{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d0d786d49c5fbc79", "name": "Stray `console.log` in TS/JS \u2014 scripts/fe_test.js:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/fe_test.js:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-803a3a6d86e5267a", "name": "Insecure pattern 'eval_used' in scripts/fe_test.js:77", "shortDescription": {"text": "Insecure pattern 'eval_used' in scripts/fe_test.js:77"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60939250642519ae", "name": "Insecure pattern 'node_child_process' in scripts/fe_test.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/fe_test.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6d4b7f32ef40a69", "name": "Very large file: council/net/store.py (1420 lines)", "shortDescription": {"text": "Very large file: council/net/store.py (1420 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 286 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4bbc20ff4e0992b6", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/eval_currency_gap.py:214", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/eval_currency_gap.py:214"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-801d8d1cc5ed0a06", "name": "Network/subprocess call without timeout or try/except \u2014 council/judge.py:116", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 council/judge.py:116"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8441b269517be95b", "name": "Network/subprocess call without timeout or try/except \u2014 council/library.py:200", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 council/library.py:200"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea7dc158dd786ad2", "name": "Network/subprocess call without timeout or try/except \u2014 council/worker.py:91", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 council/worker.py:91"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51ddc42f0cb52d02", "name": "Commented-code block (5 lines) in council/researcher.py:214", "shortDescription": {"text": "Commented-code block (5 lines) in council/researcher.py:214"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-42f3a7793d0aa594", "name": "Network/subprocess call without timeout or try/except \u2014 council/researcher.py:76", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 council/researcher.py:76"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0957b35ee89056cb", "name": "Commented-code block (14 lines) in council/research.py:439", "shortDescription": {"text": "Commented-code block (14 lines) in council/research.py:439"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20e76e15df071b19", "name": "Commented-code block (5 lines) in council/sanitize.py:60", "shortDescription": {"text": "Commented-code block (5 lines) in council/sanitize.py:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb6a7131ba1fc697", "name": "Network/subprocess call without timeout or try/except \u2014 council/net/baseline.py:48", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 council/net/baseline.py:48"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ff5e57089e61653", "name": "Commented-code block (6 lines) in council/net/store.py:1094", "shortDescription": {"text": "Commented-code block (6 lines) in council/net/store.py:1094"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nspikes/spike1_fuzzy_verify/verify.py:token_overlap, spikes/spike1_fuzzy_verify/verify.py:tok\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-888dc2aec1b02772", "name": "FastAPI POST `research` without auth dependency \u2014 council/serve.py:58", "shortDescription": {"text": "FastAPI POST `research` without auth dependency \u2014 council/serve.py:58"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ce0a80d384e86a2", "name": "FastAPI POST `heartbeat` without auth dependency \u2014 council/net/coordinator_app.py:213", "shortDescription": {"text": "FastAPI POST `heartbeat` without auth dependency \u2014 council/net/coordinator_app.py:213"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c344248e0829910", "name": "FastAPI POST `task_result` without auth dependency \u2014 council/net/coordinator_app.py:231", "shortDescription": {"text": "FastAPI POST `task_result` without auth dependency \u2014 council/net/coordinator_app.py:231"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-29a834535e8f0354", "name": "FastAPI POST `task_progress` without auth dependency \u2014 council/net/coordinator_app.py:241", "shortDescription": {"text": "FastAPI POST `task_progress` without auth dependency \u2014 council/net/coordinator_app.py:241"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-86caf374c9263b0c", "name": "FastAPI POST `accept_assisted` without auth dependency \u2014 council/net/coordinator_app.py:263", "shortDescription": {"text": "FastAPI POST `accept_assisted` without auth dependency \u2014 council/net/coordinator_app.py:263"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aeba9ec72170bf32", "name": "FastAPI POST `deliver_assisted` without auth dependency \u2014 council/net/coordinator_app.py:283", "shortDescription": {"text": "FastAPI POST `deliver_assisted` without auth dependency \u2014 council/net/coordinator_app.py:283"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67f56b138b8d7efc", "name": "FastAPI POST `put_blob` without auth dependency \u2014 council/net/coordinator_app.py:299", "shortDescription": {"text": "FastAPI POST `put_blob` without auth dependency \u2014 council/net/coordinator_app.py:299"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aae1138a18b61e70", "name": "FastAPI POST `rate_assisted` without auth dependency \u2014 council/net/coordinator_app.py:326", "shortDescription": {"text": "FastAPI POST `rate_assisted` without auth dependency \u2014 council/net/coordinator_app.py:326"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97861e8fb81407d1", "name": "FastAPI POST `make_user` without auth dependency \u2014 council/net/coordinator_app.py:348", "shortDescription": {"text": "FastAPI POST `make_user` without auth dependency \u2014 council/net/coordinator_app.py:348"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdf941582275b170", "name": "FastAPI POST `admin_enroll` without auth dependency \u2014 council/net/coordinator_app.py:365", "shortDescription": {"text": "FastAPI POST `admin_enroll` without auth dependency \u2014 council/net/coordinator_app.py:365"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31801415fd66b8bb", "name": "FastAPI POST `submit_job` without auth dependency \u2014 council/net/coordinator_app.py:417", "shortDescription": {"text": "FastAPI POST `submit_job` without auth dependency \u2014 council/net/coordinator_app.py:417"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0137ae99fe57b3b7", "name": "FastAPI POST `feedback` without auth dependency \u2014 council/net/coordinator_app.py:449", "shortDescription": {"text": "FastAPI POST `feedback` without auth dependency \u2014 council/net/coordinator_app.py:449"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b83351671d71e04e", "name": "Unused endpoint: POST /research", "shortDescription": {"text": "Unused endpoint: POST /research"}, "fullDescription": {"text": "`council/serve.py` declares `POST /research` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbe34a344b8d2f70", "name": "Unused endpoint: GET /progress/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /progress/{job_id}"}, "fullDescription": {"text": "`council/serve.py` declares `GET /progress/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c124716a4436518b", "name": "Unused endpoint: GET /reports", "shortDescription": {"text": "Unused endpoint: GET /reports"}, "fullDescription": {"text": "`council/serve.py` declares `GET /reports` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc61345a86771817", "name": "Unused endpoint: GET /report/{name}", "shortDescription": {"text": "Unused endpoint: GET /report/{name}"}, "fullDescription": {"text": "`council/serve.py` declares `GET /report/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`council/serve.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f0f2932d9f52081", "name": "Unused endpoint: POST /nodes/register", "shortDescription": {"text": "Unused endpoint: POST /nodes/register"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /nodes/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-518a7696cb424203", "name": "Unused endpoint: POST /nodes/heartbeat", "shortDescription": {"text": "Unused endpoint: POST /nodes/heartbeat"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /nodes/heartbeat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd955cb582813515", "name": "Unused endpoint: GET /tasks/next", "shortDescription": {"text": "Unused endpoint: GET /tasks/next"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /tasks/next` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-404d50a23db2eaba", "name": "Unused endpoint: POST /tasks/{task_id}/result", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/result"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /tasks/{task_id}/result` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f7a5ea7522e455d", "name": "Unused endpoint: POST /tasks/{task_id}/progress", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/progress"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /tasks/{task_id}/progress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b779871ea2d3e3a", "name": "Unused endpoint: GET /tasks/offers", "shortDescription": {"text": "Unused endpoint: GET /tasks/offers"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /tasks/offers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1772a9ee393c179c", "name": "Unused endpoint: POST /tasks/{task_id}/accept", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/accept"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /tasks/{task_id}/accept` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76c90e12f4cf8f91", "name": "Unused endpoint: POST /tasks/{task_id}/deliver", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/deliver"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /tasks/{task_id}/deliver` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-681a39259554d4e0", "name": "Unused endpoint: POST /jobs/{job_id}/blobs/{blob_hash}", "shortDescription": {"text": "Unused endpoint: POST /jobs/{job_id}/blobs/{blob_hash}"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /jobs/{job_id}/blobs/{blob_hash}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0805db71dccb88c0", "name": "Unused endpoint: POST /jobs/{job_id}/rate", "shortDescription": {"text": "Unused endpoint: POST /jobs/{job_id}/rate"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /jobs/{job_id}/rate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0abed6fb0cc0c60e", "name": "Unused endpoint: GET /jobs/{job_id}/blob/{blob_hash}", "shortDescription": {"text": "Unused endpoint: GET /jobs/{job_id}/blob/{blob_hash}"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /jobs/{job_id}/blob/{blob_hash}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bca8100a44f7f25", "name": "Unused endpoint: POST /users", "shortDescription": {"text": "Unused endpoint: POST /users"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce6d758d8479b115", "name": "Unused endpoint: POST /admin/enroll", "shortDescription": {"text": "Unused endpoint: POST /admin/enroll"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /admin/enroll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64168fd25819c254", "name": "Unused endpoint: GET /job-types", "shortDescription": {"text": "Unused endpoint: GET /job-types"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /job-types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b73face5b06aa67", "name": "Unused endpoint: POST /jobs", "shortDescription": {"text": "Unused endpoint: POST /jobs"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /jobs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19fa0857993bfb51", "name": "Unused endpoint: GET /jobs/mine", "shortDescription": {"text": "Unused endpoint: GET /jobs/mine"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /jobs/mine` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee53a8b03729481e", "name": "Unused endpoint: GET /jobs/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /jobs/{job_id}"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /jobs/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6f240e5f9c28960", "name": "Unused endpoint: POST /jobs/{job_id}/feedback", "shortDescription": {"text": "Unused endpoint: POST /jobs/{job_id}/feedback"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `POST /jobs/{job_id}/feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add6dcb6007baef6", "name": "Unused endpoint: GET /leaderboard", "shortDescription": {"text": "Unused endpoint: GET /leaderboard"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /leaderboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d504b80adc9409ec", "name": "Unused endpoint: GET /dashboard", "shortDescription": {"text": "Unused endpoint: GET /dashboard"}, "fullDescription": {"text": "`council/net/coordinator_app.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22725"}, "properties": {"repository": "wikithoughts/passiveworkers", "repoUrl": "https://github.com/wikithoughts/passiveworkers", "branch": "main"}, "results": [{"ruleId": "scanner-d0d786d49c5fbc79", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/fe_test.js:73"}, "properties": {"repobilityId": "1670404e5684692c", "scanner": "scanner-primary", "fingerprint": "d0d786d49c5fbc79", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "1de0ecd007803dbd", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-803a3a6d86e5267a", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in scripts/fe_test.js:77"}, "properties": {"repobilityId": "342b1111448d6b30", "scanner": "scanner-primary", "fingerprint": "803a3a6d86e5267a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/fe_test.js"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-60939250642519ae", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/fe_test.js:5"}, "properties": {"repobilityId": "f3ea7fc5f2abe337", "scanner": "scanner-primary", "fingerprint": "60939250642519ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/fe_test.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-a6d4b7f32ef40a69", "level": "note", "message": {"text": "Very large file: council/net/store.py (1420 lines)"}, "properties": {"repobilityId": "b7866519a898e95d", "scanner": "scanner-primary", "fingerprint": "a6d4b7f32ef40a69", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d82647e91301ad22", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "cf6fb75bd911dd9e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "994c779a2c087460", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f157642fe68ad0c3", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-4bbc20ff4e0992b6", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/eval_currency_gap.py:214"}, "properties": {"repobilityId": "9f3fa7fbbd0e8124", "scanner": "scanner-primary", "fingerprint": "4bbc20ff4e0992b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-801d8d1cc5ed0a06", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 council/judge.py:116"}, "properties": {"repobilityId": "845b77a69bf8ed69", "scanner": "scanner-primary", "fingerprint": "801d8d1cc5ed0a06", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8441b269517be95b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 council/library.py:200"}, "properties": {"repobilityId": "2e73356d029bc82c", "scanner": "scanner-primary", "fingerprint": "8441b269517be95b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ea7dc158dd786ad2", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 council/worker.py:91"}, "properties": {"repobilityId": "5aa02236be15aec1", "scanner": "scanner-primary", "fingerprint": "ea7dc158dd786ad2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-51ddc42f0cb52d02", "level": "none", "message": {"text": "Commented-code block (5 lines) in council/researcher.py:214"}, "properties": {"repobilityId": "9d2c56155ef97bf7", "scanner": "scanner-primary", "fingerprint": "51ddc42f0cb52d02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-42f3a7793d0aa594", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 council/researcher.py:76"}, "properties": {"repobilityId": "9daa638db850e9d1", "scanner": "scanner-primary", "fingerprint": "42f3a7793d0aa594", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0957b35ee89056cb", "level": "none", "message": {"text": "Commented-code block (14 lines) in council/research.py:439"}, "properties": {"repobilityId": "1b708b716adf6260", "scanner": "scanner-primary", "fingerprint": "0957b35ee89056cb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-20e76e15df071b19", "level": "none", "message": {"text": "Commented-code block (5 lines) in council/sanitize.py:60"}, "properties": {"repobilityId": "295e79e5be38ec75", "scanner": "scanner-primary", "fingerprint": "20e76e15df071b19", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb6a7131ba1fc697", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 council/net/baseline.py:48"}, "properties": {"repobilityId": "3f2b57e3d3680a20", "scanner": "scanner-primary", "fingerprint": "cb6a7131ba1fc697", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8ff5e57089e61653", "level": "none", "message": {"text": "Commented-code block (6 lines) in council/net/store.py:1094"}, "properties": {"repobilityId": "a0adc703d4069294", "scanner": "scanner-primary", "fingerprint": "8ff5e57089e61653", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3ed1289efbf94158", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ab75cf9839ab4586", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d320f6a81a44888b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-888dc2aec1b02772", "level": "error", "message": {"text": "FastAPI POST `research` without auth dependency \u2014 council/serve.py:58"}, "properties": {"repobilityId": "f9fa70214f7ef0c1", "scanner": "scanner-primary", "fingerprint": "888dc2aec1b02772", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/serve.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-8ce0a80d384e86a2", "level": "error", "message": {"text": "FastAPI POST `heartbeat` without auth dependency \u2014 council/net/coordinator_app.py:213"}, "properties": {"repobilityId": "bd3732d8cb672830", "scanner": "scanner-primary", "fingerprint": "8ce0a80d384e86a2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-9c344248e0829910", "level": "error", "message": {"text": "FastAPI POST `task_result` without auth dependency \u2014 council/net/coordinator_app.py:231"}, "properties": {"repobilityId": "4634340b469ad0e6", "scanner": "scanner-primary", "fingerprint": "9c344248e0829910", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-29a834535e8f0354", "level": "error", "message": {"text": "FastAPI POST `task_progress` without auth dependency \u2014 council/net/coordinator_app.py:241"}, "properties": {"repobilityId": "202f40e02319b8d8", "scanner": "scanner-primary", "fingerprint": "29a834535e8f0354", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-86caf374c9263b0c", "level": "error", "message": {"text": "FastAPI POST `accept_assisted` without auth dependency \u2014 council/net/coordinator_app.py:263"}, "properties": {"repobilityId": "e88e823f6c0bf658", "scanner": "scanner-primary", "fingerprint": "86caf374c9263b0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-aeba9ec72170bf32", "level": "error", "message": {"text": "FastAPI POST `deliver_assisted` without auth dependency \u2014 council/net/coordinator_app.py:283"}, "properties": {"repobilityId": "c6ec01fc9a34f25a", "scanner": "scanner-primary", "fingerprint": "aeba9ec72170bf32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-67f56b138b8d7efc", "level": "error", "message": {"text": "FastAPI POST `put_blob` without auth dependency \u2014 council/net/coordinator_app.py:299"}, "properties": {"repobilityId": "56822ca2dd08364e", "scanner": "scanner-primary", "fingerprint": "67f56b138b8d7efc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-aae1138a18b61e70", "level": "error", "message": {"text": "FastAPI POST `rate_assisted` without auth dependency \u2014 council/net/coordinator_app.py:326"}, "properties": {"repobilityId": "44dd124d2c13892d", "scanner": "scanner-primary", "fingerprint": "aae1138a18b61e70", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 326}}}]}, {"ruleId": "scanner-97861e8fb81407d1", "level": "error", "message": {"text": "FastAPI POST `make_user` without auth dependency \u2014 council/net/coordinator_app.py:348"}, "properties": {"repobilityId": "1a99ef7c4ea5d6cb", "scanner": "scanner-primary", "fingerprint": "97861e8fb81407d1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-cdf941582275b170", "level": "error", "message": {"text": "FastAPI POST `admin_enroll` without auth dependency \u2014 council/net/coordinator_app.py:365"}, "properties": {"repobilityId": "962404b238f80689", "scanner": "scanner-primary", "fingerprint": "cdf941582275b170", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 365}}}]}, {"ruleId": "scanner-31801415fd66b8bb", "level": "error", "message": {"text": "FastAPI POST `submit_job` without auth dependency \u2014 council/net/coordinator_app.py:417"}, "properties": {"repobilityId": "ea0d1548473e545f", "scanner": "scanner-primary", "fingerprint": "31801415fd66b8bb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 417}}}]}, {"ruleId": "scanner-0137ae99fe57b3b7", "level": "error", "message": {"text": "FastAPI POST `feedback` without auth dependency \u2014 council/net/coordinator_app.py:449"}, "properties": {"repobilityId": "87b1bfd782da58c4", "scanner": "scanner-primary", "fingerprint": "0137ae99fe57b3b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "council/net/coordinator_app.py"}, "region": {"startLine": 449}}}]}, {"ruleId": "scanner-b83351671d71e04e", "level": "note", "message": {"text": "Unused endpoint: POST /research"}, "properties": {"repobilityId": "2ae9f02cddf11fc2", "scanner": "scanner-primary", "fingerprint": "b83351671d71e04e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cbe34a344b8d2f70", "level": "note", "message": {"text": "Unused endpoint: GET /progress/{job_id}"}, "properties": {"repobilityId": "1fea6afd66ffe293", "scanner": "scanner-primary", "fingerprint": "cbe34a344b8d2f70", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c124716a4436518b", "level": "note", "message": {"text": "Unused endpoint: GET /reports"}, "properties": {"repobilityId": "97b190d338e116aa", "scanner": "scanner-primary", "fingerprint": "c124716a4436518b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dc61345a86771817", "level": "note", "message": {"text": "Unused endpoint: GET /report/{name}"}, "properties": {"repobilityId": "35deb889a99fb496", "scanner": "scanner-primary", "fingerprint": "dc61345a86771817", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "8a3f1b35e6bd9dd0", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9f0f2932d9f52081", "level": "note", "message": {"text": "Unused endpoint: POST /nodes/register"}, "properties": {"repobilityId": "5384ea75439907fb", "scanner": "scanner-primary", "fingerprint": "9f0f2932d9f52081", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-518a7696cb424203", "level": "note", "message": {"text": "Unused endpoint: POST /nodes/heartbeat"}, "properties": {"repobilityId": "b4704afcf957bff4", "scanner": "scanner-primary", "fingerprint": "518a7696cb424203", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd955cb582813515", "level": "note", "message": {"text": "Unused endpoint: GET /tasks/next"}, "properties": {"repobilityId": "013eefacb3cad87f", "scanner": "scanner-primary", "fingerprint": "bd955cb582813515", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-404d50a23db2eaba", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/result"}, "properties": {"repobilityId": "396b392f5e02740d", "scanner": "scanner-primary", "fingerprint": "404d50a23db2eaba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f7a5ea7522e455d", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/progress"}, "properties": {"repobilityId": "f9a6ed5d82e19a94", "scanner": "scanner-primary", "fingerprint": "6f7a5ea7522e455d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b779871ea2d3e3a", "level": "note", "message": {"text": "Unused endpoint: GET /tasks/offers"}, "properties": {"repobilityId": "214bcd566ffef905", "scanner": "scanner-primary", "fingerprint": "5b779871ea2d3e3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1772a9ee393c179c", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/accept"}, "properties": {"repobilityId": "c4723104f8f849b5", "scanner": "scanner-primary", "fingerprint": "1772a9ee393c179c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76c90e12f4cf8f91", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/deliver"}, "properties": {"repobilityId": "a1ade91bd9b3f462", "scanner": "scanner-primary", "fingerprint": "76c90e12f4cf8f91", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-681a39259554d4e0", "level": "note", "message": {"text": "Unused endpoint: POST /jobs/{job_id}/blobs/{blob_hash}"}, "properties": {"repobilityId": "d386f28b1e6af63d", "scanner": "scanner-primary", "fingerprint": "681a39259554d4e0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0805db71dccb88c0", "level": "note", "message": {"text": "Unused endpoint: POST /jobs/{job_id}/rate"}, "properties": {"repobilityId": "f20f8ec80440ea04", "scanner": "scanner-primary", "fingerprint": "0805db71dccb88c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0abed6fb0cc0c60e", "level": "note", "message": {"text": "Unused endpoint: GET /jobs/{job_id}/blob/{blob_hash}"}, "properties": {"repobilityId": "57e20af7895deef0", "scanner": "scanner-primary", "fingerprint": "0abed6fb0cc0c60e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1bca8100a44f7f25", "level": "note", "message": {"text": "Unused endpoint: POST /users"}, "properties": {"repobilityId": "4e4497457de8d859", "scanner": "scanner-primary", "fingerprint": "1bca8100a44f7f25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce6d758d8479b115", "level": "note", "message": {"text": "Unused endpoint: POST /admin/enroll"}, "properties": {"repobilityId": "9d6d3e38d7375d8f", "scanner": "scanner-primary", "fingerprint": "ce6d758d8479b115", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "c34eb910ca56e800", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64168fd25819c254", "level": "note", "message": {"text": "Unused endpoint: GET /job-types"}, "properties": {"repobilityId": "b4d0a3a9b6f8744c", "scanner": "scanner-primary", "fingerprint": "64168fd25819c254", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b73face5b06aa67", "level": "note", "message": {"text": "Unused endpoint: POST /jobs"}, "properties": {"repobilityId": "7c03d1ecaa218b52", "scanner": "scanner-primary", "fingerprint": "2b73face5b06aa67", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-19fa0857993bfb51", "level": "note", "message": {"text": "Unused endpoint: GET /jobs/mine"}, "properties": {"repobilityId": "8a936e885af68c9f", "scanner": "scanner-primary", "fingerprint": "19fa0857993bfb51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee53a8b03729481e", "level": "note", "message": {"text": "Unused endpoint: GET /jobs/{job_id}"}, "properties": {"repobilityId": "74c9f8f2f2e484c1", "scanner": "scanner-primary", "fingerprint": "ee53a8b03729481e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e6f240e5f9c28960", "level": "note", "message": {"text": "Unused endpoint: POST /jobs/{job_id}/feedback"}, "properties": {"repobilityId": "e58df44287c92dfb", "scanner": "scanner-primary", "fingerprint": "e6f240e5f9c28960", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-add6dcb6007baef6", "level": "note", "message": {"text": "Unused endpoint: GET /leaderboard"}, "properties": {"repobilityId": "f4a5c9e61d29f269", "scanner": "scanner-primary", "fingerprint": "add6dcb6007baef6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d504b80adc9409ec", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard"}, "properties": {"repobilityId": "5f7eb4acce960747", "scanner": "scanner-primary", "fingerprint": "d504b80adc9409ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}