Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

stoertebeker/picture-stage

https://github.com/stoertebeker/picture-stage · scanned 2026-06-16 00:22 UTC (2 months, 2 weeks ago)

102 raw signals (0 security + 102 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 89 actionable findings from 1 signal source. 13 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
48.5
/100
Security checks
49
0 findings
System graph
49
100.0% cov · 89 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 9 Medium 6 Low 68 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 89 Crowd 0 Layer: Software 5 Frontend 2 Network 1 Hardware 4 Security 8 Cicd 1 Quality 16 Api 52
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 48.5/100 with 100.0% coverage. It contains 1162 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 102 findings — concentrated in api (52), quality (21), software (11). Risk profile is high: 0 critical, 9 high, 7 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 83 of 89 actionable findings. 102 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: CLAUDE.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
CLAUDE.md:128 SecretsClaude instruction
high System graph api Wiring conf 1.00 Dangling fetch: POST /g/${this.token}/complete (frontend/static/js/components.js:237)
`frontend/static/js/components.js:237` calls `POST /g/${this.token}/complete` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/g/<p>/complete` If this points at an external API, prefix it with `https://` so the matche…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /g/${this.token}/selections (frontend/static/js/components.js:229)
`frontend/static/js/components.js:229` calls `POST /g/${this.token}/selections` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/g/<p>/selections` If this points at an external API, prefix it with `https://` so the ma…
Dangling fetchFetch
high System graph security auth conf 1.00 FastAPI POST `complete_review` without auth dependency — app/guest/router.py:343
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/guest/router.py:343 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_selection_event` without auth dependency — app/guest/router.py:276
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/guest/router.py:276 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `guest_verify_password` without auth dependency — app/frontend/guest.py:345
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/frontend/guest.py:345 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `setup_submit` without auth dependency — app/frontend/setup.py:37
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/frontend/setup.py:37 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `verify_email` without auth dependency — app/auth/router.py:70
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/auth/router.py:70 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `verify_gallery_password` without auth dependency — app/guest/router.py:154
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/guest/router.py:154 securityAuth fastapi unauth mutation
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/static/js/components.js:229
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/settings.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/settings.json VerificationClaude instruction
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
dorny/paths-filter@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
lines 23, 65
.github/workflows/docker-publish.yml:23, 65 (2 hits)
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in frontend/static/js/app.js:170
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
frontend/static/js/app.js:170 Direct innerhtml assignment
medium System graph network Security conf 1.00 Privileged port 587 in use
Port 587 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
README.md Ports
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 63 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: alpine:3.20
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:10 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:20-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:38 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 2 occurrences Docker base image is tag-pinned but not digest-pinned: python:3.12-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
lines 1, 49
Dockerfile:1, 49 (2 hits)
containersPinned dependencies
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 11 places
Functions with the same first-5-line body hash: app/frontend/galleries.py:gallery_detail, app/frontend/galleries.py:gallery_selection, app/frontend/galleries.py:rename_gallery, app/frontend/galleries.py:gallery_images_grid This is *the* AI-coder failure mode (4× more duplication in vibe-coded repo…
duplicatesduplication
low System graph quality Integrity conf 1.00 6 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: app/security/middleware.py:dispatch, app/security/middleware.py:dispatch This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
6 occurrences
repo-level (6 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `cmd_backup` in app/cli/backup.py:87
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_gallery_detail_uses_i18n_for_new_copy` in tests/unit/test_frontend_gallery_detail.py:84
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_legacy_active_share_link_has_clear_fallback_copy` in tests/unit/test_gallery_lifecycle.py:132
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_local_storage_has_copy` in tests/unit/test_bulk_operations.py:129
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: apply_watermark
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/images/processing.py:96
low System graph software Dead code conf 1.00 7 occurrences Possibly dead Python function: downgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
7 files, 7 locations
alembic/versions/0001_init.py:209
alembic/versions/0002_add_disabled_user_status.py:31
alembic/versions/0003_add_tokens_valid_after.py:37
alembic/versions/0004_add_image_processing_status.py:58
alembic/versions/0005_add_gallery_guest_message.py:28
alembic/versions/0006_add_pending_signup_ip_address.py:29
alembic/versions/0007_add_user_gallery_limit_override.py:30
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_uuid
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/db/base.py:26
low System graph software Dead code conf 1.00 Possibly dead Python function: notify_all_admins
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/notifications/service.py:49
low System graph software Dead code conf 1.00 Possibly dead Python function: reload_translations
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
app/i18n/__init__.py:117
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /galleries/{gallery_id}/share
`app/frontend/galleries.py` declares `DELETE /galleries/{gallery_id}/share` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /{gallery_id}
`app/galleries/router.py` declares `DELETE /{gallery_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`app/frontend/dashboard.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/nav-badge
`app/frontend/admin.py` declares `GET /admin/nav-badge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/signups
`app/frontend/admin.py` declares `GET /admin/signups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /admin/users
`app/frontend/admin.py` declares `GET /admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /dashboard
`app/frontend/dashboard.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /datenschutz
`app/frontend/legal.py` declares `GET /datenschutz` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /galleries/{gallery_id}
`app/frontend/galleries.py` declares `GET /galleries/{gallery_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /galleries/{gallery_id}/audit-log
`app/frontend/galleries.py` declares `GET /galleries/{gallery_id}/audit-log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /galleries/{gallery_id}/export
`app/frontend/galleries.py` declares `GET /galleries/{gallery_id}/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /galleries/{gallery_id}/images-grid
`app/frontend/galleries.py` declares `GET /galleries/{gallery_id}/images-grid` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /galleries/{gallery_id}/selection
`app/frontend/galleries.py` declares `GET /galleries/{gallery_id}/selection` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /impressum
`app/frontend/legal.py` declares `GET /impressum` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /login
`app/frontend/auth.py` declares `GET /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /set-lang/{locale}
`app/main.py` declares `GET /set-lang/{locale}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /setup
`app/frontend/setup.py` declares `GET /setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /signup
`app/frontend/auth.py` declares `GET /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /verify-email/{token}
`app/frontend/auth.py` declares `GET /verify-email/{token}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{gallery_id}
`app/galleries/router.py` declares `GET /{gallery_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{gallery_id}/audit-log
`app/galleries/router.py` declares `GET /{gallery_id}/audit-log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{gallery_id}/audit-log/export
`app/galleries/router.py` declares `GET /{gallery_id}/audit-log/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{token}
`app/frontend/guest.py` declares `GET /{token}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{token}/gallery-images
`app/frontend/guest.py` declares `GET /{token}/gallery-images` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{gallery_id}
`app/galleries/router.py` declares `PATCH /{gallery_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{gallery_id}/status
`app/galleries/router.py` declares `PATCH /{gallery_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /
`app/galleries/router.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/approve/{signup_id}
`app/frontend/admin.py` declares `POST /admin/approve/{signup_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/reject/{signup_id}
`app/frontend/admin.py` declares `POST /admin/reject/{signup_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/users/{user_id}/delete
`app/frontend/admin.py` declares `POST /admin/users/{user_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/users/{user_id}/gallery-limit
`app/frontend/admin.py` declares `POST /admin/users/{user_id}/gallery-limit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/users/{user_id}/reset-password
`app/frontend/admin.py` declares `POST /admin/users/{user_id}/reset-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/users/{user_id}/status/{action}
`app/frontend/admin.py` declares `POST /admin/users/{user_id}/status/{action}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /dashboard/galleries
`app/frontend/dashboard.py` declares `POST /dashboard/galleries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/bulk-delete
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/bulk-delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/delete
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/expiry
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/expiry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/message
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/message` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/password
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/rename
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/rename` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/share
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/share` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/status
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/upload
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /galleries/{gallery_id}/watermark
`app/frontend/galleries.py` declares `POST /galleries/{gallery_id}/watermark` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /login
`app/frontend/auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /logout
`app/frontend/auth.py` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /setup
`app/frontend/setup.py` declares `POST /setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /signup
`app/frontend/auth.py` declares `POST /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{gallery_id}/duplicate
`app/galleries/router.py` declares `POST /{gallery_id}/duplicate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{token}/verify-password
`app/frontend/guest.py` declares `POST /{token}/verify-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/c872f4c9-ba0e-47be-ac58-3e0846ea8cf6/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/c872f4c9-ba0e-47be-ac58-3e0846ea8cf6/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.