId": "2bd7bf51fa830f35", "scanner": "scanner-primary", "fingerprint": "399be93ab03590d1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ac132bd64f8f5170", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:619"}, "properties": {"repobilityId": "21e6b3de2b3dd856", "scanner": "scanner-primary", "fingerprint": "ac132bd64f8f5170", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-662da348442b75fd", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "662da348442b75fd", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfec5f881eaeabe5", "level": "warning", "message": {"text": "Privileged port 20 in use"}, "properties": {"repobilityId": "a59f3e53d617e0f8", "scanner": "scanner-primary", "fingerprint": "dfec5f881eaeabe5", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/smoke.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c81bc1e89a3c5b86", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:26-alpine"}, "properties": {"repobilityId": "38115a4ea003807e", "scanner": "scanner-primary", "fingerprint": "c81bc1e89a3c5b86", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-c81bc1e89a3c5b86", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:26-alpine"}, "properties": {"repobilityId": "6fe389a9cef3cab9", "scanner": "scanner-primary", "fingerprint": "c81bc1e89a3c5b86", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-68a2b8f5c8cd6b53", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0036b33690fe05ae", "scanner": "scanner-primary", "fingerprint": "68a2b8f5c8cd6b53", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d2db88af5336ff30", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "cd1e3f2bd63738a0", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "9204b67838b7db46", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "26c439ace2d72de4", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1b6f3f19b4e4a735", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "217a27e176dc49e2", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2fa6cdb62e5a69cf", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/smoke-test/SKILL.md"}, "properties": {"repobilityId": "e41d7b335b161f2b", "scanner": "scanner-primary", "fingerprint": "2fa6cdb62e5a69cf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/smoke-test/SKILL.md"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-e5f1ac4d11a0571e", "level": "none", "message": {"text": "Commented-code block (6 lines) in web/public/sw.js:1"}, "properties": {"repobilityId": "7575015f1bfc009b", "scanner": "scanner-primary", "fingerprint": "e5f1ac4d11a0571e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90ad104202708965", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/public/sw.js:40"}, "properties": {"repobilityId": "8dab77f49de39e98", "scanner": "scanner-primary", "fingerprint": "90ad104202708965", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9495d114d8d027f7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api.ts:24"}, "properties": {"repobilityId": "65b1222cdd70f9fd", "scanner": "scanner-primary", "fingerprint": "9495d114d8d027f7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a69b3d893f7c2f64", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/db.js:78"}, "properties": {"repobilityId": "bac7564b4bb58273", "scanner": "scanner-primary", "fingerprint": "a69b3d893f7c2f64", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f44e2a5f16bbe5c0", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/security.js:26"}, "properties": {"repobilityId": "feb032c668564a4e", "scanner": "scanner-primary", "fingerprint": "f44e2a5f16bbe5c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ba51058eee5ca39f", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/images.js:13"}, "properties": {"repobilityId": "6cd5b43852a645d5", "scanner": "scanner-primary", "fingerprint": "ba51058eee5ca39f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-265305ef61abcd40", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/backup.js:5"}, "properties": {"repobilityId": "5c53417d83dfa9fb", "scanner": "scanner-primary", "fingerprint": "265305ef61abcd40", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67d28fa8cd6bb12f", "level": "note", "message": {"text": "Unused endpoint: PUT /"}, "properties": {"repobilityId": "37fce6bb976a6f39", "scanner": "scanner-primary", "fingerprint": "67d28fa8cd6bb12f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c1545494ab6166c", "level": "note", "message": {"text": "Unused endpoint: GET /api/me"}, "properties": {"repobilityId": "481fae4065af422a", "scanner": "scanner-primary", "fingerprint": "5c1545494ab6166c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c7846df531751481", "level": "note", "message": {"text": "Unused endpoint: PUT /api/profile"}, "properties": {"repobilityId": "336f3eba625a292d", "scanner": "scanner-primary", "fingerprint": "c7846df531751481", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b711cd9aa491588", "level": "note", "message": {"text": "Unused endpoint: POST /api/setup"}, "properties": {"repobilityId": "a14a7487d20f6131", "scanner": "scanner-primary", "fingerprint": "7b711cd9aa491588", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-200ab2e98a288506", "level": "note", "message": {"text": "Unused endpoint: POST /api/login"}, "properties": {"repobilityId": "630a2d77bf27edcb", "scanner": "scanner-primary", "fingerprint": "200ab2e98a288506", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a10936f69cf3bbb4", "level": "note", "message": {"text": "Unused endpoint: POST /api/logout"}, "properties": {"repobilityId": "99d31810814300d5", "scanner": "scanner-primary", "fingerprint": "a10936f69cf3bbb4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8a634a311fe81b48", "level": "note", "message": {"text": "Unused endpoint: POST /api/password"}, "properties": {"repobilityId": "d1d31b8ae62b9cd1", "scanner": "scanner-primary", "fingerprint": "8a634a311fe81b48", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5ce9968f3e0376e", "level": "note", "message": {"text": "Unused endpoint: GET /api/security/activity"}, "properties": {"repobilityId": "f5237cb52bd1c94c", "scanner": "scanner-primary", "fingerprint": "a5ce9968f3e0376e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fadf77dd2bdfec96", "level": "note", "message": {"text": "Unused endpoint: POST /api/security/logout-all"}, "properties": {"repobilityId": "91e6b41b470cc557", "scanner": "scanner-primary", "fingerprint": "fadf77dd2bdfec96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8b81da6b336fb44", "level": "note", "message": {"text": "Unused endpoint: POST /api/totp/setup"}, "properties": {"repobilityId": "13229d77c25778a5", "scanner": "scanner-primary", "fingerprint": "b8b81da6b336fb44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7716d6f72e53c339", "level": "note", "message": {"text": "Unused endpoint: POST /api/totp/enable"}, "properties": {"repobilityId": "62ffc451f673f072", "scanner": "scanner-primary", "fingerprint": "7716d6f72e53c339", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-691ccf6924bd3210", "level": "note", "message": {"text": "Unused endpoint: POST /api/totp/disable"}, "properties": {"repobilityId": "3cc77e1695501704", "scanner": "scanner-primary", "fingerprint": "691ccf6924bd3210", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c7a360b33b916002", "level": "note", "message": {"text": "Unused endpoint: POST /api/webauthn/register-options"}, "properties": {"repobilityId": "44d613c95c8e3360", "scanner": "scanner-primary", "fingerprint": "c7a360b33b916002", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47f62a12a3fe76d1", "level": "note", "message": {"text": "Unused endpoint: POST /api/webauthn/register-verify"}, "properties": {"repobilityId": "27a21550816746f6", "scanner": "scanner-primary", "fingerprint": "47f62a12a3fe76d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-51a86a0424c0567a", "level": "note", "message": {"text": "Unused endpoint: POST /api/webauthn/login-options"}, "properties": {"repobilityId": "1f8fb7f179fdb803", "scanner": "scanner-primary", "fingerprint": "51a86a0424c0567a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da7f206b864ec6ce", "level": "note", "message": {"text": "Unused endpoint: POST /api/webauthn/login-verify"}, "properties": {"repobilityId": "8b26570731ca6bee", "scanner": "scanner-primary", "fingerprint": "da7f206b864ec6ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e38eb6c50451774", "level": "note", "message": {"text": "Unused endpoint: GET /api/webauthn/credentials"}, "properties": {"repobilityId": "47a7a01b049611ca", "scanner": "scanner-primary", "fingerprint": "1e38eb6c50451774", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5af7cbc45362c42", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/webauthn/credentials/:id"}, "properties": {"repobilityId": "546e341d196f56a7", "scanner": "scanner-primary", "fingerprint": "c5af7cbc45362c42", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9f9414727a771345", "level": "note", "message": {"text": "Unused endpoint: GET /api/tabs"}, "properties": {"repobilityId": "372d4f1a34766b4d", "scanner": "scanner-primary", "fingerprint": "9f9414727a771345", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d77daa2e73d07f39", "level": "note", "message": {"text": "Unused endpoint: POST /api/tabs"}, "properties": {"repobilityId": "df38f23e16195c32", "scanner": "scanner-primary", "fingerprint": "d77daa2e73d07f39", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-630c23978f5596c2", "level": "note", "message": {"text": "Unused endpoint: PUT /api/tabs/reorder"}, "properties": {"repobilityId": "36cfc47838139f44", "scanner": "scanner-primary", "fingerprint": "630c23978f5596c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d2d41027dd915991", "level": "note", "message": {"text": "Unused endpoint: PUT /api/tabs/:id"}, "properties": {"repobilityId": "78ff3ecb2ae1418d", "scanner": "scanner-primary", "fingerprint": "d2d41027dd915991", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4c984fd23f32479", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/tabs/:id"}, "properties": {"repobilityId": "17d33b9a4915bad0", "scanner": "scanner-primary", "fingerprint": "f4c984fd23f32479", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-680ed3f222a717c1", "level": "note", "message": {"text": "Unused endpoint: GET /api/entries"}, "properties": {"repobilityId": "2cd9a5ccc2427a9e", "scanner": "scanner-primary", "fingerprint": "680ed3f222a717c1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35c57a5e0db141fe", "level": "note", "message": {"text": "Unused endpoint: POST /api/entries"}, "properties": {"repobilityId": "107b9af6329a12b7", "scanner": "scanner-primary", "fingerprint": "35c57a5e0db141fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5ceac6d650d92a4", "level": "note", "message": {"text": "Unused endpoint: PUT /api/entries/:id"}, "properties": {"repobilityId": "54b1ef5c7d14a636", "scanner": "scanner-primary", "fingerprint": "b5ceac6d650d92a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-48f8d150f1c47f90", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/entries/:id"}, "properties": {"repobilityId": "147d10b7e5013496", "scanner": "scanner-primary", "fingerprint": "48f8d150f1c47f90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ca0c1df37507af1", "level": "note", "message": {"text": "Unused endpoint: GET /api/attachments"}, "properties": {"repobilityId": "c76f4a601ac4ca0c", "scanner": "scanner-primary", "fingerprint": "9ca0c1df37507af1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-116ce88c108b09c2", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/attachments/:id"}, "properties": {"repobilityId": "a231d5205de8bf3a", "scanner": "scanner-primary", "fingerprint": "116ce88c108b09c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-06effe21dde5b135", "level": "note", "message": {"text": "Unused endpoint: GET /api/files/:name"}, "properties": {"repobilityId": "b646cf4c9b3a4b70", "scanner": "scanner-primary", "fingerprint": "06effe21dde5b135", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b37265900e79a8a", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats"}, "properties": {"repobilityId": "bb81e23c97934c1f", "scanner": "scanner-primary", "fingerprint": "3b37265900e79a8a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-08f07bbf5b46f8e2", "level": "note", "message": {"text": "Unused endpoint: GET /api/onthisday"}, "properties": {"repobilityId": "b54dd3c15d9abe6a", "scanner": "scanner-primary", "fingerprint": "08f07bbf5b46f8e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e7021e2828e598e4", "level": "note", "message": {"text": "Unused endpoint: GET /api/settings/ai"}, "properties": {"repobilityId": "269b14547f7c941d", "scanner": "scanner-primary", "fingerprint": "e7021e2828e598e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-746510edc38a57c5", "level": "note", "message": {"text": "Unused endpoint: PUT /api/settings/ai"}, "properties": {"repobilityId": "92a5703b972b5cbd", "scanner": "scanner-primary", "fingerprint": "746510edc38a57c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bff7a3526b94127", "level": "note", "message": {"text": "Unused endpoint: POST /api/ai/test"}, "properties": {"repobilityId": "d33910985d18a7e2", "scanner": "scanner-primary", "fingerprint": "2bff7a3526b94127", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2d67d297fb8b348", "level": "note", "message": {"text": "Unused endpoint: GET /api/push/vapid-key"}, "properties": {"repobilityId": "877b5e51d3f9c01c", "scanner": "scanner-primary", "fingerprint": "b2d67d297fb8b348", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c622e6243ccd6e0a", "level": "note", "message": {"text": "Unused endpoint: POST /api/push/subscribe"}, "properties": {"repobilityId": "1dc44053bcd3f9c1", "scanner": "scanner-primary", "fingerprint": "c622e6243ccd6e0a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-97cb8b976bfc0553", "level": "note", "message": {"text": "Unused endpoint: POST /api/push/unsubscribe"}, "properties": {"repobilityId": "36fe5fc6ed6f75b2", "scanner": "scanner-primary", "fingerprint": "97cb8b976bfc0553", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a32befe977c8bb3", "level": "note", "message": {"text": "Unused endpoint: GET /api/settings/reminder"}, "properties": {"repobilityId": "f9115693a3514f53", "scanner": "scanner-primary", "fingerprint": "3a32befe977c8bb3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-96ad3bdc41eb5bbc", "level": "note", "message": {"text": "Unused endpoint: PUT /api/settings/reminder"}, "properties": {"repobilityId": "f9ceaddcc921f851", "scanner": "scanner-primary", "fingerprint": "96ad3bdc41eb5bbc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81560ec224758e3e", "level": "note", "message": {"text": "Unused endpoint: POST /api/push/test"}, "properties": {"repobilityId": "c94c5f44f80a913b", "scanner": "scanner-primary", "fingerprint": "81560ec224758e3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-800f5cf6e957c0f2", "level": "note", "message": {"text": "Unused endpoint: GET /api/export"}, "properties": {"repobilityId": "03365f19eaa0a3b3", "scanner": "scanner-primary", "fingerprint": "800f5cf6e957c0f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf6e0986788edfbc", "level": "note", "message": {"text": "Unused endpoint: GET /api/backup"}, "properties": {"repobilityId": "bbe823fdb52059e0", "scanner": "scanner-primary", "fingerprint": "bf6e0986788edfbc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a731a39c5a710fad", "level": "note", "message": {"text": "Unused endpoint: POST /api/restore"}, "properties": {"repobilityId": "2a00479124d13dae", "scanner": "scanner-primary", "fingerprint": "a731a39c5a710fad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}