{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d3a0522a873c86c7", "name": "Possibly dead Python function: canonicalise_browser_paired_proof", "shortDescription": {"text": "Possibly dead Python function: canonicalise_browser_paired_proof"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc11803d3ce95fbf", "name": "Possibly dead Python function: validate_daemon_proof", "shortDescription": {"text": "Possibly dead Python function: validate_daemon_proof"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b4a9f488957790c", "name": "Possibly dead Python function: score_risk", "shortDescription": {"text": "Possibly dead Python function: score_risk"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e273386a6c4a4a", "name": "Possibly dead Python function: append_entry", "shortDescription": {"text": "Possibly dead Python function: append_entry"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eff620086c34d78", "name": "Possibly dead Python function: verify_chain", "shortDescription": {"text": "Possibly dead Python function: verify_chain"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b31049e6346f716f", "name": "Stray `console.log` in TS/JS \u2014 server.js:1580", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:1580"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7e6e3ab9bc32b736", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/instructor.html:688", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/instructor.html:688"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f338a723386e5a9", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:2918", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:2918"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e35ada800fe8a39b", "name": "Insecure pattern 'local_storage_auth_token' in public/banking-pilot-consent.html:119", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in public/banking-pilot-consent.html:119"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35ef19ef625ff86c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5355c32d2323222d", "name": "Very large file: server.js (1616 lines)", "shortDescription": {"text": "Very large file: server.js (1616 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2882e376830b224", "name": "Very large file: scripts/check.sh (1423 lines)", "shortDescription": {"text": "Very large file: scripts/check.sh (1423 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 37 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65fe027610d0114c", "name": "Commented-code block (13 lines) in tests/security/stage28ab_linux_security_audit.test.js:7", "shortDescription": {"text": "Commented-code block (13 lines) in tests/security/stage28ab_linux_security_audit.test.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-89cec495b746f26c", "name": "Commented-code block (10 lines) in tests/security/stage_26_27_closeout_audit.test.js:4", "shortDescription": {"text": "Commented-code block (10 lines) in tests/security/stage_26_27_closeout_audit.test.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-038212350c3ca205", "name": "Commented-code block (6 lines) in tests/unit/nonceGuardTtlReplay.test.js:41", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/nonceGuardTtlReplay.test.js:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c174a8c80be4901", "name": "Commented-code block (5 lines) in tests/e2e/stage28cd_linux_wayland_systemd_ci_smoke.mjs:587", "shortDescription": {"text": "Commented-code block (5 lines) in tests/e2e/stage28cd_linux_wayland_systemd_ci_smoke.mjs:587"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d06b9d146cbfd45", "name": "`fetch()` without try/.catch or AbortSignal \u2014 tools/voting-pilot-persona.mjs:59", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/voting-pilot-persona.mjs:59"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0166f25764485d84", "name": "Commented-code block (5 lines) in public/sdk/simurgh-browser-sdk.js:284", "shortDescription": {"text": "Commented-code block (5 lines) in public/sdk/simurgh-browser-sdk.js:284"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3bfe9e48b148ae66", "name": "Commented-code block (6 lines) in src/integrity/proofCanonicalise.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in src/integrity/proofCanonicalise.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e4f7505a8afc3024", "name": "Commented-code block (8 lines) in src/integrity/proofSignature.js:4", "shortDescription": {"text": "Commented-code block (8 lines) in src/integrity/proofSignature.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-91a963e80cfde3bf", "name": "Commented-code block (5 lines) in src/bankingPilot/bankingAiPrivacyReceipt.js:38", "shortDescription": {"text": "Commented-code block (5 lines) in src/bankingPilot/bankingAiPrivacyReceipt.js:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4eee1c6f1fa7243f", "name": "Commented-code block (6 lines) in src/bankingPilot/bankingNarrativeOutputFirewall.js:56", "shortDescription": {"text": "Commented-code block (6 lines) in src/bankingPilot/bankingNarrativeOutputFirewall.js:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc44291a72007fb2", "name": "Commented-code block (6 lines) in src/device/forbiddenLocalFields.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in src/device/forbiddenLocalFields.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-81738ae17e065d81", "name": "Commented-code block (6 lines) in src/device/scannerRiskPolicy.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in src/device/scannerRiskPolicy.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `SIMURGH_BANKING_PILOT_AI_EXPLAIN`, `SIMURGH_BANKING_PILOT_CONSENT_RATE_MAX`, `SIMURGH_BANKING_PILOT_MAX_SESSIONS`, `SIMURGH_BANKING_PILOT_READ_RATE_MAX`, `SIMURGH_BANKING_PILOT_WRITE_RATE_MAX`, `SIMURGH_RETENTION_DAYS`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-849d10c85bb399eb", "name": "Dangling fetch: GET http://127.0.0.1:${port}/health (tests/unit/displayServerLockServerWiring.test.js:67)", "shortDescription": {"text": "Dangling fetch: GET http://127.0.0.1:${port}/health (tests/unit/displayServerLockServerWiring.test.js:67)"}, "fullDescription": {"text": "`tests/unit/displayServerLockServerWiring.test.js:67` calls `GET http://127.0.0.1:${port}/health` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:/<p>/health`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5a1c5263f53f96a5", "name": "Unused endpoint: USE /api/voting-pilot", "shortDescription": {"text": "Unused endpoint: USE /api/voting-pilot"}, "fullDescription": {"text": "`server.js` declares `USE /api/voting-pilot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf0663e979e0b5a7", "name": "Unused endpoint: USE /api/banking-pilot", "shortDescription": {"text": "Unused endpoint: USE /api/banking-pilot"}, "fullDescription": {"text": "`server.js` declares `USE /api/banking-pilot` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c3c469c7f971f22", "name": "Unused endpoint: GET /instructor", "shortDescription": {"text": "Unused endpoint: GET /instructor"}, "fullDescription": {"text": "`server.js` declares `GET /instructor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dc37d022071baad", "name": "Unused endpoint: POST /api/device/challenge", "shortDescription": {"text": "Unused endpoint: POST /api/device/challenge"}, "fullDescription": {"text": "`server.js` declares `POST /api/device/challenge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0143b1085e19e6fb", "name": "Unused endpoint: POST /api/device/pair", "shortDescription": {"text": "Unused endpoint: POST /api/device/pair"}, "fullDescription": {"text": "`server.js` declares `POST /api/device/pair` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a346e1aafec6a88d", "name": "Unused endpoint: POST /api/telemetry", "shortDescription": {"text": "Unused endpoint: POST /api/telemetry"}, "fullDescription": {"text": "`server.js` declares `POST /api/telemetry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-968d1e0352ff0d31", "name": "Unused endpoint: GET /api/dashboard/:sessionId", "shortDescription": {"text": "Unused endpoint: GET /api/dashboard/:sessionId"}, "fullDescription": {"text": "`server.js` declares `GET /api/dashboard/:sessionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c0cdb9303ee684d", "name": "Unused endpoint: POST /api/affinity", "shortDescription": {"text": "Unused endpoint: POST /api/affinity"}, "fullDescription": {"text": "`server.js` declares `POST /api/affinity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c80c74088b98459", "name": "Unused endpoint: POST /api/affinity/simulate", "shortDescription": {"text": "Unused endpoint: POST /api/affinity/simulate"}, "fullDescription": {"text": "`server.js` declares `POST /api/affinity/simulate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da8283aa96df4d11", "name": "Unused endpoint: GET /api/affinity/:sessionId", "shortDescription": {"text": "Unused endpoint: GET /api/affinity/:sessionId"}, "fullDescription": {"text": "`server.js` declares `GET /api/affinity/:sessionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-667773660797631d", "name": "Unused endpoint: GET /api/audit/:sessionId", "shortDescription": {"text": "Unused endpoint: GET /api/audit/:sessionId"}, "fullDescription": {"text": "`server.js` declares `GET /api/audit/:sessionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf2e6e2188a510ee", "name": "Unused endpoint: GET /api/sessions", "shortDescription": {"text": "Unused endpoint: GET /api/sessions"}, "fullDescription": {"text": "`server.js` declares `GET /api/sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed7a672400062217", "name": "Unused endpoint: GET /api/stream/instructor", "shortDescription": {"text": "Unused endpoint: GET /api/stream/instructor"}, "fullDescription": {"text": "`server.js` declares `GET /api/stream/instructor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1ffa0305215b513", "name": "Unused endpoint: GET /api/meta", "shortDescription": {"text": "Unused endpoint: GET /api/meta"}, "fullDescription": {"text": "`server.js` declares `GET /api/meta` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cac306070e03be15", "name": "Unused endpoint: POST /api/exams", "shortDescription": {"text": "Unused endpoint: POST /api/exams"}, "fullDescription": {"text": "`server.js` declares `POST /api/exams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d557565e59c83d86", "name": "Unused endpoint: GET /api/exams", "shortDescription": {"text": "Unused endpoint: GET /api/exams"}, "fullDescription": {"text": "`server.js` declares `GET /api/exams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4bd7482b37de7b6", "name": "Unused endpoint: POST /api/exams/:examId/join", "shortDescription": {"text": "Unused endpoint: POST /api/exams/:examId/join"}, "fullDescription": {"text": "`server.js` declares `POST /api/exams/:examId/join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26bbbc0dd1047587", "name": "Unused endpoint: POST /api/sessions/:sessionId/privacy-accept", "shortDescription": {"text": "Unused endpoint: POST /api/sessions/:sessionId/privacy-accept"}, "fullDescription": {"text": "`server.js` declares `POST /api/sessions/:sessionId/privacy-accept` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71fcc6ca249ec07a", "name": "Unused endpoint: POST /api/sessions/:sessionId/start", "shortDescription": {"text": "Unused endpoint: POST /api/sessions/:sessionId/start"}, "fullDescription": {"text": "`server.js` declares `POST /api/sessions/:sessionId/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47cc7f66c55d26ad", "name": "Unused endpoint: POST /api/sessions/:sessionId/submit", "shortDescription": {"text": "Unused endpoint: POST /api/sessions/:sessionId/submit"}, "fullDescription": {"text": "`server.js` declares `POST /api/sessions/:sessionId/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92354f939d189742", "name": "Unused endpoint: GET /api/sessions/:sessionId/report", "shortDescription": {"text": "Unused endpoint: GET /api/sessions/:sessionId/report"}, "fullDescription": {"text": "`server.js` declares `GET /api/sessions/:sessionId/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-881f62c8d6ad2999", "name": "Unused endpoint: GET /api/audit/:sessionId/verify", "shortDescription": {"text": "Unused endpoint: GET /api/audit/:sessionId/verify"}, "fullDescription": {"text": "`server.js` declares `GET /api/audit/:sessionId/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2e0f8454bb5e16d", "name": "Unused endpoint: POST /api/integrity/pairing/challenge", "shortDescription": {"text": "Unused endpoint: POST /api/integrity/pairing/challenge"}, "fullDescription": {"text": "`server.js` declares `POST /api/integrity/pairing/challenge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c16988fc84887d1", "name": "Unused endpoint: POST /api/integrity/pairing/complete", "shortDescription": {"text": "Unused endpoint: POST /api/integrity/pairing/complete"}, "fullDescription": {"text": "`server.js` declares `POST /api/integrity/pairing/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53796ffd857ae9ff", "name": "Unused endpoint: POST /api/integrity/proofs", "shortDescription": {"text": "Unused endpoint: POST /api/integrity/proofs"}, "fullDescription": {"text": "`server.js` declares `POST /api/integrity/proofs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55ca415c20a7e8fa", "name": "Unused endpoint: POST /consent/accept", "shortDescription": {"text": "Unused endpoint: POST /consent/accept"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `POST /consent/accept` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81dd947d0ca809c7", "name": "Unused endpoint: POST /submit", "shortDescription": {"text": "Unused endpoint: POST /submit"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `POST /submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92da9ee5166256ca", "name": "Unused endpoint: POST /withdraw", "shortDescription": {"text": "Unused endpoint: POST /withdraw"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `POST /withdraw` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-407fb3bf1c6df3cf", "name": "Unused endpoint: GET /:sessionId/report", "shortDescription": {"text": "Unused endpoint: GET /:sessionId/report"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `GET /:sessionId/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4c78d812a78caaf", "name": "Unused endpoint: GET /:sessionId/audit", "shortDescription": {"text": "Unused endpoint: GET /:sessionId/audit"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `GET /:sessionId/audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3838718c5d3a4dcb", "name": "Unused endpoint: GET /:sessionId/verify", "shortDescription": {"text": "Unused endpoint: GET /:sessionId/verify"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `GET /:sessionId/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a84788c42d460c04", "name": "Unused endpoint: GET /:sessionId/ai-privacy-explain", "shortDescription": {"text": "Unused endpoint: GET /:sessionId/ai-privacy-explain"}, "fullDescription": {"text": "`src/bankingPilot/index.js` declares `GET /:sessionId/ai-privacy-explain` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17819"}, "properties": {"repository": "Raoof128/Project-Simurgh", "repoUrl": "https://github.com/Raoof128/Project-Simurgh", "branch": "main"}, "results": [{"ruleId": "scanner-d3a0522a873c86c7", "level": "note", "message": {"text": "Possibly dead Python function: canonicalise_browser_paired_proof"}, "properties": {"repobilityId": "ad976b7c29c64f8e", "scanner": "scanner-primary", "fingerprint": "d3a0522a873c86c7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "papers/project-simurgh/ara/src/execution/proof_protocol.py:87"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc11803d3ce95fbf", "level": "note", "message": {"text": "Possibly dead Python function: validate_daemon_proof"}, "properties": {"repobilityId": "f47fba062b36907a", "scanner": "scanner-primary", "fingerprint": "cc11803d3ce95fbf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "papers/project-simurgh/ara/src/execution/proof_protocol.py:124"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b4a9f488957790c", "level": "note", "message": {"text": "Possibly dead Python function: score_risk"}, "properties": {"repobilityId": "96927a561de8de75", "scanner": "scanner-primary", "fingerprint": "0b4a9f488957790c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "papers/project-simurgh/ara/src/execution/proof_protocol.py:197"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9e273386a6c4a4a", "level": "note", "message": {"text": "Possibly dead Python function: append_entry"}, "properties": {"repobilityId": "e4579df88aa2ceec", "scanner": "scanner-primary", "fingerprint": "c9e273386a6c4a4a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "papers/project-simurgh/ara/src/execution/proof_protocol.py:282"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7eff620086c34d78", "level": "note", "message": {"text": "Possibly dead Python function: verify_chain"}, "properties": {"repobilityId": "babca401c6bbca6a", "scanner": "scanner-primary", "fingerprint": "7eff620086c34d78", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "papers/project-simurgh/ara/src/execution/proof_protocol.py:298"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b31049e6346f716f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:1580"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "b31049e6346f716f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7e6e3ab9bc32b736", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/instructor.html:688"}, "properties": {"repobilityId": "0484b669912ebc0b", "scanner": "scanner-primary", "fingerprint": "7e6e3ab9bc32b736", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/instructor.html"}, "region": {"startLine": 688}}}]}, {"ruleId": "scanner-7f338a723386e5a9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/index.html:2918"}, "properties": {"repobilityId": "fcd975cc51168fca", "scanner": "scanner-primary", "fingerprint": "7f338a723386e5a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/index.html"}, "region": {"startLine": 2918}}}]}, {"ruleId": "scanner-e35ada800fe8a39b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in public/banking-pilot-consent.html:119"}, "properties": {"repobilityId": "41a3336fb8bc85b7", "scanner": "scanner-primary", "fingerprint": "e35ada800fe8a39b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/banking-pilot-consent.html"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-35ef19ef625ff86c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c89ae6bd95724d1", "scanner": "scanner-primary", "fingerprint": "35ef19ef625ff86c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stage-1-checks.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-35ef19ef625ff86c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0ff1bfb415fee56", "scanner": "scanner-primary", "fingerprint": "35ef19ef625ff86c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stage-1-checks.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-35ef19ef625ff86c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ab20e3867b51078", "scanner": "scanner-primary", "fingerprint": "35ef19ef625ff86c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stage-1-checks.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-35ef19ef625ff86c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "330553c66336b087", "scanner": "scanner-primary", "fingerprint": "35ef19ef625ff86c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stage-1-checks.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-35ef19ef625ff86c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "96355546f16242ff", "scanner": "scanner-primary", "fingerprint": "35ef19ef625ff86c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stage-1-checks.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-5355c32d2323222d", "level": "note", "message": {"text": "Very large file: server.js (1616 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "5355c32d2323222d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b2882e376830b224", "level": "note", "message": {"text": "Very large file: scripts/check.sh (1423 lines)"}, "properties": {"repobilityId": "1d2a6ea05aa7ea37", "scanner": "scanner-primary", "fingerprint": "b2882e376830b224", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "187a0b95b4e7882f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "db9db5fdce33c888", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1a0725494c3caa1f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7e668a6400f40e80", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-65fe027610d0114c", "level": "none", "message": {"text": "Commented-code block (13 lines) in tests/security/stage28ab_linux_security_audit.test.js:7"}, "properties": {"repobilityId": "0dc514862777e5df", "scanner": "scanner-primary", "fingerprint": "65fe027610d0114c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-89cec495b746f26c", "level": "none", "message": {"text": "Commented-code block (10 lines) in tests/security/stage_26_27_closeout_audit.test.js:4"}, "properties": {"repobilityId": "51fed16980b3eee0", "scanner": "scanner-primary", "fingerprint": "89cec495b746f26c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-038212350c3ca205", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/nonceGuardTtlReplay.test.js:41"}, "properties": {"repobilityId": "0b4e2a5f49435c41", "scanner": "scanner-primary", "fingerprint": "038212350c3ca205", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c174a8c80be4901", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/e2e/stage28cd_linux_wayland_systemd_ci_smoke.mjs:587"}, "properties": {"repobilityId": "197ae24fa806512a", "scanner": "scanner-primary", "fingerprint": "0c174a8c80be4901", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d06b9d146cbfd45", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 tools/voting-pilot-persona.mjs:59"}, "properties": {"repobilityId": "4c7774d5aaf46290", "scanner": "scanner-primary", "fingerprint": "8d06b9d146cbfd45", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0166f25764485d84", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/sdk/simurgh-browser-sdk.js:284"}, "properties": {"repobilityId": "b52ceec4082feb57", "scanner": "scanner-primary", "fingerprint": "0166f25764485d84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3bfe9e48b148ae66", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/integrity/proofCanonicalise.js:4"}, "properties": {"repobilityId": "acc1c3d8b38984f6", "scanner": "scanner-primary", "fingerprint": "3bfe9e48b148ae66", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e4f7505a8afc3024", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/integrity/proofSignature.js:4"}, "properties": {"repobilityId": "456c55702ebabe3a", "scanner": "scanner-primary", "fingerprint": "e4f7505a8afc3024", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-91a963e80cfde3bf", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/bankingPilot/bankingAiPrivacyReceipt.js:38"}, "properties": {"repobilityId": "c29d09ec596ba0a8", "scanner": "scanner-primary", "fingerprint": "91a963e80cfde3bf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4eee1c6f1fa7243f", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/bankingPilot/bankingNarrativeOutputFirewall.js:56"}, "properties": {"repobilityId": "a06bad39df1d8091", "scanner": "scanner-primary", "fingerprint": "4eee1c6f1fa7243f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc44291a72007fb2", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/device/forbiddenLocalFields.js:1"}, "properties": {"repobilityId": "2fe02c7c7d482058", "scanner": "scanner-primary", "fingerprint": "cc44291a72007fb2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-81738ae17e065d81", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/device/scannerRiskPolicy.js:1"}, "properties": {"repobilityId": "2ec6af4502b51bd9", "scanner": "scanner-primary", "fingerprint": "81738ae17e065d81", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-849d10c85bb399eb", "level": "error", "message": {"text": "Dangling fetch: GET http://127.0.0.1:${port}/health (tests/unit/displayServerLockServerWiring.test.js:67)"}, "properties": {"repobilityId": "e17403d7e583e000", "scanner": "scanner-primary", "fingerprint": "849d10c85bb399eb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5a1c5263f53f96a5", "level": "note", "message": {"text": "Unused endpoint: USE /api/voting-pilot"}, "properties": {"repobilityId": "68e3fc2168f9fe78", "scanner": "scanner-primary", "fingerprint": "5a1c5263f53f96a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf0663e979e0b5a7", "level": "note", "message": {"text": "Unused endpoint: USE /api/banking-pilot"}, "properties": {"repobilityId": "ef82b2d1b653920a", "scanner": "scanner-primary", "fingerprint": "bf0663e979e0b5a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c3c469c7f971f22", "level": "note", "message": {"text": "Unused endpoint: GET /instructor"}, "properties": {"repobilityId": "b2bdab25fe85f425", "scanner": "scanner-primary", "fingerprint": "0c3c469c7f971f22", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8dc37d022071baad", "level": "note", "message": {"text": "Unused endpoint: POST /api/device/challenge"}, "properties": {"repobilityId": "37799f363d1573e0", "scanner": "scanner-primary", "fingerprint": "8dc37d022071baad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0143b1085e19e6fb", "level": "note", "message": {"text": "Unused endpoint: POST /api/device/pair"}, "properties": {"repobilityId": "9bf14219775f0ce2", "scanner": "scanner-primary", "fingerprint": "0143b1085e19e6fb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a346e1aafec6a88d", "level": "note", "message": {"text": "Unused endpoint: POST /api/telemetry"}, "properties": {"repobilityId": "98f7b904e4716e38", "scanner": "scanner-primary", "fingerprint": "a346e1aafec6a88d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-968d1e0352ff0d31", "level": "note", "message": {"text": "Unused endpoint: GET /api/dashboard/:sessionId"}, "properties": {"repobilityId": "80e4f33165dd4e6e", "scanner": "scanner-primary", "fingerprint": "968d1e0352ff0d31", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c0cdb9303ee684d", "level": "note", "message": {"text": "Unused endpoint: POST /api/affinity"}, "properties": {"repobilityId": "3f57b977669da4e4", "scanner": "scanner-primary", "fingerprint": "4c0cdb9303ee684d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c80c74088b98459", "level": "note", "message": {"text": "Unused endpoint: POST /api/affinity/simulate"}, "properties": {"repobilityId": "4005573747764a67", "scanner": "scanner-primary", "fingerprint": "4c80c74088b98459", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da8283aa96df4d11", "level": "note", "message": {"text": "Unused endpoint: GET /api/affinity/:sessionId"}, "properties": {"repobilityId": "3d910f6e7b13e5ca", "scanner": "scanner-primary", "fingerprint": "da8283aa96df4d11", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-667773660797631d", "level": "note", "message": {"text": "Unused endpoint: GET /api/audit/:sessionId"}, "properties": {"repobilityId": "7ee07bf66bedd215", "scanner": "scanner-primary", "fingerprint": "667773660797631d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf2e6e2188a510ee", "level": "note", "message": {"text": "Unused endpoint: GET /api/sessions"}, "properties": {"repobilityId": "994f83d7f7b8b63d", "scanner": "scanner-primary", "fingerprint": "bf2e6e2188a510ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed7a672400062217", "level": "note", "message": {"text": "Unused endpoint: GET /api/stream/instructor"}, "properties": {"repobilityId": "c56d6fda825e9652", "scanner": "scanner-primary", "fingerprint": "ed7a672400062217", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a1ffa0305215b513", "level": "note", "message": {"text": "Unused endpoint: GET /api/meta"}, "properties": {"repobilityId": "e610bc11c6aa5870", "scanner": "scanner-primary", "fingerprint": "a1ffa0305215b513", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cac306070e03be15", "level": "note", "message": {"text": "Unused endpoint: POST /api/exams"}, "properties": {"repobilityId": "7b1059ee2f932a81", "scanner": "scanner-primary", "fingerprint": "cac306070e03be15", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d557565e59c83d86", "level": "note", "message": {"text": "Unused endpoint: GET /api/exams"}, "properties": {"repobilityId": "60e9a53c4f92674a", "scanner": "scanner-primary", "fingerprint": "d557565e59c83d86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4bd7482b37de7b6", "level": "note", "message": {"text": "Unused endpoint: POST /api/exams/:examId/join"}, "properties": {"repobilityId": "2f40108b21987f44", "scanner": "scanner-primary", "fingerprint": "a4bd7482b37de7b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-26bbbc0dd1047587", "level": "note", "message": {"text": "Unused endpoint: POST /api/sessions/:sessionId/privacy-accept"}, "properties": {"repobilityId": "0b0516ebcd5394b0", "scanner": "scanner-primary", "fingerprint": "26bbbc0dd1047587", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71fcc6ca249ec07a", "level": "note", "message": {"text": "Unused endpoint: POST /api/sessions/:sessionId/start"}, "properties": {"repobilityId": "2b6a1ec3f378a7d3", "scanner": "scanner-primary", "fingerprint": "71fcc6ca249ec07a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47cc7f66c55d26ad", "level": "note", "message": {"text": "Unused endpoint: POST /api/sessions/:sessionId/submit"}, "properties": {"repobilityId": "7acf36825b7ae715", "scanner": "scanner-primary", "fingerprint": "47cc7f66c55d26ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92354f939d189742", "level": "note", "message": {"text": "Unused endpoint: GET /api/sessions/:sessionId/report"}, "properties": {"repobilityId": "ea5b7df54d315d5b", "scanner": "scanner-primary", "fingerprint": "92354f939d189742", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-881f62c8d6ad2999", "level": "note", "message": {"text": "Unused endpoint: GET /api/audit/:sessionId/verify"}, "properties": {"repobilityId": "d6dc6b89375e61c2", "scanner": "scanner-primary", "fingerprint": "881f62c8d6ad2999", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e2e0f8454bb5e16d", "level": "note", "message": {"text": "Unused endpoint: POST /api/integrity/pairing/challenge"}, "properties": {"repobilityId": "b1b4dd3d8600bf89", "scanner": "scanner-primary", "fingerprint": "e2e0f8454bb5e16d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3c16988fc84887d1", "level": "note", "message": {"text": "Unused endpoint: POST /api/integrity/pairing/complete"}, "properties": {"repobilityId": "2fffebe4c3330a36", "scanner": "scanner-primary", "fingerprint": "3c16988fc84887d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-53796ffd857ae9ff", "level": "note", "message": {"text": "Unused endpoint: POST /api/integrity/proofs"}, "properties": {"repobilityId": "c55cc85e6c76e90f", "scanner": "scanner-primary", "fingerprint": "53796ffd857ae9ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55ca415c20a7e8fa", "level": "note", "message": {"text": "Unused endpoint: POST /consent/accept"}, "properties": {"repobilityId": "a34d1e02bf13b747", "scanner": "scanner-primary", "fingerprint": "55ca415c20a7e8fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81dd947d0ca809c7", "level": "note", "message": {"text": "Unused endpoint: POST /submit"}, "properties": {"repobilityId": "a7565163b2ee2360", "scanner": "scanner-primary", "fingerprint": "81dd947d0ca809c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92da9ee5166256ca", "level": "note", "message": {"text": "Unused endpoint: POST /withdraw"}, "properties": {"repobilityId": "7593264b3f0a7db0", "scanner": "scanner-primary", "fingerprint": "92da9ee5166256ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-407fb3bf1c6df3cf", "level": "note", "message": {"text": "Unused endpoint: GET /:sessionId/report"}, "properties": {"repobilityId": "eabdc110b73f419f", "scanner": "scanner-primary", "fingerprint": "407fb3bf1c6df3cf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4c78d812a78caaf", "level": "note", "message": {"text": "Unused endpoint: GET /:sessionId/audit"}, "properties": {"repobilityId": "72574dfd6aed1597", "scanner": "scanner-primary", "fingerprint": "c4c78d812a78caaf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3838718c5d3a4dcb", "level": "note", "message": {"text": "Unused endpoint: GET /:sessionId/verify"}, "properties": {"repobilityId": "061bf6c219dfb989", "scanner": "scanner-primary", "fingerprint": "3838718c5d3a4dcb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a84788c42d460c04", "level": "note", "message": {"text": "Unused endpoint: GET /:sessionId/ai-privacy-explain"}, "properties": {"repobilityId": "de46ff8f034c7e8c", "scanner": "scanner-primary", "fingerprint": "a84788c42d460c04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}