{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f1178c5c1a48e6d0", "name": "Possibly dead Python function: expire_tick", "shortDescription": {"text": "Possibly dead Python function: expire_tick"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be605761a96b4e10", "name": "Possibly dead Python function: reassign_tick", "shortDescription": {"text": "Possibly dead Python function: reassign_tick"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e5c9c5f9b9ff356", "name": "Possibly dead Python function: antifraud_tick", "shortDescription": {"text": "Possibly dead Python function: antifraud_tick"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eea62b0ad9a28427", "name": "Possibly dead Python function: kyc_retry_tick", "shortDescription": {"text": "Possibly dead Python function: kyc_retry_tick"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-557382b7394bded3", "name": "Possibly dead Python function: ask_support_ai", "shortDescription": {"text": "Possibly dead Python function: ask_support_ai"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f784ee65915ca868", "name": "Possibly dead Python function: run_photo_check", "shortDescription": {"text": "Possibly dead Python function: run_photo_check"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9f91a8722f5e572", "name": "Possibly dead Python function: require_admin", "shortDescription": {"text": "Possibly dead Python function: require_admin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3aeba3c512365177", "name": "Possibly dead Python function: release_lot", "shortDescription": {"text": "Possibly dead Python function: release_lot"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f06066905f7a142", "name": "Possibly dead Python function: create_notification", "shortDescription": {"text": "Possibly dead Python function: create_notification"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d8f996b9948fc79", "name": "Possibly dead Python function: save_volunteer_kyc", "shortDescription": {"text": "Possibly dead Python function: save_volunteer_kyc"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbb3b18fdd4a5e12", "name": "Possibly dead Python function: create_route", "shortDescription": {"text": "Possibly dead Python function: create_route"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c338538b4102e762", "name": "Possibly dead Python function: fetch_new", "shortDescription": {"text": "Possibly dead Python function: fetch_new"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45dc87f884e03d06", "name": "Stray `console.log` in TS/JS \u2014 savefood/src/index.jsx:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 savefood/src/index.jsx:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b212bfd94c19a2e", "name": "Privileged port 3 in use", "shortDescription": {"text": "Privileged port 3 in use"}, "fullDescription": {"text": "Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a26ba5e32460e6cf", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5bed0889632c485", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.24-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.24-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccc0e00af5793b5f", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963666afd4c976a8", "name": "Dockerfile runs as root: savefood/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: savefood/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40153b2134130c36", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f495cd8a5e54f038", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f59db8e8f3ac9fb2", "name": "Insecure pattern 'document_write' in savefood/src/Pages/Shop/ShopDashboard.jsx:299", "shortDescription": {"text": "Insecure pattern 'document_write' in savefood/src/Pages/Shop/ShopDashboard.jsx:299"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d96733ffb651e5f5", "name": "Insecure pattern 'local_storage_auth_token' in savefood/src/context/AuthContext.jsx:39", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in savefood/src/context/AuthContext.jsx:39"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60c1ae78de2de163", "name": "Very large file: backend/volunteer/routes.py (1195 lines)", "shortDescription": {"text": "Very large file: backend/volunteer/routes.py (1195 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 5 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 36 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7e8bf8dfde4fbbcc", "name": "Commented-code block (5 lines) in backend/database.py:95", "shortDescription": {"text": "Commented-code block (5 lines) in backend/database.py:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8cfb6b0f01b92060", "name": "Commented-code block (6 lines) in backend/esg.py:38", "shortDescription": {"text": "Commented-code block (6 lines) in backend/esg.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b2f3c8e285e80ce", "name": "Commented-code block (5 lines) in backend/kyc_service.py:298", "shortDescription": {"text": "Commented-code block (5 lines) in backend/kyc_service.py:298"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd1ef4afb13a3f47", "name": "Commented-code block (5 lines) in backend/background.py:46", "shortDescription": {"text": "Commented-code block (5 lines) in backend/background.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fb500f27ba6145ce", "name": "Commented-code block (6 lines) in backend/limiter.py:7", "shortDescription": {"text": "Commented-code block (6 lines) in backend/limiter.py:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-034a64251644e396", "name": "Commented-code block (7 lines) in backend/volunteer/routes.py:571", "shortDescription": {"text": "Commented-code block (7 lines) in backend/volunteer/routes.py:571"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8b54d3fc8349d0d", "name": "Commented-code block (7 lines) in backend/volunteer/db.py:93", "shortDescription": {"text": "Commented-code block (7 lines) in backend/volunteer/db.py:93"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd76e1f089359997", "name": "Commented-code block (5 lines) in backend/needy/routes.py:338", "shortDescription": {"text": "Commented-code block (5 lines) in backend/needy/routes.py:338"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e93b64676f0d8a01", "name": "Commented-code block (5 lines) in backend/needy/db.py:195", "shortDescription": {"text": "Commented-code block (5 lines) in backend/needy/db.py:195"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f513bb8033ab371", "name": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/public/sw.js:112", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/public/sw.js:112"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01571255f0693a5e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/ImpactPage.jsx:31", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/ImpactPage.jsx:31"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a96a7c49d91aa6e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Auth/AddressInput.jsx:28", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Auth/AddressInput.jsx:28"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b264e0e8852e76d9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Auth/AuthPage.jsx:237", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Auth/AuthPage.jsx:237"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2020b130d512bd63", "name": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Needy/NeedyDashboard.jsx:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Needy/NeedyDashboard.jsx:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64f7ea66a4b693cb", "name": "Legacy-named symbol `embed_copy` in savefood/src/Pages/Shop/ShopDashboard.jsx:895", "shortDescription": {"text": "Legacy-named symbol `embed_copy` in savefood/src/Pages/Shop/ShopDashboard.jsx:895"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad6a7ef5cd89428d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Shop/ShopDashboard.jsx:241", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Shop/ShopDashboard.jsx:241"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a68d84925e6b4d8", "name": "47 env vars used in code but missing from .env.example", "shortDescription": {"text": "47 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AI_MODEL`, `BACKGROUND_TASKS`, `CORS_ORIGIN`, `DB_HOST`, `DB_NAME`, `DB_PASS`, `DB_PORT`, `DB_USER` + 39 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/shop/db.py:release_lot, backend/shop/db.py:confirm_lot_transfer, backend/shop/db.py:delete_lot\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/volunteer/routes.py:create_team, backend/volunteer/routes.py:join_team\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75acbf5919785537", "name": "Frontend route `/shop` has no Link/navigate to it \u2014 savefood/src/App.jsx", "shortDescription": {"text": "Frontend route `/shop` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da3f2a25cf47f8da", "name": "Frontend route `/needy` has no Link/navigate to it \u2014 savefood/src/App.jsx", "shortDescription": {"text": "Frontend route `/needy` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71056280b56a66cd", "name": "Frontend route `/volunteer` has no Link/navigate to it \u2014 savefood/src/App.jsx", "shortDescription": {"text": "Frontend route `/volunteer` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8a5d65082aeb0e9", "name": "Frontend route `/admin` has no Link/navigate to it \u2014 savefood/src/App.jsx", "shortDescription": {"text": "Frontend route `/admin` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0ffffbb371cb9f9", "name": "FastAPI POST `telegram_login_start` without auth dependency \u2014 backend/oauth_routes.py:280", "shortDescription": {"text": "FastAPI POST `telegram_login_start` without auth dependency \u2014 backend/oauth_routes.py:280"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-57190c5e78f4c255", "name": "FastAPI POST `telegram_login_poll` without auth dependency \u2014 backend/oauth_routes.py:303", "shortDescription": {"text": "FastAPI POST `telegram_login_poll` without auth dependency \u2014 backend/oauth_routes.py:303"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3512eab882c03769", "name": "FastAPI POST `api_create_lot` without auth dependency \u2014 backend/partner_api.py:102", "shortDescription": {"text": "FastAPI POST `api_create_lot` without auth dependency \u2014 backend/partner_api.py:102"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-645b2506764493d0", "name": "FastAPI DELETE `api_delete_lot` without auth dependency \u2014 backend/partner_api.py:123", "shortDescription": {"text": "FastAPI DELETE `api_delete_lot` without auth dependency \u2014 backend/partner_api.py:123"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7fdd471c03e6880a", "name": "FastAPI POST `telegram_webhook` without auth dependency \u2014 backend/telegram_routes.py:410", "shortDescription": {"text": "FastAPI POST `telegram_webhook` without auth dependency \u2014 backend/telegram_routes.py:410"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-61d3ebb504249435", "name": "FastAPI POST `create_lot_upload` without auth dependency \u2014 backend/shop/routes.py:95", "shortDescription": {"text": "FastAPI POST `create_lot_upload` without auth dependency \u2014 backend/shop/routes.py:95"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca57b78c0f931b7b", "name": "Unused endpoint: GET /oauth/providers", "shortDescription": {"text": "Unused endpoint: GET /oauth/providers"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `GET /oauth/providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-197acaa7a42c056a", "name": "Unused endpoint: GET /oauth/{provider}/start", "shortDescription": {"text": "Unused endpoint: GET /oauth/{provider}/start"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `GET /oauth/{provider}/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b0d26ecf596dc7f", "name": "Unused endpoint: GET /oauth/{provider}/callback", "shortDescription": {"text": "Unused endpoint: GET /oauth/{provider}/callback"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `GET /oauth/{provider}/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8f012f6e75182f4", "name": "Unused endpoint: GET /links", "shortDescription": {"text": "Unused endpoint: GET /links"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `GET /links` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f08350790d47f65a", "name": "Unused endpoint: POST /links/{provider}/unlink", "shortDescription": {"text": "Unused endpoint: POST /links/{provider}/unlink"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `POST /links/{provider}/unlink` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-247169400b7372d7", "name": "Unused endpoint: POST /telegram/login/start", "shortDescription": {"text": "Unused endpoint: POST /telegram/login/start"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `POST /telegram/login/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9ef80883cfd78bd", "name": "Unused endpoint: POST /telegram/login/poll", "shortDescription": {"text": "Unused endpoint: POST /telegram/login/poll"}, "fullDescription": {"text": "`backend/oauth_routes.py` declares `POST /telegram/login/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4fe7d28c0a3f2a8", "name": "Unused endpoint: GET /lots", "shortDescription": {"text": "Unused endpoint: GET /lots"}, "fullDescription": {"text": "`backend/partner_api.py` declares `GET /lots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3d6314b9a525244", "name": "Unused endpoint: POST /lots", "shortDescription": {"text": "Unused endpoint: POST /lots"}, "fullDescription": {"text": "`backend/partner_api.py` declares `POST /lots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e11baaccf4af392", "name": "Unused endpoint: DELETE /lots/{lot_id}", "shortDescription": {"text": "Unused endpoint: DELETE /lots/{lot_id}"}, "fullDescription": {"text": "`backend/partner_api.py` declares `DELETE /lots/{lot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f6c02a70ebbee3a", "name": "Unused endpoint: GET /esg", "shortDescription": {"text": "Unused endpoint: GET /esg"}, "fullDescription": {"text": "`backend/partner_api.py` declares `GET /esg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af6f50ab28ff2ce1", "name": "Unused endpoint: POST /shops/{shop_id}/api_keys", "shortDescription": {"text": "Unused endpoint: POST /shops/{shop_id}/api_keys"}, "fullDescription": {"text": "`backend/partner_api.py` declares `POST /shops/{shop_id}/api_keys` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0662d1884908f12", "name": "Unused endpoint: GET /shops/{shop_id}/api_keys", "shortDescription": {"text": "Unused endpoint: GET /shops/{shop_id}/api_keys"}, "fullDescription": {"text": "`backend/partner_api.py` declares `GET /shops/{shop_id}/api_keys` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45d5574e42ddf9fe", "name": "Unused endpoint: POST /shops/{shop_id}/api_keys/{key_id}/revoke", "shortDescription": {"text": "Unused endpoint: POST /shops/{shop_id}/api_keys/{key_id}/revoke"}, "fullDescription": {"text": "`backend/partner_api.py` declares `POST /shops/{shop_id}/api_keys/{key_id}/revoke` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ded07d1e5cea2dd", "name": "Unused endpoint: POST /shops/{shop_id}/webhooks", "shortDescription": {"text": "Unused endpoint: POST /shops/{shop_id}/webhooks"}, "fullDescription": {"text": "`backend/partner_api.py` declares `POST /shops/{shop_id}/webhooks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05b8edef79a6dbf0", "name": "Unused endpoint: GET /shops/{shop_id}/webhooks", "shortDescription": {"text": "Unused endpoint: GET /shops/{shop_id}/webhooks"}, "fullDescription": {"text": "`backend/partner_api.py` declares `GET /shops/{shop_id}/webhooks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eaedc0093c82c79", "name": "Unused endpoint: DELETE /shops/{shop_id}/webhooks/{hook_id}", "shortDescription": {"text": "Unused endpoint: DELETE /shops/{shop_id}/webhooks/{hook_id}"}, "fullDescription": {"text": "`backend/partner_api.py` declares `DELETE /shops/{shop_id}/webhooks/{hook_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1b7bee247ffc801", "name": "Unused endpoint: GET /summary", "shortDescription": {"text": "Unused endpoint: GET /summary"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ac91b74ccc9fa1e", "name": "Unused endpoint: GET /cities", "shortDescription": {"text": "Unused endpoint: GET /cities"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /cities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffc228cb3b9c78e9", "name": "Unused endpoint: GET /volunteers", "shortDescription": {"text": "Unused endpoint: GET /volunteers"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /volunteers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72e04955cf83a53f", "name": "Unused endpoint: GET /teams", "shortDescription": {"text": "Unused endpoint: GET /teams"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2340e057c2e02511", "name": "Unused endpoint: GET /widget.svg", "shortDescription": {"text": "Unused endpoint: GET /widget.svg"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /widget.svg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-044b16cfddcbf7e4", "name": "Unused endpoint: GET /widget/{shop_id}.svg", "shortDescription": {"text": "Unused endpoint: GET /widget/{shop_id}.svg"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /widget/{shop_id}.svg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfada129ce5bb026", "name": "Unused endpoint: GET /feed", "shortDescription": {"text": "Unused endpoint: GET /feed"}, "fullDescription": {"text": "`backend/impact.py` declares `GET /feed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`backend/auth_routes.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce17d6b092a81ca", "name": "Unused endpoint: POST /refresh", "shortDescription": {"text": "Unused endpoint: POST /refresh"}, "fullDescription": {"text": "`backend/auth_routes.py` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`backend/auth_routes.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2dab9b3c8d209fe", "name": "Unused endpoint: GET /public_key", "shortDescription": {"text": "Unused endpoint: GET /public_key"}, "fullDescription": {"text": "`backend/push_routes.py` declares `GET /public_key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-365f0986d17746b8", "name": "Unused endpoint: POST /subscribe", "shortDescription": {"text": "Unused endpoint: POST /subscribe"}, "fullDescription": {"text": "`backend/push_routes.py` declares `POST /subscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52681d778ae5876a", "name": "Unused endpoint: POST /unsubscribe", "shortDescription": {"text": "Unused endpoint: POST /unsubscribe"}, "fullDescription": {"text": "`backend/push_routes.py` declares `POST /unsubscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6f45b5eb3a31352", "name": "Unused endpoint: POST /fcm/register", "shortDescription": {"text": "Unused endpoint: POST /fcm/register"}, "fullDescription": {"text": "`backend/push_routes.py` declares `POST /fcm/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a5834615a0d0588", "name": "Unused endpoint: POST /fcm/unregister", "shortDescription": {"text": "Unused endpoint: POST /fcm/unregister"}, "fullDescription": {"text": "`backend/push_routes.py` declares `POST /fcm/unregister` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd8dc4599ec52a08", "name": "Unused endpoint: GET /stats", "shortDescription": {"text": "Unused endpoint: GET /stats"}, "fullDescription": {"text": "`backend/main.py` declares `GET /stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf5197e7f4f12cb8", "name": "Unused endpoint: GET /tickets/{ticket_id}/messages", "shortDescription": {"text": "Unused endpoint: GET /tickets/{ticket_id}/messages"}, "fullDescription": {"text": "`backend/chat_routes.py` declares `GET /tickets/{ticket_id}/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76c2b96a31993459", "name": "Unused endpoint: POST /tickets/{ticket_id}/messages", "shortDescription": {"text": "Unused endpoint: POST /tickets/{ticket_id}/messages"}, "fullDescription": {"text": "`backend/chat_routes.py` declares `POST /tickets/{ticket_id}/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c77e6658967e090", "name": "Unused endpoint: POST /telegram/webhook", "shortDescription": {"text": "Unused endpoint: POST /telegram/webhook"}, "fullDescription": {"text": "`backend/telegram_routes.py` declares `POST /telegram/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7cbf3558d59650d", "name": "Unused endpoint: GET /auth/telegram/init-link", "shortDescription": {"text": "Unused endpoint: GET /auth/telegram/init-link"}, "fullDescription": {"text": "`backend/telegram_routes.py` declares `GET /auth/telegram/init-link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-556909d2147b940f", "name": "Unused endpoint: GET /needy", "shortDescription": {"text": "Unused endpoint: GET /needy"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `GET /needy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1cea6ebe6998a79", "name": "Unused endpoint: GET /delivery_photos", "shortDescription": {"text": "Unused endpoint: GET /delivery_photos"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `GET /delivery_photos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd11109d8b3a2514", "name": "Unused endpoint: POST /delivery_photos/{ticket_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /delivery_photos/{ticket_id}/approve"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `POST /delivery_photos/{ticket_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c05977d2710d36e", "name": "Unused endpoint: POST /delivery_photos/{ticket_id}/reject", "shortDescription": {"text": "Unused endpoint: POST /delivery_photos/{ticket_id}/reject"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `POST /delivery_photos/{ticket_id}/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8445b057f72d6ece", "name": "Unused endpoint: GET /heatmap", "shortDescription": {"text": "Unused endpoint: GET /heatmap"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `GET /heatmap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af75cdebd6061f00", "name": "Unused endpoint: GET /routes", "shortDescription": {"text": "Unused endpoint: GET /routes"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `GET /routes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c538b8b9e403bd9b", "name": "Unused endpoint: POST /routes/{route_id}/reset", "shortDescription": {"text": "Unused endpoint: POST /routes/{route_id}/reset"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `POST /routes/{route_id}/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa43a16f437d5e20", "name": "Unused endpoint: POST /lots/{lot_id}/reset", "shortDescription": {"text": "Unused endpoint: POST /lots/{lot_id}/reset"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `POST /lots/{lot_id}/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-841e50bf821e4158", "name": "Unused endpoint: GET /users", "shortDescription": {"text": "Unused endpoint: GET /users"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `GET /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31551fd373068017", "name": "Unused endpoint: POST /users/{user_id}/block", "shortDescription": {"text": "Unused endpoint: POST /users/{user_id}/block"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `POST /users/{user_id}/block` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-034316c27d68c40c", "name": "Unused endpoint: POST /users/{user_id}/unblock", "shortDescription": {"text": "Unused endpoint: POST /users/{user_id}/unblock"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `POST /users/{user_id}/unblock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb0d8e53e94ed440", "name": "Unused endpoint: GET /shops", "shortDescription": {"text": "Unused endpoint: GET /shops"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `GET /shops` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d1e405ee8360df0", "name": "Unused endpoint: PATCH /shops/{shop_id}/plan", "shortDescription": {"text": "Unused endpoint: PATCH /shops/{shop_id}/plan"}, "fullDescription": {"text": "`backend/admin/routes.py` declares `PATCH /shops/{shop_id}/plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23491"}, "properties": {"repository": "z7gvt9mys9-dev/savefood", "repoUrl": "https://github.com/z7gvt9mys9-dev/savefood", "branch": "main"}, "results": [{"ruleId": "scanner-f1178c5c1a48e6d0", "level": "note", "message": {"text": "Possibly dead Python function: expire_tick"}, "properties": {"repobilityId": "3bfab70db902a9d2", "scanner": "scanner-primary", "fingerprint": "f1178c5c1a48e6d0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/background.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be605761a96b4e10", "level": "note", "message": {"text": "Possibly dead Python function: reassign_tick"}, "properties": {"repobilityId": "f291d6aac6d08160", "scanner": "scanner-primary", "fingerprint": "be605761a96b4e10", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/background.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e5c9c5f9b9ff356", "level": "note", "message": {"text": "Possibly dead Python function: antifraud_tick"}, "properties": {"repobilityId": "8b0ddea506ce1df7", "scanner": "scanner-primary", "fingerprint": "8e5c9c5f9b9ff356", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/background.py:132"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eea62b0ad9a28427", "level": "note", "message": {"text": "Possibly dead Python function: kyc_retry_tick"}, "properties": {"repobilityId": "d4f7646baff4c6a0", "scanner": "scanner-primary", "fingerprint": "eea62b0ad9a28427", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/background.py:357"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-557382b7394bded3", "level": "note", "message": {"text": "Possibly dead Python function: ask_support_ai"}, "properties": {"repobilityId": "f90530797b8b3d02", "scanner": "scanner-primary", "fingerprint": "557382b7394bded3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/ai_service.py:55"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f784ee65915ca868", "level": "note", "message": {"text": "Possibly dead Python function: run_photo_check"}, "properties": {"repobilityId": "a5a98e9d1a52b7c5", "scanner": "scanner-primary", "fingerprint": "f784ee65915ca868", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/photo_moderation.py:186"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9f91a8722f5e572", "level": "note", "message": {"text": "Possibly dead Python function: require_admin"}, "properties": {"repobilityId": "3c06db2e25566bf7", "scanner": "scanner-primary", "fingerprint": "d9f91a8722f5e572", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/admin/routes.py:12"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3aeba3c512365177", "level": "note", "message": {"text": "Possibly dead Python function: release_lot"}, "properties": {"repobilityId": "2d320410ff1c8612", "scanner": "scanner-primary", "fingerprint": "3aeba3c512365177", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/shop/db.py:226"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f06066905f7a142", "level": "note", "message": {"text": "Possibly dead Python function: create_notification"}, "properties": {"repobilityId": "8f63c28078dc216a", "scanner": "scanner-primary", "fingerprint": "5f06066905f7a142", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/volunteer/db.py:183"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d8f996b9948fc79", "level": "note", "message": {"text": "Possibly dead Python function: save_volunteer_kyc"}, "properties": {"repobilityId": "057c7a53c53dbff4", "scanner": "scanner-primary", "fingerprint": "7d8f996b9948fc79", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/volunteer/db.py:263"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbb3b18fdd4a5e12", "level": "note", "message": {"text": "Possibly dead Python function: create_route"}, "properties": {"repobilityId": "10743b378ff09fda", "scanner": "scanner-primary", "fingerprint": "dbb3b18fdd4a5e12", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/volunteer/db.py:303"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c338538b4102e762", "level": "note", "message": {"text": "Possibly dead Python function: fetch_new"}, "properties": {"repobilityId": "5761e65fad1baf4b", "scanner": "scanner-primary", "fingerprint": "c338538b4102e762", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/needy/routes.py:400"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45dc87f884e03d06", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 savefood/src/index.jsx:17"}, "properties": {"repobilityId": "6b8ad005f2ecd6f8", "scanner": "scanner-primary", "fingerprint": "45dc87f884e03d06", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3b212bfd94c19a2e", "level": "warning", "message": {"text": "Privileged port 3 in use"}, "properties": {"repobilityId": "261b7b1c6a18d412", "scanner": "scanner-primary", "fingerprint": "3b212bfd94c19a2e", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/db_backup.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a26ba5e32460e6cf", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "a26ba5e32460e6cf", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/db_backup.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5bed0889632c485", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.24-alpine"}, "properties": {"repobilityId": "a1f544d38cc70471", "scanner": "scanner-primary", "fingerprint": "e5bed0889632c485", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "go-services/geows/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ccc0e00af5793b5f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.20"}, "properties": {"repobilityId": "3b8a04e2bb350239", "scanner": "scanner-primary", "fingerprint": "ccc0e00af5793b5f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "go-services/geows/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-963666afd4c976a8", "level": "warning", "message": {"text": "Dockerfile runs as root: savefood/Dockerfile"}, "properties": {"repobilityId": "54fc054f32e1ef19", "scanner": "scanner-primary", "fingerprint": "963666afd4c976a8", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-40153b2134130c36", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "300249bec4d512f9", "scanner": "scanner-primary", "fingerprint": "40153b2134130c36", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "savefood/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f495cd8a5e54f038", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "0e5b5a99116927f1", "scanner": "scanner-primary", "fingerprint": "f495cd8a5e54f038", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "savefood/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-f59db8e8f3ac9fb2", "level": "note", "message": {"text": "Insecure pattern 'document_write' in savefood/src/Pages/Shop/ShopDashboard.jsx:299"}, "properties": {"repobilityId": "ca47f345eb100bdb", "scanner": "scanner-primary", "fingerprint": "f59db8e8f3ac9fb2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "savefood/src/Pages/Shop/ShopDashboard.jsx"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-d96733ffb651e5f5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in savefood/src/context/AuthContext.jsx:39"}, "properties": {"repobilityId": "140e8d23651f1724", "scanner": "scanner-primary", "fingerprint": "d96733ffb651e5f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "savefood/src/context/AuthContext.jsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-60c1ae78de2de163", "level": "note", "message": {"text": "Very large file: backend/volunteer/routes.py (1195 lines)"}, "properties": {"repobilityId": "08484a761c5720fe", "scanner": "scanner-primary", "fingerprint": "60c1ae78de2de163", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "5a3f05fff8abd8f5", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "013dacfcb86d0242", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d2b2541ff79480c3", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "49c513bf0e26339a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c5fc016ff13d924f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "92ef94549fdc92f7", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7e8bf8dfde4fbbcc", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/database.py:95"}, "properties": {"repobilityId": "eddbba2bdc017d83", "scanner": "scanner-primary", "fingerprint": "7e8bf8dfde4fbbcc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8cfb6b0f01b92060", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/esg.py:38"}, "properties": {"repobilityId": "dffe5e4683abe37f", "scanner": "scanner-primary", "fingerprint": "8cfb6b0f01b92060", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8b2f3c8e285e80ce", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/kyc_service.py:298"}, "properties": {"repobilityId": "cc9c34f94d7d904f", "scanner": "scanner-primary", "fingerprint": "8b2f3c8e285e80ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd1ef4afb13a3f47", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/background.py:46"}, "properties": {"repobilityId": "a5cf3ee7ad85ea33", "scanner": "scanner-primary", "fingerprint": "dd1ef4afb13a3f47", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fb500f27ba6145ce", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/limiter.py:7"}, "properties": {"repobilityId": "35af08196535bbf5", "scanner": "scanner-primary", "fingerprint": "fb500f27ba6145ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-034a64251644e396", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/volunteer/routes.py:571"}, "properties": {"repobilityId": "befe158da2744029", "scanner": "scanner-primary", "fingerprint": "034a64251644e396", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8b54d3fc8349d0d", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/volunteer/db.py:93"}, "properties": {"repobilityId": "da2365706656189a", "scanner": "scanner-primary", "fingerprint": "f8b54d3fc8349d0d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd76e1f089359997", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/needy/routes.py:338"}, "properties": {"repobilityId": "9f6c873e52dd72f4", "scanner": "scanner-primary", "fingerprint": "bd76e1f089359997", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e93b64676f0d8a01", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/needy/db.py:195"}, "properties": {"repobilityId": "8c15506eabfeeb6c", "scanner": "scanner-primary", "fingerprint": "e93b64676f0d8a01", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f513bb8033ab371", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/public/sw.js:112"}, "properties": {"repobilityId": "3bace5579e0760b2", "scanner": "scanner-primary", "fingerprint": "2f513bb8033ab371", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-01571255f0693a5e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/ImpactPage.jsx:31"}, "properties": {"repobilityId": "904a437435d9b327", "scanner": "scanner-primary", "fingerprint": "01571255f0693a5e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6a96a7c49d91aa6e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Auth/AddressInput.jsx:28"}, "properties": {"repobilityId": "2d496246a8acf315", "scanner": "scanner-primary", "fingerprint": "6a96a7c49d91aa6e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b264e0e8852e76d9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Auth/AuthPage.jsx:237"}, "properties": {"repobilityId": "13884f549fd1ae98", "scanner": "scanner-primary", "fingerprint": "b264e0e8852e76d9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2020b130d512bd63", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Needy/NeedyDashboard.jsx:62"}, "properties": {"repobilityId": "02f8fce342ea1f4f", "scanner": "scanner-primary", "fingerprint": "2020b130d512bd63", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-64f7ea66a4b693cb", "level": "note", "message": {"text": "Legacy-named symbol `embed_copy` in savefood/src/Pages/Shop/ShopDashboard.jsx:895"}, "properties": {"repobilityId": "33b23d79065a2847", "scanner": "scanner-primary", "fingerprint": "64f7ea66a4b693cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ad6a7ef5cd89428d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 savefood/src/Pages/Shop/ShopDashboard.jsx:241"}, "properties": {"repobilityId": "6810e3398d697dde", "scanner": "scanner-primary", "fingerprint": "ad6a7ef5cd89428d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2a68d84925e6b4d8", "level": "note", "message": {"text": "47 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "82fb9703fa20a5fa", "scanner": "scanner-primary", "fingerprint": "2a68d84925e6b4d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "dbd25e8856ff98dc", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "db3330a5060ce433", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8e16cf7464ecc4c8", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e9f4c42b8dd81e52", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6750219cf29dff5c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-75acbf5919785537", "level": "warning", "message": {"text": "Frontend route `/shop` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "properties": {"repobilityId": "7ae8f9883624d9b7", "scanner": "scanner-primary", "fingerprint": "75acbf5919785537", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-da3f2a25cf47f8da", "level": "warning", "message": {"text": "Frontend route `/needy` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "properties": {"repobilityId": "23c69b4396111432", "scanner": "scanner-primary", "fingerprint": "da3f2a25cf47f8da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-71056280b56a66cd", "level": "warning", "message": {"text": "Frontend route `/volunteer` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "properties": {"repobilityId": "442fc1d24951e7b8", "scanner": "scanner-primary", "fingerprint": "71056280b56a66cd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-a8a5d65082aeb0e9", "level": "warning", "message": {"text": "Frontend route `/admin` has no Link/navigate to it \u2014 savefood/src/App.jsx"}, "properties": {"repobilityId": "66a239f8710f4085", "scanner": "scanner-primary", "fingerprint": "a8a5d65082aeb0e9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e0ffffbb371cb9f9", "level": "error", "message": {"text": "FastAPI POST `telegram_login_start` without auth dependency \u2014 backend/oauth_routes.py:280"}, "properties": {"repobilityId": "18ff908a77245d18", "scanner": "scanner-primary", "fingerprint": "e0ffffbb371cb9f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/oauth_routes.py"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-57190c5e78f4c255", "level": "error", "message": {"text": "FastAPI POST `telegram_login_poll` without auth dependency \u2014 backend/oauth_routes.py:303"}, "properties": {"repobilityId": "c6ab2bdddb18d729", "scanner": "scanner-primary", "fingerprint": "57190c5e78f4c255", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/oauth_routes.py"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-3512eab882c03769", "level": "error", "message": {"text": "FastAPI POST `api_create_lot` without auth dependency \u2014 backend/partner_api.py:102"}, "properties": {"repobilityId": "644ca36b174649f2", "scanner": "scanner-primary", "fingerprint": "3512eab882c03769", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/partner_api.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-645b2506764493d0", "level": "error", "message": {"text": "FastAPI DELETE `api_delete_lot` without auth dependency \u2014 backend/partner_api.py:123"}, "properties": {"repobilityId": "3d4c7c3ff47e1697", "scanner": "scanner-primary", "fingerprint": "645b2506764493d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/partner_api.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-7fdd471c03e6880a", "level": "error", "message": {"text": "FastAPI POST `telegram_webhook` without auth dependency \u2014 backend/telegram_routes.py:410"}, "properties": {"repobilityId": "856c9ad288335542", "scanner": "scanner-primary", "fingerprint": "7fdd471c03e6880a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/telegram_routes.py"}, "region": {"startLine": 410}}}]}, {"ruleId": "scanner-61d3ebb504249435", "level": "error", "message": {"text": "FastAPI POST `create_lot_upload` without auth dependency \u2014 backend/shop/routes.py:95"}, "properties": {"repobilityId": "978cf62c50b1aec6", "scanner": "scanner-primary", "fingerprint": "61d3ebb504249435", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/shop/routes.py"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-ca57b78c0f931b7b", "level": "note", "message": {"text": "Unused endpoint: GET /oauth/providers"}, "properties": {"repobilityId": "2fd6ac98e3eb6908", "scanner": "scanner-primary", "fingerprint": "ca57b78c0f931b7b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-197acaa7a42c056a", "level": "note", "message": {"text": "Unused endpoint: GET /oauth/{provider}/start"}, "properties": {"repobilityId": "39683984ef671278", "scanner": "scanner-primary", "fingerprint": "197acaa7a42c056a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b0d26ecf596dc7f", "level": "note", "message": {"text": "Unused endpoint: GET /oauth/{provider}/callback"}, "properties": {"repobilityId": "b99ccb2d0ce94276", "scanner": "scanner-primary", "fingerprint": "1b0d26ecf596dc7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c8f012f6e75182f4", "level": "note", "message": {"text": "Unused endpoint: GET /links"}, "properties": {"repobilityId": "1eba54033373d955", "scanner": "scanner-primary", "fingerprint": "c8f012f6e75182f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f08350790d47f65a", "level": "note", "message": {"text": "Unused endpoint: POST /links/{provider}/unlink"}, "properties": {"repobilityId": "0b7ff1e65866c918", "scanner": "scanner-primary", "fingerprint": "f08350790d47f65a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-247169400b7372d7", "level": "note", "message": {"text": "Unused endpoint: POST /telegram/login/start"}, "properties": {"repobilityId": "5dfefa295c8a0203", "scanner": "scanner-primary", "fingerprint": "247169400b7372d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9ef80883cfd78bd", "level": "note", "message": {"text": "Unused endpoint: POST /telegram/login/poll"}, "properties": {"repobilityId": "f32e579ee5bd46cb", "scanner": "scanner-primary", "fingerprint": "e9ef80883cfd78bd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e4fe7d28c0a3f2a8", "level": "note", "message": {"text": "Unused endpoint: GET /lots"}, "properties": {"repobilityId": "0bebd6e2cbb35f9c", "scanner": "scanner-primary", "fingerprint": "e4fe7d28c0a3f2a8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f3d6314b9a525244", "level": "note", "message": {"text": "Unused endpoint: POST /lots"}, "properties": {"repobilityId": "78d25d18700c0719", "scanner": "scanner-primary", "fingerprint": "f3d6314b9a525244", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9e11baaccf4af392", "level": "note", "message": {"text": "Unused endpoint: DELETE /lots/{lot_id}"}, "properties": {"repobilityId": "f99257e313073ff4", "scanner": "scanner-primary", "fingerprint": "9e11baaccf4af392", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f6c02a70ebbee3a", "level": "note", "message": {"text": "Unused endpoint: GET /esg"}, "properties": {"repobilityId": "22f3d1cb391e88b7", "scanner": "scanner-primary", "fingerprint": "1f6c02a70ebbee3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af6f50ab28ff2ce1", "level": "note", "message": {"text": "Unused endpoint: POST /shops/{shop_id}/api_keys"}, "properties": {"repobilityId": "dcc2ca464ec3e562", "scanner": "scanner-primary", "fingerprint": "af6f50ab28ff2ce1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a0662d1884908f12", "level": "note", "message": {"text": "Unused endpoint: GET /shops/{shop_id}/api_keys"}, "properties": {"repobilityId": "7b10f2a7331879fc", "scanner": "scanner-primary", "fingerprint": "a0662d1884908f12", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45d5574e42ddf9fe", "level": "note", "message": {"text": "Unused endpoint: POST /shops/{shop_id}/api_keys/{key_id}/revoke"}, "properties": {"repobilityId": "2e54e4866fd6d44d", "scanner": "scanner-primary", "fingerprint": "45d5574e42ddf9fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ded07d1e5cea2dd", "level": "note", "message": {"text": "Unused endpoint: POST /shops/{shop_id}/webhooks"}, "properties": {"repobilityId": "817d7762b5dfbeee", "scanner": "scanner-primary", "fingerprint": "9ded07d1e5cea2dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05b8edef79a6dbf0", "level": "note", "message": {"text": "Unused endpoint: GET /shops/{shop_id}/webhooks"}, "properties": {"repobilityId": "92151671b20d8fca", "scanner": "scanner-primary", "fingerprint": "05b8edef79a6dbf0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7eaedc0093c82c79", "level": "note", "message": {"text": "Unused endpoint: DELETE /shops/{shop_id}/webhooks/{hook_id}"}, "properties": {"repobilityId": "3ff4de384eaffe0a", "scanner": "scanner-primary", "fingerprint": "7eaedc0093c82c79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1b7bee247ffc801", "level": "note", "message": {"text": "Unused endpoint: GET /summary"}, "properties": {"repobilityId": "4fd7610fdb53550c", "scanner": "scanner-primary", "fingerprint": "e1b7bee247ffc801", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ac91b74ccc9fa1e", "level": "note", "message": {"text": "Unused endpoint: GET /cities"}, "properties": {"repobilityId": "3ef7dedfbbeb5f38", "scanner": "scanner-primary", "fingerprint": "8ac91b74ccc9fa1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ffc228cb3b9c78e9", "level": "note", "message": {"text": "Unused endpoint: GET /volunteers"}, "properties": {"repobilityId": "2b9ff1c756aa5660", "scanner": "scanner-primary", "fingerprint": "ffc228cb3b9c78e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72e04955cf83a53f", "level": "note", "message": {"text": "Unused endpoint: GET /teams"}, "properties": {"repobilityId": "358c77e2f4bcb578", "scanner": "scanner-primary", "fingerprint": "72e04955cf83a53f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2340e057c2e02511", "level": "note", "message": {"text": "Unused endpoint: GET /widget.svg"}, "properties": {"repobilityId": "daae8583bca7d474", "scanner": "scanner-primary", "fingerprint": "2340e057c2e02511", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-044b16cfddcbf7e4", "level": "note", "message": {"text": "Unused endpoint: GET /widget/{shop_id}.svg"}, "properties": {"repobilityId": "80078b40df71ca9c", "scanner": "scanner-primary", "fingerprint": "044b16cfddcbf7e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfada129ce5bb026", "level": "note", "message": {"text": "Unused endpoint: GET /feed"}, "properties": {"repobilityId": "1310f38e86f03a32", "scanner": "scanner-primary", "fingerprint": "bfada129ce5bb026", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "d3e1498e3b363a67", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ce17d6b092a81ca", "level": "note", "message": {"text": "Unused endpoint: POST /refresh"}, "properties": {"repobilityId": "cbf8bded6b057dd6", "scanner": "scanner-primary", "fingerprint": "7ce17d6b092a81ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "edf554aa1e0f4a43", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d2dab9b3c8d209fe", "level": "note", "message": {"text": "Unused endpoint: GET /public_key"}, "properties": {"repobilityId": "cea0a12b48bc62ee", "scanner": "scanner-primary", "fingerprint": "d2dab9b3c8d209fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-365f0986d17746b8", "level": "note", "message": {"text": "Unused endpoint: POST /subscribe"}, "properties": {"repobilityId": "e487b1b4b928f4c9", "scanner": "scanner-primary", "fingerprint": "365f0986d17746b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52681d778ae5876a", "level": "note", "message": {"text": "Unused endpoint: POST /unsubscribe"}, "properties": {"repobilityId": "43c67e824f04c18a", "scanner": "scanner-primary", "fingerprint": "52681d778ae5876a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c6f45b5eb3a31352", "level": "note", "message": {"text": "Unused endpoint: POST /fcm/register"}, "properties": {"repobilityId": "f4b7139c6ac95ae5", "scanner": "scanner-primary", "fingerprint": "c6f45b5eb3a31352", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a5834615a0d0588", "level": "note", "message": {"text": "Unused endpoint: POST /fcm/unregister"}, "properties": {"repobilityId": "d702864e0a718ced", "scanner": "scanner-primary", "fingerprint": "7a5834615a0d0588", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd8dc4599ec52a08", "level": "note", "message": {"text": "Unused endpoint: GET /stats"}, "properties": {"repobilityId": "e40aea6ea85ac7a5", "scanner": "scanner-primary", "fingerprint": "cd8dc4599ec52a08", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf5197e7f4f12cb8", "level": "note", "message": {"text": "Unused endpoint: GET /tickets/{ticket_id}/messages"}, "properties": {"repobilityId": "cce7121b3eba0e67", "scanner": "scanner-primary", "fingerprint": "cf5197e7f4f12cb8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76c2b96a31993459", "level": "note", "message": {"text": "Unused endpoint: POST /tickets/{ticket_id}/messages"}, "properties": {"repobilityId": "86439e242c2f4e88", "scanner": "scanner-primary", "fingerprint": "76c2b96a31993459", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c77e6658967e090", "level": "note", "message": {"text": "Unused endpoint: POST /telegram/webhook"}, "properties": {"repobilityId": "4f5ac59c62cce001", "scanner": "scanner-primary", "fingerprint": "0c77e6658967e090", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b7cbf3558d59650d", "level": "note", "message": {"text": "Unused endpoint: GET /auth/telegram/init-link"}, "properties": {"repobilityId": "3e02679b0f8e1ea0", "scanner": "scanner-primary", "fingerprint": "b7cbf3558d59650d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-556909d2147b940f", "level": "note", "message": {"text": "Unused endpoint: GET /needy"}, "properties": {"repobilityId": "02b2436248be5fc8", "scanner": "scanner-primary", "fingerprint": "556909d2147b940f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1cea6ebe6998a79", "level": "note", "message": {"text": "Unused endpoint: GET /delivery_photos"}, "properties": {"repobilityId": "4c1599b93e0a45e4", "scanner": "scanner-primary", "fingerprint": "f1cea6ebe6998a79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd11109d8b3a2514", "level": "note", "message": {"text": "Unused endpoint: POST /delivery_photos/{ticket_id}/approve"}, "properties": {"repobilityId": "65dc56f42f7b2d3a", "scanner": "scanner-primary", "fingerprint": "cd11109d8b3a2514", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c05977d2710d36e", "level": "note", "message": {"text": "Unused endpoint: POST /delivery_photos/{ticket_id}/reject"}, "properties": {"repobilityId": "8e34351722ad1539", "scanner": "scanner-primary", "fingerprint": "7c05977d2710d36e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8445b057f72d6ece", "level": "note", "message": {"text": "Unused endpoint: GET /heatmap"}, "properties": {"repobilityId": "15162cc9529d5ea9", "scanner": "scanner-primary", "fingerprint": "8445b057f72d6ece", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af75cdebd6061f00", "level": "note", "message": {"text": "Unused endpoint: GET /routes"}, "properties": {"repobilityId": "dad0cfa8cf9716c2", "scanner": "scanner-primary", "fingerprint": "af75cdebd6061f00", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c538b8b9e403bd9b", "level": "note", "message": {"text": "Unused endpoint: POST /routes/{route_id}/reset"}, "properties": {"repobilityId": "bd52119e25b100fa", "scanner": "scanner-primary", "fingerprint": "c538b8b9e403bd9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa43a16f437d5e20", "level": "note", "message": {"text": "Unused endpoint: POST /lots/{lot_id}/reset"}, "properties": {"repobilityId": "9b6c38dee58f300e", "scanner": "scanner-primary", "fingerprint": "fa43a16f437d5e20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-841e50bf821e4158", "level": "note", "message": {"text": "Unused endpoint: GET /users"}, "properties": {"repobilityId": "312815959ab63d8c", "scanner": "scanner-primary", "fingerprint": "841e50bf821e4158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-31551fd373068017", "level": "note", "message": {"text": "Unused endpoint: POST /users/{user_id}/block"}, "properties": {"repobilityId": "b748f586798d88e3", "scanner": "scanner-primary", "fingerprint": "31551fd373068017", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-034316c27d68c40c", "level": "note", "message": {"text": "Unused endpoint: POST /users/{user_id}/unblock"}, "properties": {"repobilityId": "add1af0392947d92", "scanner": "scanner-primary", "fingerprint": "034316c27d68c40c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fb0d8e53e94ed440", "level": "note", "message": {"text": "Unused endpoint: GET /shops"}, "properties": {"repobilityId": "1fedadeb72ca82c7", "scanner": "scanner-primary", "fingerprint": "fb0d8e53e94ed440", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d1e405ee8360df0", "level": "note", "message": {"text": "Unused endpoint: PATCH /shops/{shop_id}/plan"}, "properties": {"repobilityId": "571f205e6f598b1d", "scanner": "scanner-primary", "fingerprint": "8d1e405ee8360df0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}