{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-120e899544914da4", "name": "Possibly dead Python function: upload_to_gdrive", "shortDescription": {"text": "Possibly dead Python function: upload_to_gdrive"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 2 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 11 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96fd0659c7e449d8", "name": "Legacy-named symbol `qr_codes_v2` in server.py:1011", "shortDescription": {"text": "Legacy-named symbol `qr_codes_v2` in server.py:1011"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e132e691aa4a1162", "name": "Commented-code block (5 lines) in server.py:193", "shortDescription": {"text": "Commented-code block (5 lines) in server.py:193"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver.py:submit, server.py:skip\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5688f8909e0a362", "name": "Flask mutation route `team_create` without `@login_required` \u2014 server.py:282", "shortDescription": {"text": "Flask mutation route `team_create` without `@login_required` \u2014 server.py:282"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c09d78b8c378a75c", "name": "Flask mutation route `team_join` without `@login_required` \u2014 server.py:318", "shortDescription": {"text": "Flask mutation route `team_join` without `@login_required` \u2014 server.py:318"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7df07939127c9642", "name": "Flask mutation route `api_unlock` without `@login_required` \u2014 server.py:341", "shortDescription": {"text": "Flask mutation route `api_unlock` without `@login_required` \u2014 server.py:341"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e2fdcedb7c7efef", "name": "Flask mutation route `submit` without `@login_required` \u2014 server.py:393", "shortDescription": {"text": "Flask mutation route `submit` without `@login_required` \u2014 server.py:393"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d578a5bba03a0d3", "name": "Flask mutation route `skip` without `@login_required` \u2014 server.py:531", "shortDescription": {"text": "Flask mutation route `skip` without `@login_required` \u2014 server.py:531"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b8078be5338c050", "name": "Flask mutation route `buy_hint` without `@login_required` \u2014 server.py:619", "shortDescription": {"text": "Flask mutation route `buy_hint` without `@login_required` \u2014 server.py:619"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8901a84000e7f7c2", "name": "Flask mutation route `bonus_offer` without `@login_required` \u2014 server.py:663", "shortDescription": {"text": "Flask mutation route `bonus_offer` without `@login_required` \u2014 server.py:663"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-042733945ce8d67b", "name": "Flask mutation route `bonus_respond` without `@login_required` \u2014 server.py:691", "shortDescription": {"text": "Flask mutation route `bonus_respond` without `@login_required` \u2014 server.py:691"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-196395dd5f53bf51", "name": "Flask mutation route `bonus_cancel` without `@login_required` \u2014 server.py:786", "shortDescription": {"text": "Flask mutation route `bonus_cancel` without `@login_required` \u2014 server.py:786"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dfc5fa749ddfb2d4", "name": "Flask mutation route `bonus_fail` without `@login_required` \u2014 server.py:800", "shortDescription": {"text": "Flask mutation route `bonus_fail` without `@login_required` \u2014 server.py:800"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5094e70fac97188d", "name": "Flask mutation route `verify_pushups` without `@login_required` \u2014 server.py:834", "shortDescription": {"text": "Flask mutation route `verify_pushups` without `@login_required` \u2014 server.py:834"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7e58bed8c1d0c35", "name": "Flask mutation route `admin_reset` without `@login_required` \u2014 server.py:870", "shortDescription": {"text": "Flask mutation route `admin_reset` without `@login_required` \u2014 server.py:870"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c94adefc230e736", "name": "Flask mutation route `admin_start` without `@login_required` \u2014 server.py:884", "shortDescription": {"text": "Flask mutation route `admin_start` without `@login_required` \u2014 server.py:884"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d1b35e68f973048", "name": "Flask mutation route `admin_bonus` without `@login_required` \u2014 server.py:902", "shortDescription": {"text": "Flask mutation route `admin_bonus` without `@login_required` \u2014 server.py:902"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa53e2bcf5634cbc", "name": "Flask mutation route `admin_clear_block` without `@login_required` \u2014 server.py:922", "shortDescription": {"text": "Flask mutation route `admin_clear_block` without `@login_required` \u2014 server.py:922"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c07c2516419ed15", "name": "Flask mutation route `editor_load` without `@login_required` \u2014 server.py:952", "shortDescription": {"text": "Flask mutation route `editor_load` without `@login_required` \u2014 server.py:952"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b595adcf1add605b", "name": "Flask mutation route `editor_save` without `@login_required` \u2014 server.py:962", "shortDescription": {"text": "Flask mutation route `editor_save` without `@login_required` \u2014 server.py:962"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56d933dc0c428d52", "name": "Flask mutation route `editor_upload` without `@login_required` \u2014 server.py:985", "shortDescription": {"text": "Flask mutation route `editor_upload` without `@login_required` \u2014 server.py:985"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`server.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f322c3c7eba721f", "name": "Unused endpoint: ANY /unlock/<int:mission_id>", "shortDescription": {"text": "Unused endpoint: ANY /unlock/<int:mission_id>"}, "fullDescription": {"text": "`server.py` declares `ANY /unlock/<int:mission_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32759079c9e4d148", "name": "Unused endpoint: ANY /api/missions", "shortDescription": {"text": "Unused endpoint: ANY /api/missions"}, "fullDescription": {"text": "`server.py` declares `ANY /api/missions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5444bcce1f6e801a", "name": "Unused endpoint: ANY /api/team/create", "shortDescription": {"text": "Unused endpoint: ANY /api/team/create"}, "fullDescription": {"text": "`server.py` declares `ANY /api/team/create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01917852f38ac526", "name": "Unused endpoint: ANY /api/team/join", "shortDescription": {"text": "Unused endpoint: ANY /api/team/join"}, "fullDescription": {"text": "`server.py` declares `ANY /api/team/join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6505a5b832b745c", "name": "Unused endpoint: ANY /api/unlock", "shortDescription": {"text": "Unused endpoint: ANY /api/unlock"}, "fullDescription": {"text": "`server.py` declares `ANY /api/unlock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f8b64971ad1c5d2", "name": "Unused endpoint: ANY /api/team/list", "shortDescription": {"text": "Unused endpoint: ANY /api/team/list"}, "fullDescription": {"text": "`server.py` declares `ANY /api/team/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50cece05c486fb18", "name": "Unused endpoint: ANY /api/submit", "shortDescription": {"text": "Unused endpoint: ANY /api/submit"}, "fullDescription": {"text": "`server.py` declares `ANY /api/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa0a30eee7a52cd4", "name": "Unused endpoint: ANY /api/skip", "shortDescription": {"text": "Unused endpoint: ANY /api/skip"}, "fullDescription": {"text": "`server.py` declares `ANY /api/skip` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c58e664c6e7298e3", "name": "Unused endpoint: ANY /api/hint", "shortDescription": {"text": "Unused endpoint: ANY /api/hint"}, "fullDescription": {"text": "`server.py` declares `ANY /api/hint` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6fc07ea23f67edb", "name": "Unused endpoint: ANY /api/state", "shortDescription": {"text": "Unused endpoint: ANY /api/state"}, "fullDescription": {"text": "`server.py` declares `ANY /api/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2a23020eab7d739", "name": "Unused endpoint: ANY /api/team/<team_name>", "shortDescription": {"text": "Unused endpoint: ANY /api/team/<team_name>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/team/<team_name>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acd423c7d3f8c34d", "name": "Unused endpoint: ANY /api/bonus/offer", "shortDescription": {"text": "Unused endpoint: ANY /api/bonus/offer"}, "fullDescription": {"text": "`server.py` declares `ANY /api/bonus/offer` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f684f8dc9a22bf79", "name": "Unused endpoint: ANY /api/bonus/respond", "shortDescription": {"text": "Unused endpoint: ANY /api/bonus/respond"}, "fullDescription": {"text": "`server.py` declares `ANY /api/bonus/respond` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e1769a069622068", "name": "Unused endpoint: ANY /api/bonus/cancel", "shortDescription": {"text": "Unused endpoint: ANY /api/bonus/cancel"}, "fullDescription": {"text": "`server.py` declares `ANY /api/bonus/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0184647094f7106", "name": "Unused endpoint: ANY /api/bonus/fail", "shortDescription": {"text": "Unused endpoint: ANY /api/bonus/fail"}, "fullDescription": {"text": "`server.py` declares `ANY /api/bonus/fail` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cf9bb963f1db298", "name": "Unused endpoint: ANY /api/verify/pushups", "shortDescription": {"text": "Unused endpoint: ANY /api/verify/pushups"}, "fullDescription": {"text": "`server.py` declares `ANY /api/verify/pushups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d158b9bd4955056", "name": "Unused endpoint: ANY /api/admin/reset", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/reset"}, "fullDescription": {"text": "`server.py` declares `ANY /api/admin/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ef97e5995573a65", "name": "Unused endpoint: ANY /api/admin/start", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/start"}, "fullDescription": {"text": "`server.py` declares `ANY /api/admin/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d739c5f92674d48", "name": "Unused endpoint: ANY /api/admin/bonus", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/bonus"}, "fullDescription": {"text": "`server.py` declares `ANY /api/admin/bonus` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5fc4f373073b659", "name": "Unused endpoint: ANY /api/admin/state", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/state"}, "fullDescription": {"text": "`server.py` declares `ANY /api/admin/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4825c4255b3e44f", "name": "Unused endpoint: ANY /api/admin/clear-block", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/clear-block"}, "fullDescription": {"text": "`server.py` declares `ANY /api/admin/clear-block` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98356fa7ff420a14", "name": "Unused endpoint: ANY /admin", "shortDescription": {"text": "Unused endpoint: ANY /admin"}, "fullDescription": {"text": "`server.py` declares `ANY /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-192d62fb6630bb2d", "name": "Unused endpoint: ANY /editor", "shortDescription": {"text": "Unused endpoint: ANY /editor"}, "fullDescription": {"text": "`server.py` declares `ANY /editor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-945f6fbfcf44b50a", "name": "Unused endpoint: ANY /api/editor/load", "shortDescription": {"text": "Unused endpoint: ANY /api/editor/load"}, "fullDescription": {"text": "`server.py` declares `ANY /api/editor/load` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6487dc7c70310945", "name": "Unused endpoint: ANY /api/editor/save", "shortDescription": {"text": "Unused endpoint: ANY /api/editor/save"}, "fullDescription": {"text": "`server.py` declares `ANY /api/editor/save` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eed741786a2c841c", "name": "Unused endpoint: ANY /api/editor/upload", "shortDescription": {"text": "Unused endpoint: ANY /api/editor/upload"}, "fullDescription": {"text": "`server.py` declares `ANY /api/editor/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2eebbecdf8e7c779", "name": "Unused endpoint: ANY /uploads/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /uploads/<filename>"}, "fullDescription": {"text": "`server.py` declares `ANY /uploads/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58f27698e0011680", "name": "Unused endpoint: ANY /static/<path:filename>", "shortDescription": {"text": "Unused endpoint: ANY /static/<path:filename>"}, "fullDescription": {"text": "`server.py` declares `ANY /static/<path:filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c038a4433a0069b", "name": "Unused endpoint: ANY /qr-codes-v2/<path:filename>", "shortDescription": {"text": "Unused endpoint: ANY /qr-codes-v2/<path:filename>"}, "fullDescription": {"text": "`server.py` declares `ANY /qr-codes-v2/<path:filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7875e0cd18e3595e", "name": "Unused endpoint: ANY /qr", "shortDescription": {"text": "Unused endpoint: ANY /qr"}, "fullDescription": {"text": "`server.py` declares `ANY /qr` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec618e4781cde1d5", "name": "Unused endpoint: ANY /missions/red.json", "shortDescription": {"text": "Unused endpoint: ANY /missions/red.json"}, "fullDescription": {"text": "`server.py` declares `ANY /missions/red.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ee4cdab1e647909", "name": "Unused endpoint: ANY /missions/blue.json", "shortDescription": {"text": "Unused endpoint: ANY /missions/blue.json"}, "fullDescription": {"text": "`server.py` declares `ANY /missions/blue.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21233"}, "properties": {"repository": "THTProtocol/Birthday", "repoUrl": "https://github.com/THTProtocol/Birthday", "branch": "main"}, "results": [{"ruleId": "scanner-120e899544914da4", "level": "note", "message": {"text": "Possibly dead Python function: upload_to_gdrive"}, "properties": {"repobilityId": "bf26e6c2de44d054", "scanner": "scanner-primary", "fingerprint": "120e899544914da4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "228cd2dea763598d", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "0b9ab535eb427bbd", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "27cc358a3749f211", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "91f20d961b49e7fb", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3b8f450a6a442a55", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9c689be6ce5a14ac", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-96fd0659c7e449d8", "level": "note", "message": {"text": "Legacy-named symbol `qr_codes_v2` in server.py:1011"}, "properties": {"repobilityId": "5aa1e7c35d4ab557", "scanner": "scanner-primary", "fingerprint": "96fd0659c7e449d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e132e691aa4a1162", "level": "none", "message": {"text": "Commented-code block (5 lines) in server.py:193"}, "properties": {"repobilityId": "effedfdc24909274", "scanner": "scanner-primary", "fingerprint": "e132e691aa4a1162", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "35bf16c1bb926db6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4e25a391e2c42257", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-f5688f8909e0a362", "level": "error", "message": {"text": "Flask mutation route `team_create` without `@login_required` \u2014 server.py:282"}, "properties": {"repobilityId": "87553f80451dc43b", "scanner": "scanner-primary", "fingerprint": "f5688f8909e0a362", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-c09d78b8c378a75c", "level": "error", "message": {"text": "Flask mutation route `team_join` without `@login_required` \u2014 server.py:318"}, "properties": {"repobilityId": "bcc439bffbdba6ef", "scanner": "scanner-primary", "fingerprint": "c09d78b8c378a75c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-7df07939127c9642", "level": "error", "message": {"text": "Flask mutation route `api_unlock` without `@login_required` \u2014 server.py:341"}, "properties": {"repobilityId": "af3e682f28023ebb", "scanner": "scanner-primary", "fingerprint": "7df07939127c9642", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 341}}}]}, {"ruleId": "scanner-8e2fdcedb7c7efef", "level": "error", "message": {"text": "Flask mutation route `submit` without `@login_required` \u2014 server.py:393"}, "properties": {"repobilityId": "b9a25c19cda9a699", "scanner": "scanner-primary", "fingerprint": "8e2fdcedb7c7efef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 393}}}]}, {"ruleId": "scanner-9d578a5bba03a0d3", "level": "error", "message": {"text": "Flask mutation route `skip` without `@login_required` \u2014 server.py:531"}, "properties": {"repobilityId": "2715451f3afa66f6", "scanner": "scanner-primary", "fingerprint": "9d578a5bba03a0d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 531}}}]}, {"ruleId": "scanner-5b8078be5338c050", "level": "error", "message": {"text": "Flask mutation route `buy_hint` without `@login_required` \u2014 server.py:619"}, "properties": {"repobilityId": "1925ad50d2768e00", "scanner": "scanner-primary", "fingerprint": "5b8078be5338c050", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 619}}}]}, {"ruleId": "scanner-8901a84000e7f7c2", "level": "error", "message": {"text": "Flask mutation route `bonus_offer` without `@login_required` \u2014 server.py:663"}, "properties": {"repobilityId": "2498bb45ac0a6dde", "scanner": "scanner-primary", "fingerprint": "8901a84000e7f7c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 663}}}]}, {"ruleId": "scanner-042733945ce8d67b", "level": "error", "message": {"text": "Flask mutation route `bonus_respond` without `@login_required` \u2014 server.py:691"}, "properties": {"repobilityId": "4290209c4ea2b81f", "scanner": "scanner-primary", "fingerprint": "042733945ce8d67b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 691}}}]}, {"ruleId": "scanner-196395dd5f53bf51", "level": "error", "message": {"text": "Flask mutation route `bonus_cancel` without `@login_required` \u2014 server.py:786"}, "properties": {"repobilityId": "6f1569c881f0fa69", "scanner": "scanner-primary", "fingerprint": "196395dd5f53bf51", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 786}}}]}, {"ruleId": "scanner-dfc5fa749ddfb2d4", "level": "error", "message": {"text": "Flask mutation route `bonus_fail` without `@login_required` \u2014 server.py:800"}, "properties": {"repobilityId": "71fdb80ebcca8f64", "scanner": "scanner-primary", "fingerprint": "dfc5fa749ddfb2d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 800}}}]}, {"ruleId": "scanner-5094e70fac97188d", "level": "error", "message": {"text": "Flask mutation route `verify_pushups` without `@login_required` \u2014 server.py:834"}, "properties": {"repobilityId": "e5e9996ad057fdac", "scanner": "scanner-primary", "fingerprint": "5094e70fac97188d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 834}}}]}, {"ruleId": "scanner-d7e58bed8c1d0c35", "level": "error", "message": {"text": "Flask mutation route `admin_reset` without `@login_required` \u2014 server.py:870"}, "properties": {"repobilityId": "58ca700d4172cd21", "scanner": "scanner-primary", "fingerprint": "d7e58bed8c1d0c35", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 870}}}]}, {"ruleId": "scanner-7c94adefc230e736", "level": "error", "message": {"text": "Flask mutation route `admin_start` without `@login_required` \u2014 server.py:884"}, "properties": {"repobilityId": "81f5225f8148fd3a", "scanner": "scanner-primary", "fingerprint": "7c94adefc230e736", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 884}}}]}, {"ruleId": "scanner-6d1b35e68f973048", "level": "error", "message": {"text": "Flask mutation route `admin_bonus` without `@login_required` \u2014 server.py:902"}, "properties": {"repobilityId": "631aca081a9da3e3", "scanner": "scanner-primary", "fingerprint": "6d1b35e68f973048", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 902}}}]}, {"ruleId": "scanner-fa53e2bcf5634cbc", "level": "error", "message": {"text": "Flask mutation route `admin_clear_block` without `@login_required` \u2014 server.py:922"}, "properties": {"repobilityId": "84d6a62c7e928636", "scanner": "scanner-primary", "fingerprint": "fa53e2bcf5634cbc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 922}}}]}, {"ruleId": "scanner-7c07c2516419ed15", "level": "error", "message": {"text": "Flask mutation route `editor_load` without `@login_required` \u2014 server.py:952"}, "properties": {"repobilityId": "096250b5532cbd35", "scanner": "scanner-primary", "fingerprint": "7c07c2516419ed15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 952}}}]}, {"ruleId": "scanner-b595adcf1add605b", "level": "error", "message": {"text": "Flask mutation route `editor_save` without `@login_required` \u2014 server.py:962"}, "properties": {"repobilityId": "f9787b05c10c9db8", "scanner": "scanner-primary", "fingerprint": "b595adcf1add605b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 962}}}]}, {"ruleId": "scanner-56d933dc0c428d52", "level": "error", "message": {"text": "Flask mutation route `editor_upload` without `@login_required` \u2014 server.py:985"}, "properties": {"repobilityId": "b3b68f210facaf45", "scanner": "scanner-primary", "fingerprint": "56d933dc0c428d52", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.py"}, "region": {"startLine": 985}}}]}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "acd87918fd42fe63", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f322c3c7eba721f", "level": "note", "message": {"text": "Unused endpoint: ANY /unlock/<int:mission_id>"}, "properties": {"repobilityId": "667ac2bddd88b6a7", "scanner": "scanner-primary", "fingerprint": "8f322c3c7eba721f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32759079c9e4d148", "level": "note", "message": {"text": "Unused endpoint: ANY /api/missions"}, "properties": {"repobilityId": "9223f7ae855716f9", "scanner": "scanner-primary", "fingerprint": "32759079c9e4d148", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5444bcce1f6e801a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/team/create"}, "properties": {"repobilityId": "0b1d73f3b2bb2614", "scanner": "scanner-primary", "fingerprint": "5444bcce1f6e801a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01917852f38ac526", "level": "note", "message": {"text": "Unused endpoint: ANY /api/team/join"}, "properties": {"repobilityId": "b732d44b526a1828", "scanner": "scanner-primary", "fingerprint": "01917852f38ac526", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6505a5b832b745c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/unlock"}, "properties": {"repobilityId": "98bb48cc52e5843d", "scanner": "scanner-primary", "fingerprint": "a6505a5b832b745c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9f8b64971ad1c5d2", "level": "note", "message": {"text": "Unused endpoint: ANY /api/team/list"}, "properties": {"repobilityId": "1f9033abf409998e", "scanner": "scanner-primary", "fingerprint": "9f8b64971ad1c5d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-50cece05c486fb18", "level": "note", "message": {"text": "Unused endpoint: ANY /api/submit"}, "properties": {"repobilityId": "8cd282f8bce7d652", "scanner": "scanner-primary", "fingerprint": "50cece05c486fb18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aa0a30eee7a52cd4", "level": "note", "message": {"text": "Unused endpoint: ANY /api/skip"}, "properties": {"repobilityId": "21b273606c2d73a1", "scanner": "scanner-primary", "fingerprint": "aa0a30eee7a52cd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c58e664c6e7298e3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/hint"}, "properties": {"repobilityId": "a6d2c5c8928574d3", "scanner": "scanner-primary", "fingerprint": "c58e664c6e7298e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e6fc07ea23f67edb", "level": "note", "message": {"text": "Unused endpoint: ANY /api/state"}, "properties": {"repobilityId": "570a0e167dc3001c", "scanner": "scanner-primary", "fingerprint": "e6fc07ea23f67edb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2a23020eab7d739", "level": "note", "message": {"text": "Unused endpoint: ANY /api/team/<team_name>"}, "properties": {"repobilityId": "18e34ba36231fb5f", "scanner": "scanner-primary", "fingerprint": "e2a23020eab7d739", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-acd423c7d3f8c34d", "level": "note", "message": {"text": "Unused endpoint: ANY /api/bonus/offer"}, "properties": {"repobilityId": "ca26c5ddc27599cc", "scanner": "scanner-primary", "fingerprint": "acd423c7d3f8c34d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f684f8dc9a22bf79", "level": "note", "message": {"text": "Unused endpoint: ANY /api/bonus/respond"}, "properties": {"repobilityId": "e46251008caa35f1", "scanner": "scanner-primary", "fingerprint": "f684f8dc9a22bf79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e1769a069622068", "level": "note", "message": {"text": "Unused endpoint: ANY /api/bonus/cancel"}, "properties": {"repobilityId": "39f748d2c3a230a4", "scanner": "scanner-primary", "fingerprint": "8e1769a069622068", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0184647094f7106", "level": "note", "message": {"text": "Unused endpoint: ANY /api/bonus/fail"}, "properties": {"repobilityId": "d301e8cff5a35146", "scanner": "scanner-primary", "fingerprint": "e0184647094f7106", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1cf9bb963f1db298", "level": "note", "message": {"text": "Unused endpoint: ANY /api/verify/pushups"}, "properties": {"repobilityId": "0489d386f28689e5", "scanner": "scanner-primary", "fingerprint": "1cf9bb963f1db298", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2d158b9bd4955056", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/reset"}, "properties": {"repobilityId": "a87eeb5045a4e3fe", "scanner": "scanner-primary", "fingerprint": "2d158b9bd4955056", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1ef97e5995573a65", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/start"}, "properties": {"repobilityId": "8650c17862e256ce", "scanner": "scanner-primary", "fingerprint": "1ef97e5995573a65", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d739c5f92674d48", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/bonus"}, "properties": {"repobilityId": "1ac5de6bc36d224a", "scanner": "scanner-primary", "fingerprint": "9d739c5f92674d48", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5fc4f373073b659", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/state"}, "properties": {"repobilityId": "c96af4b6b6de62ee", "scanner": "scanner-primary", "fingerprint": "a5fc4f373073b659", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4825c4255b3e44f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/clear-block"}, "properties": {"repobilityId": "e06dceb9634cfd5d", "scanner": "scanner-primary", "fingerprint": "c4825c4255b3e44f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98356fa7ff420a14", "level": "note", "message": {"text": "Unused endpoint: ANY /admin"}, "properties": {"repobilityId": "4daf5aaa79fbac20", "scanner": "scanner-primary", "fingerprint": "98356fa7ff420a14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-192d62fb6630bb2d", "level": "note", "message": {"text": "Unused endpoint: ANY /editor"}, "properties": {"repobilityId": "fade4a17b70cbd56", "scanner": "scanner-primary", "fingerprint": "192d62fb6630bb2d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-945f6fbfcf44b50a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/editor/load"}, "properties": {"repobilityId": "7ae368920972e753", "scanner": "scanner-primary", "fingerprint": "945f6fbfcf44b50a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6487dc7c70310945", "level": "note", "message": {"text": "Unused endpoint: ANY /api/editor/save"}, "properties": {"repobilityId": "20a0a391fdbcef3a", "scanner": "scanner-primary", "fingerprint": "6487dc7c70310945", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eed741786a2c841c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/editor/upload"}, "properties": {"repobilityId": "8ea286512db53957", "scanner": "scanner-primary", "fingerprint": "eed741786a2c841c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2eebbecdf8e7c779", "level": "note", "message": {"text": "Unused endpoint: ANY /uploads/<filename>"}, "properties": {"repobilityId": "9a41cd1389c41e30", "scanner": "scanner-primary", "fingerprint": "2eebbecdf8e7c779", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58f27698e0011680", "level": "note", "message": {"text": "Unused endpoint: ANY /static/<path:filename>"}, "properties": {"repobilityId": "9abf1f540afc232e", "scanner": "scanner-primary", "fingerprint": "58f27698e0011680", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2c038a4433a0069b", "level": "note", "message": {"text": "Unused endpoint: ANY /qr-codes-v2/<path:filename>"}, "properties": {"repobilityId": "e2903b99c6b71c36", "scanner": "scanner-primary", "fingerprint": "2c038a4433a0069b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7875e0cd18e3595e", "level": "note", "message": {"text": "Unused endpoint: ANY /qr"}, "properties": {"repobilityId": "cc71e8c9284363aa", "scanner": "scanner-primary", "fingerprint": "7875e0cd18e3595e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec618e4781cde1d5", "level": "note", "message": {"text": "Unused endpoint: ANY /missions/red.json"}, "properties": {"repobilityId": "2d39268985fefaf3", "scanner": "scanner-primary", "fingerprint": "ec618e4781cde1d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ee4cdab1e647909", "level": "note", "message": {"text": "Unused endpoint: ANY /missions/blue.json"}, "properties": {"repobilityId": "bd5eb27d9fc77e88", "scanner": "scanner-primary", "fingerprint": "5ee4cdab1e647909", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}