Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

sridherj/diecast

https://github.com/sridherj/diecast · scanned 2026-06-16 00:20 UTC (2 months, 2 weeks ago)

196 raw signals (0 security + 196 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 175 actionable findings from 1 signal source. 21 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
47.8
/100
Security checks
48
0 findings
System graph
48
88.9% cov · 175 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 50 Medium 19 Low 88 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 175 Crowd 0 Layer: Software 12 Frontend 2 Network 4 Security 52 Cicd 1 Quality 53 Api 51
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 47.8/100 with 88.9% coverage. It contains 4932 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 196 findings — concentrated in quality (60), security (52), api (51). Risk profile is high: 0 critical, 50 high, 19 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 157 of 175 actionable findings. 196 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def _launch_agent` — cast-server/cast_server/services/agent_service.py:2320
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
cast-server/cast_server/services/agent_service.py:2320 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def _launch_agent` — cast-server/cast_server/services/agent_service.py:2375
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
cast-server/cast_server/services/agent_service.py:2375 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def continue_agent_run` — cast-server/cast_server/services/agent_service.py:2118
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
cast-server/cast_server/services/agent_service.py:2118 Sync io in asyncPerformance
high System graph api Wiring conf 1.00 Dangling fetch: POST /feedback (agents/cast-preso-review/static/review.js:504)
`agents/cast-preso-review/static/review.js:504` calls `POST /feedback` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/feedback` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph security auth conf 1.00 FastAPI DELETE `delete_run_endpoint` without auth dependency — cast-server/cast_server/routes/api_agents.py:433
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:433 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_goal_config` without auth dependency — cast-server/cast_server/routes/api_goals.py:275
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:275 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `add_task` without auth dependency — cast-server/cast_server/routes/api_tasks.py:64
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_tasks.py:64 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `approve_group` without auth dependency — cast-server/cast_server/routes/api_task_suggestions.py:41
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_task_suggestions.py:41 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `approve_parent` without auth dependency — cast-server/cast_server/routes/api_task_suggestions.py:56
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_task_suggestions.py:56 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `approve` without auth dependency — cast-server/cast_server/routes/api_goals.py:446
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:446 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `approve` without auth dependency — cast-server/cast_server/routes/api_task_suggestions.py:21
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_task_suggestions.py:21 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `backfill_context_usage` without auth dependency — cast-server/cast_server/routes/api_agents.py:318
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:318 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `cancel_run_endpoint` without auth dependency — cast-server/cast_server/routes/api_agents.py:415
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:415 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `complete_run` without auth dependency — cast-server/cast_server/routes/api_agents.py:390
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:390 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `complete_subagent_invocation` without auth dependency — cast-server/cast_server/routes/api_agents.py:205
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:205 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `complete_user_invocation` without auth dependency — cast-server/cast_server/routes/api_agents.py:176
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:176 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `continue_run` without auth dependency — cast-server/cast_server/routes/api_agents.py:380
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:380 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_change_request` without auth dependency — cast-server/cast_server/routes/change_requests.py:65
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/change_requests.py:65 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_comment` without auth dependency — cast-server/cast_server/routes/api_requirements.py:143
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:143 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_entry` without auth dependency — cast-server/cast_server/routes/api_scratchpad.py:24
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_scratchpad.py:24 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_goal_endpoint` without auth dependency — cast-server/cast_server/routes/api_goals.py:90
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:90 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_version` without auth dependency — cast-server/cast_server/routes/api_requirements.py:284
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:284 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `decline_group_endpoint` without auth dependency — cast-server/cast_server/routes/api_task_suggestions.py:71
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_task_suggestions.py:71 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `decline` without auth dependency — cast-server/cast_server/routes/api_goals.py:455
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:455 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `decline` without auth dependency — cast-server/cast_server/routes/api_task_suggestions.py:32
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_task_suggestions.py:32 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `fail_run_endpoint` without auth dependency — cast-server/cast_server/routes/api_agents.py:445
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:445 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate` without auth dependency — cast-server/cast_server/routes/api_task_suggestions.py:80
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_task_suggestions.py:80 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `invoke_agent` without auth dependency — cast-server/cast_server/routes/api_agents.py:365
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:365 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `open_subagent_invocation` without auth dependency — cast-server/cast_server/routes/api_agents.py:187
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:187 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `open_user_invocation` without auth dependency — cast-server/cast_server/routes/api_agents.py:161
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:161 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `orphan_comment` without auth dependency — cast-server/cast_server/routes/api_requirements.py:211
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:211 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `post_inbox` without auth dependency — cast-server/cast_server/routes/change_requests.py:147
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/change_requests.py:147 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `post_narration` without auth dependency — cast-server/cast_server/routes/api_requirements.py:371
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:371 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `recheck_run` without auth dependency — cast-server/cast_server/routes/api_agents.py:284
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:284 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `record_subagent_skill` without auth dependency — cast-server/cast_server/routes/api_agents.py:216
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:216 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `relocate_comment` without auth dependency — cast-server/cast_server/routes/api_requirements.py:223
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:223 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `reopen_comment` without auth dependency — cast-server/cast_server/routes/api_requirements.py:197
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:197 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `resolve_comment` without auth dependency — cast-server/cast_server/routes/api_requirements.py:183
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_requirements.py:183 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `resolve_error_memory` without auth dependency — cast-server/cast_server/routes/api_agents.py:455
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:455 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `route_goal` without auth dependency — cast-server/cast_server/routes/api_goals.py:185
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:185 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `run_agent_for_task` without auth dependency — cast-server/cast_server/routes/api_tasks.py:362
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_tasks.py:362 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `trigger_agent` without auth dependency — cast-server/cast_server/routes/api_agents.py:88
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_agents.py:88 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `change_status` without auth dependency — cast-server/cast_server/routes/api_tasks.py:175
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_tasks.py:175 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `mark_complete` without auth dependency — cast-server/cast_server/routes/api_tasks.py:227
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_tasks.py:227 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `save_artifact` without auth dependency — cast-server/cast_server/routes/api_artifacts.py:81
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_artifacts.py:81 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_focus` without auth dependency — cast-server/cast_server/routes/api_goals.py:245
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:245 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_phase` without auth dependency — cast-server/cast_server/routes/api_goals.py:147
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:147 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_status` without auth dependency — cast-server/cast_server/routes/api_goals.py:104
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_goals.py:104 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_task_fields` without auth dependency — cast-server/cast_server/routes/api_tasks.py:311
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
cast-server/cast_server/routes/api_tasks.py:311 securityAuth fastapi unauth mutation
high System graph security security conf 1.00 Insecure pattern 'new_function_used' in cast-server/cast_server/static/htmx.min.js:1
Found a known-risky pattern (new_function_used). Review and replace if possible.
cast-server/cast_server/static/htmx.min.js:1 New function used
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — agents/cast-preso-review/static/review.js:504
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/claude-code/cast-docstring-best-practices/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/claude-code/cast-docstring-best-practices/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/claude-code/cast-mvcs-compliance/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/claude-code/cast-mvcs-compliance/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/claude-code/cast-python-best-practices/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/claude-code/cast-python-best-practices/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/claude-code/cast-upgrade/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/claude-code/cast-upgrade/SKILL.md VerificationSkill file
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in agents/cast-preso-review/static/review.js:57
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
agents/cast-preso-review/static/review.js:57 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in cast-server/cast_server/static/htmx.min.js:1
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
cast-server/cast_server/static/htmx.min.js:1 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in goals/refine-requirements-v2/prototype/render-demo.html:351
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
goals/refine-requirements-v2/prototype/render-demo.html:351 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in cast-server/cast_server/static/htmx.min.js:1
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
cast-server/cast_server/static/htmx.min.js:1 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'insert_adjacent_html' in cast-server/cast_server/static/htmx.min.js:1
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
cast-server/cast_server/static/htmx.min.js:1 Insert adjacent html
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in agents/cast-preso-review/README.md:90
Found a known-risky pattern (weak_hash). Review and replace if possible.
agents/cast-preso-review/README.md:90 Weak hash
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — cast-server/cast_server/bootstrap/setup_flow.py:149
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — cast-server/cast_server/dev_tools/precommit_tests.py:103
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — cast-server/cast_server/infra/tmux_manager.py:197
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph network Security conf 1.00 Privileged port 17 in use
Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
.github/workflows/cast-delegation-e2e-nightly.yml Ports
medium System graph network Security conf 1.00 Privileged port 30 in use
Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
docs/goal/revamp-diecast/goal.yaml Ports
medium System graph network Security conf 1.00 Privileged port 37 in use
Port 37 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
.github/workflows/cast-delegation-e2e-nightly.yml Ports
medium System graph network Security conf 1.00 Privileged port 47 in use
Port 47 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
.github/workflows/cast-delegation-e2e-nightly.yml Ports
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 122 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/audit.yml:29 CI/CD securitySupply chainGithub actions
low System graph quality Integrity conf 1.00 8 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:handle_endtag, cast-server/cast_server/requirements_render/maker_gate.py:handle_endtag This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — …
8 occurrences
repo-level (8 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `diff_v1_v2` in cast-server/tests/test_diff_render.py:6
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `parsed_old` in docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:408
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `parsed_v2` in cast-server/tests/eval_sc003_survival.py:305
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/eval_reanchor.py:56
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_block_diff.py:27
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_conflict_predicate.py:29
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_diff_narration.py:37
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_fr007_readonly_guard.py:59
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_render_route_and_service.py:33
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_requirement_versions.py:23
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/test_requirements_parser.py:30
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `refine_requirements_v2` in cast-server/tests/ui/runner.py:49
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `task_v2` in tests/test_us10_tshirt_estimates.py:62
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_eval_imports_production_gate_not_a_copy` in cast-server/tests/test_eval_quality_gate.py:91
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_step3_dry_run_logs_copy` in tests/test_setup_flow.py:179
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: create_suggestions
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
cast-server/cast_server/services/suggestion_service.py:11
low System graph software Dead code conf 1.00 Possibly dead Python function: do_POST
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
agents/cast-preso-review/server.py:56
low System graph software Dead code conf 1.00 Possibly dead Python function: downgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
cast-server/alembic/versions/cfe1a46fdefc_baseline.py:43
low System graph software Dead code conf 1.00 3 occurrences Possibly dead Python function: handle_data
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
3 files, 3 locations
cast-server/cast_server/requirements_render/maker_gate.py:233
cast-server/cast_server/requirements_render/zero_click.py:113
docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:70
low System graph software Dead code conf 1.00 5 occurrences Possibly dead Python function: handle_endtag
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
5 files, 5 locations
cast-server/cast_server/requirements_render/block_splice.py:180
cast-server/cast_server/requirements_render/maker_gate.py:227
cast-server/cast_server/requirements_render/zero_click.py:97
docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:64
docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:238
low System graph software Dead code conf 1.00 5 occurrences Possibly dead Python function: handle_startendtag
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
5 files, 5 locations
cast-server/cast_server/requirements_render/block_splice.py:176
cast-server/cast_server/requirements_render/maker_gate.py:870
cast-server/cast_server/requirements_render/zero_click.py:92
docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:60
docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:235
low System graph software Dead code conf 1.00 5 occurrences Possibly dead Python function: handle_starttag
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
5 files, 5 locations
cast-server/cast_server/requirements_render/block_splice.py:164
cast-server/cast_server/requirements_render/maker_gate.py:867
cast-server/cast_server/requirements_render/zero_click.py:79
docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:54
docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:229
low System graph software Dead code conf 1.00 Possibly dead Python function: is_gate
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
cast-server/cast_server/services/orchestration_service.py:46
low System graph software Dead code conf 1.00 Possibly dead Python function: log_message
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
agents/cast-preso-review/server.py:110
low System graph software Dead code conf 1.00 Possibly dead Python function: merge
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
cast-server/cast_server/services/orchestration_service.py:38
low System graph software Dead code conf 1.00 Possibly dead Python function: run_setup
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
cast-server/cast_server/bootstrap/setup_flow.py:762
low System graph software Dead code conf 1.00 Possibly dead Python function: translate_path
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
agents/cast-preso-review/server.py:98
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — cast-server/cast_server/static/htmx.min.js:1
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`cast-server/cast_server/routes/api_health.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /about
`cast-server/cast_server/routes/pages.py` declares `GET /about` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /agents
`cast-server/cast_server/routes/pages.py` declares `GET /agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /artifact-sidebar
`cast-server/cast_server/routes/api_artifacts.py` declares `GET /artifact-sidebar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /changes
`cast-server/cast_server/routes/api_requirements.py` declares `GET /changes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /comments
`cast-server/cast_server/routes/api_requirements.py` declares `GET /comments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /dashboard
`cast-server/cast_server/routes/pages.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /edit
`cast-server/cast_server/routes/api_artifacts.py` declares `GET /edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /focus
`cast-server/cast_server/routes/pages.py` declares `GET /focus` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /goals/{slug}
`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /goals/{slug}/render
`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}/render` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /goals/{slug}/render/diff
`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}/render/diff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /goals/{slug}/render/status
`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}/render/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /goals/{slug}/tasks
`cast-server/cast_server/routes/api_tasks.py` declares `GET /goals/{slug}/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /inbox
`cast-server/cast_server/routes/change_requests.py` declares `GET /inbox` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /preso/review/{goal_slug}
`cast-server/cast_server/routes/pages.py` declares `GET /preso/review/{goal_slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /runs
`cast-server/cast_server/routes/pages.py` declares `GET /runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /scratchpad
`cast-server/cast_server/routes/pages.py` declares `GET /scratchpad` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /tasks/{task_id}
`cast-server/cast_server/routes/api_tasks.py` declares `GET /tasks/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /tasks/{task_id}/edit
`cast-server/cast_server/routes/api_tasks.py` declares `GET /tasks/{task_id}/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{slug}/config/edit
`cast-server/cast_server/routes/api_goals.py` declares `GET /{slug}/config/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{slug}/config/view
`cast-server/cast_server/routes/api_goals.py` declares `GET /{slug}/config/view` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{slug}/tab/{phase}
`cast-server/cast_server/routes/api_goals.py` declares `GET /{slug}/tab/{phase}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{slug}/config
`cast-server/cast_server/routes/api_goals.py` declares `PATCH /{slug}/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /
`cast-server/cast_server/routes/api_scratchpad.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /change-requests
`cast-server/cast_server/routes/change_requests.py` declares `POST /change-requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /comments
`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /comments/{comment_id}/orphan
`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/orphan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /comments/{comment_id}/relocate
`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/relocate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or docume…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /comments/{comment_id}/reopen
`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/reopen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /comments/{comment_id}/resolve
`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/resolve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documen…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /generate
`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /goals/{slug}/tasks
`cast-server/cast_server/routes/api_tasks.py` declares `POST /goals/{slug}/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /inbox
`cast-server/cast_server/routes/change_requests.py` declares `POST /inbox` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /suggestions/{suggestion_id}/approve
`cast-server/cast_server/routes/api_goals.py` declares `POST /suggestions/{suggestion_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /suggestions/{suggestion_id}/decline
`cast-server/cast_server/routes/api_goals.py` declares `POST /suggestions/{suggestion_id}/decline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /tasks/{task_id}/run-agent
`cast-server/cast_server/routes/api_tasks.py` declares `POST /tasks/{task_id}/run-agent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{slug}/route
`cast-server/cast_server/routes/api_goals.py` declares `POST /{slug}/route` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{suggestion_id}/approve
`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenti…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{suggestion_id}/approve-group
`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/approve-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or doc…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{suggestion_id}/approve-parent-only
`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/approve-parent-only` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{suggestion_id}/decline
`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/decline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenti…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{suggestion_id}/decline-group
`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/decline-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or doc…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /save
`cast-server/cast_server/routes/api_artifacts.py` declares `PUT /save` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /tasks/{task_id}
`cast-server/cast_server/routes/api_tasks.py` declares `PUT /tasks/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /tasks/{task_id}/complete
`cast-server/cast_server/routes/api_tasks.py` declares `PUT /tasks/{task_id}/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /tasks/{task_id}/status
`cast-server/cast_server/routes/api_tasks.py` declares `PUT /tasks/{task_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /{slug}/focus
`cast-server/cast_server/routes/api_goals.py` declares `PUT /{slug}/focus` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /{slug}/phase
`cast-server/cast_server/routes/api_goals.py` declares `PUT /{slug}/phase` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /{slug}/status
`cast-server/cast_server/routes/api_goals.py` declares `PUT /{slug}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: cast-server/cast_server/requirements_render/maker_gate.py (1073 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: cast-server/cast_server/services/agent_service.py (2881 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: cast-server/cast_server/services/render_job_service.py (2437 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: cast-server/tests/integration/test_child_delegation.py (2015 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: cast-server/tests/test_render_job_service.py (1198 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: cast-server/tests/ui/runner.py (1139 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/da3f501e-2bde-44a1-b545-55fcbbd55e22/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/da3f501e-2bde-44a1-b545-55fcbbd55e22/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.