{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e4227044e6c62394", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad8d572a057475f3", "name": "Possibly dead Python function: handle_startendtag", "shortDescription": {"text": "Possibly dead Python function: handle_startendtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d3e2a649fd98345", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e28b339ee6939a3", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-303e9019d3e9ec2c", "name": "Possibly dead Python function: handle_startendtag", "shortDescription": {"text": "Possibly dead Python function: handle_startendtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5afb2b3263e37119", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d4c25c9a762f51f", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f010befdb4b4bada", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51821c5ff0bf3d5a", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f42c9fd72db0b10d", "name": "Possibly dead Python function: handle_startendtag", "shortDescription": {"text": "Possibly dead Python function: handle_startendtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a470dfc6af891e8", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a96bda59ef444bc", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-427d26c7afc0ab73", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-233cadd34f27b757", "name": "Possibly dead Python function: handle_startendtag", "shortDescription": {"text": "Possibly dead Python function: handle_startendtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af9787b507b5ab7a", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c44413c5408c945", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c65de54a9d9e76d", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f549650081a73531", "name": "Possibly dead Python function: handle_startendtag", "shortDescription": {"text": "Possibly dead Python function: handle_startendtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df7d1fd6b5a0454a", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03431640a3663f25", "name": "Possibly dead Python function: run_setup", "shortDescription": {"text": "Possibly dead Python function: run_setup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78341091d4c1a381", "name": "Possibly dead Python function: merge", "shortDescription": {"text": "Possibly dead Python function: merge"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1a7506d9fa0960e", "name": "Possibly dead Python function: is_gate", "shortDescription": {"text": "Possibly dead Python function: is_gate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d482281dd301ee44", "name": "Possibly dead Python function: create_suggestions", "shortDescription": {"text": "Possibly dead Python function: create_suggestions"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70b32da5650a3d2c", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acd9ab3c1084a410", "name": "Possibly dead Python function: translate_path", "shortDescription": {"text": "Possibly dead Python function: translate_path"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c852c3545f6f7264", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c25b2cf6a07e5b98", "name": "Stray `console.log` in TS/JS \u2014 cast-server/cast_server/static/htmx.min.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 cast-server/cast_server/static/htmx.min.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e539b5b6cd7bbdd2", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-121e7af4dfad0ce9", "name": "Privileged port 37 in use", "shortDescription": {"text": "Privileged port 37 in use"}, "fullDescription": {"text": "Port 37 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-051dde2575b5a04d", "name": "Privileged port 17 in use", "shortDescription": {"text": "Privileged port 17 in use"}, "fullDescription": {"text": "Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-868f05188e046fa6", "name": "Privileged port 47 in use", "shortDescription": {"text": "Privileged port 47 in use"}, "fullDescription": {"text": "Port 47 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2b19478021bc31e", "name": "Insecure pattern 'direct_innerhtml_assignment' in goals/refine-requirements-v2/prototype/render-demo.html:351", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in goals/refine-requirements-v2/prototype/render-demo.html:351"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6d07c38f462abe3", "name": "Insecure pattern 'new_function_used' in cast-server/cast_server/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'new_function_used' in cast-server/cast_server/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ad6807de932a57fa", "name": "Insecure pattern 'direct_innerhtml_assignment' in cast-server/cast_server/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in cast-server/cast_server/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-316739ec8a499437", "name": "Insecure pattern 'insert_adjacent_html' in cast-server/cast_server/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in cast-server/cast_server/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97ecc8da8141e474", "name": "Insecure pattern 'domparser_html_parse' in cast-server/cast_server/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in cast-server/cast_server/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-daa1996da0dfacc5", "name": "Insecure pattern 'weak_hash' in agents/cast-preso-review/README.md:90", "shortDescription": {"text": "Insecure pattern 'weak_hash' in agents/cast-preso-review/README.md:90"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db0ed511d1e0f743", "name": "Insecure pattern 'direct_innerhtml_assignment' in agents/cast-preso-review/static/review.js:57", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in agents/cast-preso-review/static/review.js:57"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-397ffb69fd282511", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f27e50fc1c36fdc5", "name": "Very large file: cast-server/tests/test_render_job_service.py (1198 lines)", "shortDescription": {"text": "Very large file: cast-server/tests/test_render_job_service.py (1198 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fd46ad19ce8ade6", "name": "Very large file: cast-server/tests/integration/test_child_delegation.py (2015 lines)", "shortDescription": {"text": "Very large file: cast-server/tests/integration/test_child_delegation.py (2015 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dac11ecd80d15ea", "name": "Very large file: cast-server/tests/ui/runner.py (1139 lines)", "shortDescription": {"text": "Very large file: cast-server/tests/ui/runner.py (1139 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f61745516610b2a", "name": "Very large file: cast-server/cast_server/requirements_render/maker_gate.py (1073 lines)", "shortDescription": {"text": "Very large file: cast-server/cast_server/requirements_render/maker_gate.py (1073 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee42b7275f1c71b6", "name": "Very large file: cast-server/cast_server/services/render_job_service.py (2437 lines)", "shortDescription": {"text": "Very large file: cast-server/cast_server/services/render_job_service.py (2437 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67fd0fbd59499c16", "name": "Very large file: cast-server/cast_server/services/agent_service.py (2881 lines)", "shortDescription": {"text": "Very large file: cast-server/cast_server/services/agent_service.py (2881 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 122 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da9b05c5e983ef9b", "name": "Agent authority lacks a verifier contract: skills/claude-code/cast-mvcs-compliance/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-mvcs-compliance/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcdd6358b3e8533f", "name": "Agent authority lacks a verifier contract: skills/claude-code/cast-python-best-practices/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-python-best-practices/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b5a13bbbf94d5c2", "name": "Agent authority lacks a verifier contract: skills/claude-code/cast-upgrade/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-upgrade/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fa7b0c51d44e846", "name": "Agent authority lacks a verifier contract: skills/claude-code/cast-docstring-best-practices/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-docstring-best-practices/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-028d16a5517ff10b", "name": "Legacy-named symbol `task_v2` in tests/test_us10_tshirt_estimates.py:62", "shortDescription": {"text": "Legacy-named symbol `task_v2` in tests/test_us10_tshirt_estimates.py:62"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d188ce985ebd4c2c", "name": "Legacy-named symbol `test_step3_dry_run_logs_copy` in tests/test_setup_flow.py:179", "shortDescription": {"text": "Legacy-named symbol `test_step3_dry_run_logs_copy` in tests/test_setup_flow.py:179"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52535f6d9d409848", "name": "Commented-code block (5 lines) in tests/test_phase1b_prompt_pins.py:67", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_phase1b_prompt_pins.py:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-32e4fd1995410164", "name": "Legacy-named symbol `parsed_old` in docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:", "shortDescription": {"text": "Legacy-named symbol `parsed_old` in docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:408"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-799771758d8ed59b", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_requirement_versions.py:23", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_requirement_versions.py:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fefcf455603bbde9", "name": "Commented-code block (5 lines) in cast-server/tests/test_requirements_renderer.py:426", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/tests/test_requirements_renderer.py:426"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c7789234f8e8fa68", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/eval_reanchor.py:56", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/eval_reanchor.py:56"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-419ab2d184f9b4f9", "name": "Legacy-named symbol `diff_v1_v2` in cast-server/tests/test_diff_render.py:6", "shortDescription": {"text": "Legacy-named symbol `diff_v1_v2` in cast-server/tests/test_diff_render.py:6"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dba30ba31784926f", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_diff_narration.py:37", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_diff_narration.py:37"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a9046e307e897f3", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_render_route_and_service.py:33", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_render_route_and_service.py:33"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb036a269cce90ad", "name": "Legacy-named symbol `parsed_v2` in cast-server/tests/eval_sc003_survival.py:305", "shortDescription": {"text": "Legacy-named symbol `parsed_v2` in cast-server/tests/eval_sc003_survival.py:305"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f25175467526af8d", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_requirements_parser.py:30", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_requirements_parser.py:30"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8dd3447c33c88a1", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_block_diff.py:27", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_block_diff.py:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7362ef898d54e1fe", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_fr007_readonly_guard.py:59", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_fr007_readonly_guard.py:59"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-752b02af0d3841f7", "name": "Legacy-named symbol `test_eval_imports_production_gate_not_a_copy` in cast-server/tests/test_eval_quality_gate.py:91", "shortDescription": {"text": "Legacy-named symbol `test_eval_imports_production_gate_not_a_copy` in cast-server/tests/test_eval_quality_gate.py:91"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-608ac834fadf1912", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_conflict_predicate.py:29", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_conflict_predicate.py:29"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1c3b167af4723b7", "name": "Commented-code block (5 lines) in cast-server/tests/ui/conftest.py:27", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/tests/ui/conftest.py:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6844c3e8e4eeacbe", "name": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/ui/runner.py:49", "shortDescription": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/ui/runner.py:49"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e64dd41ae42ea308", "name": "Commented-code block (5 lines) in cast-server/alembic/env.py:19", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/alembic/env.py:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-24071dc58063509f", "name": "Commented-code block (13 lines) in cast-server/cast_server/config.py:120", "shortDescription": {"text": "Commented-code block (13 lines) in cast-server/cast_server/config.py:120"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28aad60fc0565aad", "name": "Commented-code block (6 lines) in cast-server/cast_server/requirements_render/maker_gate.py:612", "shortDescription": {"text": "Commented-code block (6 lines) in cast-server/cast_server/requirements_render/maker_gate.py:612"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd5f6cca7446513c", "name": "Commented-code block (7 lines) in cast-server/cast_server/requirements_render/renderer.py:59", "shortDescription": {"text": "Commented-code block (7 lines) in cast-server/cast_server/requirements_render/renderer.py:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6fbbf896607f5123", "name": "Commented-code block (5 lines) in cast-server/cast_server/requirements_render/goal_card.py:46", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/cast_server/requirements_render/goal_card.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0dfbc7ec70e804c5", "name": "Commented-code block (7 lines) in cast-server/cast_server/static/requirements_comments.js:165", "shortDescription": {"text": "Commented-code block (7 lines) in cast-server/cast_server/static/requirements_comments.js:165"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3de236083e731e9a", "name": "Commented-code block (7 lines) in cast-server/cast_server/cli/hook_events.py:22", "shortDescription": {"text": "Commented-code block (7 lines) in cast-server/cast_server/cli/hook_events.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f61cf0dfaa9bc989", "name": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/dev_tools/precommit_tests.py:103", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/dev_tools/precommit_tests.py:103"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a509dcd8d5accc73", "name": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/bootstrap/setup_flow.py:149", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/bootstrap/setup_flow.py:149"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b5a8008d7bbb7df", "name": "Commented-code block (5 lines) in cast-server/cast_server/routes/pages.py:366", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/cast_server/routes/pages.py:366"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2885f665cedd3ce", "name": "Commented-code block (5 lines) in cast-server/cast_server/services/change_request_service.py:209", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/cast_server/services/change_request_service.py:209"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3cbeb583cca0d579", "name": "Commented-code block (5 lines) in cast-server/cast_server/services/requirements_render_service.py:41", "shortDescription": {"text": "Commented-code block (5 lines) in cast-server/cast_server/services/requirements_render_service.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd3f3f96ef872d0f", "name": "Commented-code block (6 lines) in cast-server/cast_server/services/render_job_service.py:912", "shortDescription": {"text": "Commented-code block (6 lines) in cast-server/cast_server/services/render_job_service.py:912"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87d042e0b0b7c5cd", "name": "Blocking `time.sleep(...)` inside `async def continue_agent_run` \u2014 cast-server/cast_server/services/agent_service.py:211", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def continue_agent_run` \u2014 cast-server/cast_server/services/agent_service.py:2118"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-49ff9ff8b205a36a", "name": "Blocking `time.sleep(...)` inside `async def _launch_agent` \u2014 cast-server/cast_server/services/agent_service.py:2320", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def _launch_agent` \u2014 cast-server/cast_server/services/agent_service.py:2320"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33188860395bd450", "name": "Blocking `time.sleep(...)` inside `async def _launch_agent` \u2014 cast-server/cast_server/services/agent_service.py:2375", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def _launch_agent` \u2014 cast-server/cast_server/services/agent_service.py:2375"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cead5b185a30a820", "name": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/infra/tmux_manager.py:197", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/infra/tmux_manager.py:197"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-146e8cf9d37c0a50", "name": "Commented-code block (5 lines) in agents/cast-preso-review/build.py:272", "shortDescription": {"text": "Commented-code block (5 lines) in agents/cast-preso-review/build.py:272"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-58d196643f8d297c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 agents/cast-preso-review/static/review.js:504", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 agents/cast-preso-review/static/review.js:504"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fd8356db3b8be19", "name": "Commented-code block (5 lines) in agents/cast-preso-review/renderers/_markdown.py:41", "shortDescription": {"text": "Commented-code block (5 lines) in agents/cast-preso-review/renderers/_markdown.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndocs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:handle_endtag, cast-server/cast_server/requirements_render/maker_gate.py:handle_endtag\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8abea284a124631", "name": "FastAPI POST `add_task` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:64", "shortDescription": {"text": "FastAPI POST `add_task` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:64"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a9aa1d22137b0545", "name": "FastAPI PUT `change_status` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:175", "shortDescription": {"text": "FastAPI PUT `change_status` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:175"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-20c6ee0b4a66298b", "name": "FastAPI PUT `mark_complete` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:227", "shortDescription": {"text": "FastAPI PUT `mark_complete` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:227"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7d994889bcdd10b0", "name": "FastAPI PUT `update_task_fields` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:311", "shortDescription": {"text": "FastAPI PUT `update_task_fields` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:311"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-367b7d11e2a54be6", "name": "FastAPI POST `run_agent_for_task` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:362", "shortDescription": {"text": "FastAPI POST `run_agent_for_task` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:362"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0897a2b8e6547a5b", "name": "FastAPI POST `create_change_request` without auth dependency \u2014 cast-server/cast_server/routes/change_requests.py:65", "shortDescription": {"text": "FastAPI POST `create_change_request` without auth dependency \u2014 cast-server/cast_server/routes/change_requests.py:65"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e0422ecfbba36f5", "name": "FastAPI POST `post_inbox` without auth dependency \u2014 cast-server/cast_server/routes/change_requests.py:147", "shortDescription": {"text": "FastAPI POST `post_inbox` without auth dependency \u2014 cast-server/cast_server/routes/change_requests.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-54caa4d0895da3d3", "name": "FastAPI POST `create_entry` without auth dependency \u2014 cast-server/cast_server/routes/api_scratchpad.py:24", "shortDescription": {"text": "FastAPI POST `create_entry` without auth dependency \u2014 cast-server/cast_server/routes/api_scratchpad.py:24"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ad805207d87ca841", "name": "FastAPI POST `create_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:143", "shortDescription": {"text": "FastAPI POST `create_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:143"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caa2153a61cb3140", "name": "FastAPI POST `resolve_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:183", "shortDescription": {"text": "FastAPI POST `resolve_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:183"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6147adc78d18028", "name": "FastAPI POST `reopen_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:197", "shortDescription": {"text": "FastAPI POST `reopen_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:197"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-660bccc06894a3a9", "name": "FastAPI POST `orphan_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:211", "shortDescription": {"text": "FastAPI POST `orphan_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:211"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e6376370e980a26", "name": "FastAPI POST `relocate_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:223", "shortDescription": {"text": "FastAPI POST `relocate_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:223"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0da51ea69cdd50da", "name": "FastAPI POST `create_version` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:284", "shortDescription": {"text": "FastAPI POST `create_version` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:284"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8947f98ad7b4d03b", "name": "FastAPI POST `post_narration` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:371", "shortDescription": {"text": "FastAPI POST `post_narration` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:371"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce15a0ff2e56c358", "name": "FastAPI POST `create_goal_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:90", "shortDescription": {"text": "FastAPI POST `create_goal_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:90"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f73ee2a56d6008b", "name": "FastAPI PUT `update_status` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:104", "shortDescription": {"text": "FastAPI PUT `update_status` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:104"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47365eabb28fdf26", "name": "FastAPI PUT `update_phase` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:147", "shortDescription": {"text": "FastAPI PUT `update_phase` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:147"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ad0274e1c3f72ed", "name": "FastAPI POST `route_goal` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:185", "shortDescription": {"text": "FastAPI POST `route_goal` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:185"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ab16555b26ed556", "name": "FastAPI PUT `update_focus` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:245", "shortDescription": {"text": "FastAPI PUT `update_focus` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:245"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a541d3a00b286e8c", "name": "FastAPI PATCH `update_goal_config` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:275", "shortDescription": {"text": "FastAPI PATCH `update_goal_config` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:275"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-250b77c4567de614", "name": "FastAPI POST `approve` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:446", "shortDescription": {"text": "FastAPI POST `approve` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:446"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-355a359b35a73bdc", "name": "FastAPI POST `decline` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:455", "shortDescription": {"text": "FastAPI POST `decline` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:455"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-58477b12edee103b", "name": "FastAPI PUT `save_artifact` without auth dependency \u2014 cast-server/cast_server/routes/api_artifacts.py:81", "shortDescription": {"text": "FastAPI PUT `save_artifact` without auth dependency \u2014 cast-server/cast_server/routes/api_artifacts.py:81"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6c57d600ac5d916", "name": "FastAPI POST `approve` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:21", "shortDescription": {"text": "FastAPI POST `approve` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27f786881c908e9d", "name": "FastAPI POST `decline` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:32", "shortDescription": {"text": "FastAPI POST `decline` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:32"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ccb045f8776f11b1", "name": "FastAPI POST `approve_group` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:41", "shortDescription": {"text": "FastAPI POST `approve_group` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:41"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-073d6d4d605ddd28", "name": "FastAPI POST `approve_parent` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:56", "shortDescription": {"text": "FastAPI POST `approve_parent` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:56"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6733626bd3ef6dcc", "name": "FastAPI POST `decline_group_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:7", "shortDescription": {"text": "FastAPI POST `decline_group_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:71"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-329967c3e092ed54", "name": "FastAPI POST `generate` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:80", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:80"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-690823b94c27804d", "name": "FastAPI POST `trigger_agent` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:88", "shortDescription": {"text": "FastAPI POST `trigger_agent` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:88"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9604eebb00ad8c3c", "name": "FastAPI POST `open_user_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:161", "shortDescription": {"text": "FastAPI POST `open_user_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:161"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e25fcc3d426d405d", "name": "FastAPI POST `complete_user_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:176", "shortDescription": {"text": "FastAPI POST `complete_user_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:176"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b004e46f2156c43", "name": "FastAPI POST `open_subagent_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:187", "shortDescription": {"text": "FastAPI POST `open_subagent_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:187"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-930657e7e836bcf9", "name": "FastAPI POST `complete_subagent_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:205", "shortDescription": {"text": "FastAPI POST `complete_subagent_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:205"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b139dab7b4eb940c", "name": "FastAPI POST `record_subagent_skill` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:216", "shortDescription": {"text": "FastAPI POST `record_subagent_skill` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:216"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d6d6773204958aa", "name": "FastAPI POST `recheck_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:284", "shortDescription": {"text": "FastAPI POST `recheck_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:284"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80afc6a7e3407b88", "name": "FastAPI POST `backfill_context_usage` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:318", "shortDescription": {"text": "FastAPI POST `backfill_context_usage` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:318"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0cebffe72faaa043", "name": "FastAPI POST `invoke_agent` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:365", "shortDescription": {"text": "FastAPI POST `invoke_agent` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:365"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22cb5792ab032d51", "name": "FastAPI POST `continue_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:380", "shortDescription": {"text": "FastAPI POST `continue_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:380"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-79f9b9e32d5e5acf", "name": "FastAPI POST `complete_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:390", "shortDescription": {"text": "FastAPI POST `complete_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:390"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1664481aa1618e6d", "name": "FastAPI POST `cancel_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:415", "shortDescription": {"text": "FastAPI POST `cancel_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:415"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a002443ff2f9f3ce", "name": "FastAPI DELETE `delete_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:433", "shortDescription": {"text": "FastAPI DELETE `delete_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:433"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a76f224fa5e3249", "name": "FastAPI POST `fail_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:445", "shortDescription": {"text": "FastAPI POST `fail_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:445"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-64fc070a9c2936a9", "name": "FastAPI POST `resolve_error_memory` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:455", "shortDescription": {"text": "FastAPI POST `resolve_error_memory` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:455"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b640f3771a0e748", "name": "Dangling fetch: POST /feedback (agents/cast-preso-review/static/review.js:504)", "shortDescription": {"text": "Dangling fetch: POST /feedback (agents/cast-preso-review/static/review.js:504)"}, "fullDescription": {"text": "`agents/cast-preso-review/static/review.js:504` calls `POST /feedback` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/feedback`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_health.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-988745aa2e856a1f", "name": "Unused endpoint: GET /goals/{slug}/tasks", "shortDescription": {"text": "Unused endpoint: GET /goals/{slug}/tasks"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `GET /goals/{slug}/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fa3862c821d1975", "name": "Unused endpoint: POST /goals/{slug}/tasks", "shortDescription": {"text": "Unused endpoint: POST /goals/{slug}/tasks"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `POST /goals/{slug}/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d639334023917d1c", "name": "Unused endpoint: PUT /tasks/{task_id}/status", "shortDescription": {"text": "Unused endpoint: PUT /tasks/{task_id}/status"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `PUT /tasks/{task_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b06441de864177d", "name": "Unused endpoint: PUT /tasks/{task_id}/complete", "shortDescription": {"text": "Unused endpoint: PUT /tasks/{task_id}/complete"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `PUT /tasks/{task_id}/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e30433c1fac6e869", "name": "Unused endpoint: GET /tasks/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /tasks/{task_id}"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `GET /tasks/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7d71cf388a6922e", "name": "Unused endpoint: GET /tasks/{task_id}/edit", "shortDescription": {"text": "Unused endpoint: GET /tasks/{task_id}/edit"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `GET /tasks/{task_id}/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-06138fdfa02bf80e", "name": "Unused endpoint: PUT /tasks/{task_id}", "shortDescription": {"text": "Unused endpoint: PUT /tasks/{task_id}"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `PUT /tasks/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-818bf1e917e6ff35", "name": "Unused endpoint: POST /tasks/{task_id}/run-agent", "shortDescription": {"text": "Unused endpoint: POST /tasks/{task_id}/run-agent"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_tasks.py` declares `POST /tasks/{task_id}/run-agent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75568d6b8eb49728", "name": "Unused endpoint: POST /change-requests", "shortDescription": {"text": "Unused endpoint: POST /change-requests"}, "fullDescription": {"text": "`cast-server/cast_server/routes/change_requests.py` declares `POST /change-requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d315efa0f1b0f8fb", "name": "Unused endpoint: GET /inbox", "shortDescription": {"text": "Unused endpoint: GET /inbox"}, "fullDescription": {"text": "`cast-server/cast_server/routes/change_requests.py` declares `GET /inbox` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1af1cf9559446a09", "name": "Unused endpoint: POST /inbox", "shortDescription": {"text": "Unused endpoint: POST /inbox"}, "fullDescription": {"text": "`cast-server/cast_server/routes/change_requests.py` declares `POST /inbox` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_scratchpad.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-429ac987f08d1c86", "name": "Unused endpoint: GET /comments", "shortDescription": {"text": "Unused endpoint: GET /comments"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `GET /comments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f45a153048d9870", "name": "Unused endpoint: POST /comments", "shortDescription": {"text": "Unused endpoint: POST /comments"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf4f0992c187443b", "name": "Unused endpoint: POST /comments/{comment_id}/resolve", "shortDescription": {"text": "Unused endpoint: POST /comments/{comment_id}/resolve"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/resolve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9054328a02caf15", "name": "Unused endpoint: POST /comments/{comment_id}/reopen", "shortDescription": {"text": "Unused endpoint: POST /comments/{comment_id}/reopen"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/reopen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d90732a12b85a1b6", "name": "Unused endpoint: POST /comments/{comment_id}/orphan", "shortDescription": {"text": "Unused endpoint: POST /comments/{comment_id}/orphan"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/orphan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b61b5a3ca1d082d", "name": "Unused endpoint: POST /comments/{comment_id}/relocate", "shortDescription": {"text": "Unused endpoint: POST /comments/{comment_id}/relocate"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `POST /comments/{comment_id}/relocate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fdc7447dc98123d", "name": "Unused endpoint: GET /changes", "shortDescription": {"text": "Unused endpoint: GET /changes"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_requirements.py` declares `GET /changes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d504b80adc9409ec", "name": "Unused endpoint: GET /dashboard", "shortDescription": {"text": "Unused endpoint: GET /dashboard"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f13ec8c7fc1fe52", "name": "Unused endpoint: GET /goals/{slug}", "shortDescription": {"text": "Unused endpoint: GET /goals/{slug}"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa80979f93b09b9b", "name": "Unused endpoint: GET /scratchpad", "shortDescription": {"text": "Unused endpoint: GET /scratchpad"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /scratchpad` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3be912c6187ea599", "name": "Unused endpoint: GET /runs", "shortDescription": {"text": "Unused endpoint: GET /runs"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3140e61d7cac5091", "name": "Unused endpoint: GET /agents", "shortDescription": {"text": "Unused endpoint: GET /agents"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66ced633faf594fe", "name": "Unused endpoint: GET /focus", "shortDescription": {"text": "Unused endpoint: GET /focus"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /focus` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-610dff8275175b9a", "name": "Unused endpoint: GET /preso/review/{goal_slug}", "shortDescription": {"text": "Unused endpoint: GET /preso/review/{goal_slug}"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /preso/review/{goal_slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-027e2f96294a4a9b", "name": "Unused endpoint: GET /goals/{slug}/render", "shortDescription": {"text": "Unused endpoint: GET /goals/{slug}/render"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}/render` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e368d44ad58fba1", "name": "Unused endpoint: GET /goals/{slug}/render/status", "shortDescription": {"text": "Unused endpoint: GET /goals/{slug}/render/status"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}/render/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01a47f393cd11ae8", "name": "Unused endpoint: GET /goals/{slug}/render/diff", "shortDescription": {"text": "Unused endpoint: GET /goals/{slug}/render/diff"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /goals/{slug}/render/diff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fff7d7c74ad81e4", "name": "Unused endpoint: GET /about", "shortDescription": {"text": "Unused endpoint: GET /about"}, "fullDescription": {"text": "`cast-server/cast_server/routes/pages.py` declares `GET /about` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2689c069fa1b20c6", "name": "Unused endpoint: PUT /{slug}/status", "shortDescription": {"text": "Unused endpoint: PUT /{slug}/status"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `PUT /{slug}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd924151b73ebe12", "name": "Unused endpoint: PUT /{slug}/phase", "shortDescription": {"text": "Unused endpoint: PUT /{slug}/phase"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `PUT /{slug}/phase` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2ac63247c6648b4", "name": "Unused endpoint: POST /{slug}/route", "shortDescription": {"text": "Unused endpoint: POST /{slug}/route"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `POST /{slug}/route` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7bad2c66e9f7a0c", "name": "Unused endpoint: PUT /{slug}/focus", "shortDescription": {"text": "Unused endpoint: PUT /{slug}/focus"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `PUT /{slug}/focus` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccb6d09aea5f5859", "name": "Unused endpoint: PATCH /{slug}/config", "shortDescription": {"text": "Unused endpoint: PATCH /{slug}/config"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `PATCH /{slug}/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1dde0f1847c837d", "name": "Unused endpoint: GET /{slug}/config/edit", "shortDescription": {"text": "Unused endpoint: GET /{slug}/config/edit"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `GET /{slug}/config/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-428906facdfe1731", "name": "Unused endpoint: GET /{slug}/config/view", "shortDescription": {"text": "Unused endpoint: GET /{slug}/config/view"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `GET /{slug}/config/view` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0dab903859366e93", "name": "Unused endpoint: GET /{slug}/tab/{phase}", "shortDescription": {"text": "Unused endpoint: GET /{slug}/tab/{phase}"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `GET /{slug}/tab/{phase}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-840ab824fcbed1f8", "name": "Unused endpoint: POST /suggestions/{suggestion_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /suggestions/{suggestion_id}/approve"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `POST /suggestions/{suggestion_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f64d45c14c0c07ba", "name": "Unused endpoint: POST /suggestions/{suggestion_id}/decline", "shortDescription": {"text": "Unused endpoint: POST /suggestions/{suggestion_id}/decline"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_goals.py` declares `POST /suggestions/{suggestion_id}/decline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9838537f519e109c", "name": "Unused endpoint: GET /edit", "shortDescription": {"text": "Unused endpoint: GET /edit"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_artifacts.py` declares `GET /edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-700adbeca0a13527", "name": "Unused endpoint: PUT /save", "shortDescription": {"text": "Unused endpoint: PUT /save"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_artifacts.py` declares `PUT /save` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-818430e88b3b4480", "name": "Unused endpoint: GET /artifact-sidebar", "shortDescription": {"text": "Unused endpoint: GET /artifact-sidebar"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_artifacts.py` declares `GET /artifact-sidebar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a75f5660fad363d", "name": "Unused endpoint: POST /{suggestion_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /{suggestion_id}/approve"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb7bd5cb45f32ee", "name": "Unused endpoint: POST /{suggestion_id}/decline", "shortDescription": {"text": "Unused endpoint: POST /{suggestion_id}/decline"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/decline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-193ac8bb421cdddd", "name": "Unused endpoint: POST /{suggestion_id}/approve-group", "shortDescription": {"text": "Unused endpoint: POST /{suggestion_id}/approve-group"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/approve-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41e81f00d4801846", "name": "Unused endpoint: POST /{suggestion_id}/approve-parent-only", "shortDescription": {"text": "Unused endpoint: POST /{suggestion_id}/approve-parent-only"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/approve-parent-only` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b5aa8d37ddad2dd", "name": "Unused endpoint: POST /{suggestion_id}/decline-group", "shortDescription": {"text": "Unused endpoint: POST /{suggestion_id}/decline-group"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /{suggestion_id}/decline-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-970eb92d6ec2bfaa", "name": "Unused endpoint: POST /generate", "shortDescription": {"text": "Unused endpoint: POST /generate"}, "fullDescription": {"text": "`cast-server/cast_server/routes/api_task_suggestions.py` declares `POST /generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20195"}, "properties": {"repository": "sridherj/diecast", "repoUrl": "https://github.com/sridherj/diecast", "branch": "main"}, "results": [{"ruleId": "scanner-e4227044e6c62394", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "e4227044e6c62394", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:229"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad8d572a057475f3", "level": "note", "message": {"text": "Possibly dead Python function: handle_startendtag"}, "properties": {"repobilityId": "259e69d47dc2412b", "scanner": "scanner-primary", "fingerprint": "ad8d572a057475f3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:235"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d3e2a649fd98345", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "4d3e2a649fd98345", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:238"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e28b339ee6939a3", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "5e28b339ee6939a3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:54"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-303e9019d3e9ec2c", "level": "note", "message": {"text": "Possibly dead Python function: handle_startendtag"}, "properties": {"repobilityId": "259e69d47dc2412b", "scanner": "scanner-primary", "fingerprint": "303e9019d3e9ec2c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5afb2b3263e37119", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "5afb2b3263e37119", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d4c25c9a762f51f", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "3d4c25c9a762f51f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/refine-requirements-better-rendering-v3/spikes/1b/spike_mark_placement.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f010befdb4b4bada", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "f010befdb4b4bada", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/alembic/versions/cfe1a46fdefc_baseline.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51821c5ff0bf3d5a", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "51821c5ff0bf3d5a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/zero_click.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f42c9fd72db0b10d", "level": "note", "message": {"text": "Possibly dead Python function: handle_startendtag"}, "properties": {"repobilityId": "259e69d47dc2412b", "scanner": "scanner-primary", "fingerprint": "f42c9fd72db0b10d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/zero_click.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a470dfc6af891e8", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "8a470dfc6af891e8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/zero_click.py:97"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a96bda59ef444bc", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "3a96bda59ef444bc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/zero_click.py:113"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-427d26c7afc0ab73", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "427d26c7afc0ab73", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/maker_gate.py:867"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-233cadd34f27b757", "level": "note", "message": {"text": "Possibly dead Python function: handle_startendtag"}, "properties": {"repobilityId": "259e69d47dc2412b", "scanner": "scanner-primary", "fingerprint": "233cadd34f27b757", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/maker_gate.py:870"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af9787b507b5ab7a", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "af9787b507b5ab7a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/maker_gate.py:227"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c44413c5408c945", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "0c44413c5408c945", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/maker_gate.py:233"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c65de54a9d9e76d", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "5c65de54a9d9e76d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/block_splice.py:164"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f549650081a73531", "level": "note", "message": {"text": "Possibly dead Python function: handle_startendtag"}, "properties": {"repobilityId": "259e69d47dc2412b", "scanner": "scanner-primary", "fingerprint": "f549650081a73531", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/block_splice.py:176"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df7d1fd6b5a0454a", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "df7d1fd6b5a0454a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/requirements_render/block_splice.py:180"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-03431640a3663f25", "level": "note", "message": {"text": "Possibly dead Python function: run_setup"}, "properties": {"repobilityId": "ae40d69546041fb3", "scanner": "scanner-primary", "fingerprint": "03431640a3663f25", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/bootstrap/setup_flow.py:762"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78341091d4c1a381", "level": "note", "message": {"text": "Possibly dead Python function: merge"}, "properties": {"repobilityId": "32fa242be480a996", "scanner": "scanner-primary", "fingerprint": "78341091d4c1a381", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/services/orchestration_service.py:38"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1a7506d9fa0960e", "level": "note", "message": {"text": "Possibly dead Python function: is_gate"}, "properties": {"repobilityId": "d24cb6994390875c", "scanner": "scanner-primary", "fingerprint": "b1a7506d9fa0960e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/services/orchestration_service.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d482281dd301ee44", "level": "note", "message": {"text": "Possibly dead Python function: create_suggestions"}, "properties": {"repobilityId": "94033b7ef7eb36c1", "scanner": "scanner-primary", "fingerprint": "d482281dd301ee44", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/services/suggestion_service.py:11"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70b32da5650a3d2c", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "70b32da5650a3d2c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/cast-preso-review/server.py:56"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-acd9ab3c1084a410", "level": "note", "message": {"text": "Possibly dead Python function: translate_path"}, "properties": {"repobilityId": "84ebe394cbed3b93", "scanner": "scanner-primary", "fingerprint": "acd9ab3c1084a410", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/cast-preso-review/server.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c852c3545f6f7264", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "c852c3545f6f7264", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/cast-preso-review/server.py:110"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c25b2cf6a07e5b98", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 cast-server/cast_server/static/htmx.min.js:1"}, "properties": {"repobilityId": "079b380a9284616b", "scanner": "scanner-primary", "fingerprint": "c25b2cf6a07e5b98", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e539b5b6cd7bbdd2", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "e539b5b6cd7bbdd2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/goal/revamp-diecast/goal.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-121e7af4dfad0ce9", "level": "warning", "message": {"text": "Privileged port 37 in use"}, "properties": {"repobilityId": "3bc0728a81a76695", "scanner": "scanner-primary", "fingerprint": "121e7af4dfad0ce9", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cast-delegation-e2e-nightly.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-051dde2575b5a04d", "level": "warning", "message": {"text": "Privileged port 17 in use"}, "properties": {"repobilityId": "0bf38fb8f89ec589", "scanner": "scanner-primary", "fingerprint": "051dde2575b5a04d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cast-delegation-e2e-nightly.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-868f05188e046fa6", "level": "warning", "message": {"text": "Privileged port 47 in use"}, "properties": {"repobilityId": "986e85543d70890d", "scanner": "scanner-primary", "fingerprint": "868f05188e046fa6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cast-delegation-e2e-nightly.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b2b19478021bc31e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in goals/refine-requirements-v2/prototype/render-demo.html:351"}, "properties": {"repobilityId": "a8f093d032f4655e", "scanner": "scanner-primary", "fingerprint": "b2b19478021bc31e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "goals/refine-requirements-v2/prototype/render-demo.html"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-c6d07c38f462abe3", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in cast-server/cast_server/static/htmx.min.js:1"}, "properties": {"repobilityId": "b24dedcb6677b1dc", "scanner": "scanner-primary", "fingerprint": "c6d07c38f462abe3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad6807de932a57fa", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in cast-server/cast_server/static/htmx.min.js:1"}, "properties": {"repobilityId": "220a68eac3cc6f0c", "scanner": "scanner-primary", "fingerprint": "ad6807de932a57fa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-316739ec8a499437", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in cast-server/cast_server/static/htmx.min.js:1"}, "properties": {"repobilityId": "fbbddc8b47d4314f", "scanner": "scanner-primary", "fingerprint": "316739ec8a499437", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97ecc8da8141e474", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in cast-server/cast_server/static/htmx.min.js:1"}, "properties": {"repobilityId": "be8c4430d2fd4ff0", "scanner": "scanner-primary", "fingerprint": "97ecc8da8141e474", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-daa1996da0dfacc5", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in agents/cast-preso-review/README.md:90"}, "properties": {"repobilityId": "acdbdba3ad47fb9b", "scanner": "scanner-primary", "fingerprint": "daa1996da0dfacc5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/cast-preso-review/README.md"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-db0ed511d1e0f743", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in agents/cast-preso-review/static/review.js:57"}, "properties": {"repobilityId": "fe3744f998a918cb", "scanner": "scanner-primary", "fingerprint": "db0ed511d1e0f743", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/cast-preso-review/static/review.js"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-397ffb69fd282511", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f267b6e006fe22e7", "scanner": "scanner-primary", "fingerprint": "397ffb69fd282511", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/audit.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-f27e50fc1c36fdc5", "level": "note", "message": {"text": "Very large file: cast-server/tests/test_render_job_service.py (1198 lines)"}, "properties": {"repobilityId": "8e0e58f96083bf0a", "scanner": "scanner-primary", "fingerprint": "f27e50fc1c36fdc5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0fd46ad19ce8ade6", "level": "note", "message": {"text": "Very large file: cast-server/tests/integration/test_child_delegation.py (2015 lines)"}, "properties": {"repobilityId": "968ac5c0aad598a0", "scanner": "scanner-primary", "fingerprint": "0fd46ad19ce8ade6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6dac11ecd80d15ea", "level": "note", "message": {"text": "Very large file: cast-server/tests/ui/runner.py (1139 lines)"}, "properties": {"repobilityId": "701c27dc95889fc6", "scanner": "scanner-primary", "fingerprint": "6dac11ecd80d15ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4f61745516610b2a", "level": "note", "message": {"text": "Very large file: cast-server/cast_server/requirements_render/maker_gate.py (1073 lines)"}, "properties": {"repobilityId": "b651c23f611042bb", "scanner": "scanner-primary", "fingerprint": "4f61745516610b2a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee42b7275f1c71b6", "level": "note", "message": {"text": "Very large file: cast-server/cast_server/services/render_job_service.py (2437 lines)"}, "properties": {"repobilityId": "1bfaace06d2eaa2e", "scanner": "scanner-primary", "fingerprint": "ee42b7275f1c71b6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-67fd0fbd59499c16", "level": "note", "message": {"text": "Very large file: cast-server/cast_server/services/agent_service.py (2881 lines)"}, "properties": {"repobilityId": "6725345be7f9c0f3", "scanner": "scanner-primary", "fingerprint": "67fd0fbd59499c16", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a46967aa89869a8f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4762aa6753f8b969", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7d89bb6eefefccd8", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3639a268db778d1e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-da9b05c5e983ef9b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-mvcs-compliance/SKILL.md"}, "properties": {"repobilityId": "dc08f29ee34fd501", "scanner": "scanner-primary", "fingerprint": "da9b05c5e983ef9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/claude-code/cast-mvcs-compliance/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fcdd6358b3e8533f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-python-best-practices/SKILL.md"}, "properties": {"repobilityId": "914f6df3cd961b22", "scanner": "scanner-primary", "fingerprint": "fcdd6358b3e8533f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/claude-code/cast-python-best-practices/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b5a13bbbf94d5c2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-upgrade/SKILL.md"}, "properties": {"repobilityId": "7fcf1359b2790fb9", "scanner": "scanner-primary", "fingerprint": "5b5a13bbbf94d5c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/claude-code/cast-upgrade/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fa7b0c51d44e846", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/claude-code/cast-docstring-best-practices/SKILL.md"}, "properties": {"repobilityId": "e52c0cf3702c2439", "scanner": "scanner-primary", "fingerprint": "6fa7b0c51d44e846", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/claude-code/cast-docstring-best-practices/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-028d16a5517ff10b", "level": "note", "message": {"text": "Legacy-named symbol `task_v2` in tests/test_us10_tshirt_estimates.py:62"}, "properties": {"repobilityId": "7e5f082a82aaa4dd", "scanner": "scanner-primary", "fingerprint": "028d16a5517ff10b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d188ce985ebd4c2c", "level": "note", "message": {"text": "Legacy-named symbol `test_step3_dry_run_logs_copy` in tests/test_setup_flow.py:179"}, "properties": {"repobilityId": "95f1a942ded6d57c", "scanner": "scanner-primary", "fingerprint": "d188ce985ebd4c2c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-52535f6d9d409848", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_phase1b_prompt_pins.py:67"}, "properties": {"repobilityId": "cea4f0734c8b1542", "scanner": "scanner-primary", "fingerprint": "52535f6d9d409848", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-32e4fd1995410164", "level": "note", "message": {"text": "Legacy-named symbol `parsed_old` in docs/goal/refine-requirements-better-rendering-v3/spikes/update-fidelity/harness.py:408"}, "properties": {"repobilityId": "864b2e019c993425", "scanner": "scanner-primary", "fingerprint": "32e4fd1995410164", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-799771758d8ed59b", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_requirement_versions.py:23"}, "properties": {"repobilityId": "dcb9e8f3b7c58e70", "scanner": "scanner-primary", "fingerprint": "799771758d8ed59b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fefcf455603bbde9", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/tests/test_requirements_renderer.py:426"}, "properties": {"repobilityId": "522a0c5874a07874", "scanner": "scanner-primary", "fingerprint": "fefcf455603bbde9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c7789234f8e8fa68", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/eval_reanchor.py:56"}, "properties": {"repobilityId": "7c7ec342924e4905", "scanner": "scanner-primary", "fingerprint": "c7789234f8e8fa68", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-419ab2d184f9b4f9", "level": "note", "message": {"text": "Legacy-named symbol `diff_v1_v2` in cast-server/tests/test_diff_render.py:6"}, "properties": {"repobilityId": "405f047845fa55bd", "scanner": "scanner-primary", "fingerprint": "419ab2d184f9b4f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dba30ba31784926f", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_diff_narration.py:37"}, "properties": {"repobilityId": "399ef16a70281876", "scanner": "scanner-primary", "fingerprint": "dba30ba31784926f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3a9046e307e897f3", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_render_route_and_service.py:33"}, "properties": {"repobilityId": "ec7d377d8fee7eb0", "scanner": "scanner-primary", "fingerprint": "3a9046e307e897f3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bb036a269cce90ad", "level": "note", "message": {"text": "Legacy-named symbol `parsed_v2` in cast-server/tests/eval_sc003_survival.py:305"}, "properties": {"repobilityId": "55532060cbd89921", "scanner": "scanner-primary", "fingerprint": "bb036a269cce90ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f25175467526af8d", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_requirements_parser.py:30"}, "properties": {"repobilityId": "9c1503c7803f8e6d", "scanner": "scanner-primary", "fingerprint": "f25175467526af8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e8dd3447c33c88a1", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_block_diff.py:27"}, "properties": {"repobilityId": "9ec17819837536b0", "scanner": "scanner-primary", "fingerprint": "e8dd3447c33c88a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7362ef898d54e1fe", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_fr007_readonly_guard.py:59"}, "properties": {"repobilityId": "49d36f9719c74767", "scanner": "scanner-primary", "fingerprint": "7362ef898d54e1fe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-752b02af0d3841f7", "level": "note", "message": {"text": "Legacy-named symbol `test_eval_imports_production_gate_not_a_copy` in cast-server/tests/test_eval_quality_gate.py:91"}, "properties": {"repobilityId": "d7a215a904dc2767", "scanner": "scanner-primary", "fingerprint": "752b02af0d3841f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-608ac834fadf1912", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/test_conflict_predicate.py:29"}, "properties": {"repobilityId": "99fd32940228d07f", "scanner": "scanner-primary", "fingerprint": "608ac834fadf1912", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c1c3b167af4723b7", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/tests/ui/conftest.py:27"}, "properties": {"repobilityId": "50762d87634129d0", "scanner": "scanner-primary", "fingerprint": "c1c3b167af4723b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6844c3e8e4eeacbe", "level": "note", "message": {"text": "Legacy-named symbol `refine_requirements_v2` in cast-server/tests/ui/runner.py:49"}, "properties": {"repobilityId": "40cb2bfaf28a9f5f", "scanner": "scanner-primary", "fingerprint": "6844c3e8e4eeacbe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e64dd41ae42ea308", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/alembic/env.py:19"}, "properties": {"repobilityId": "7cf4eac91557c8a9", "scanner": "scanner-primary", "fingerprint": "e64dd41ae42ea308", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-24071dc58063509f", "level": "none", "message": {"text": "Commented-code block (13 lines) in cast-server/cast_server/config.py:120"}, "properties": {"repobilityId": "22f96a07eaccfffc", "scanner": "scanner-primary", "fingerprint": "24071dc58063509f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28aad60fc0565aad", "level": "none", "message": {"text": "Commented-code block (6 lines) in cast-server/cast_server/requirements_render/maker_gate.py:612"}, "properties": {"repobilityId": "d7ee43103a2c852a", "scanner": "scanner-primary", "fingerprint": "28aad60fc0565aad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd5f6cca7446513c", "level": "none", "message": {"text": "Commented-code block (7 lines) in cast-server/cast_server/requirements_render/renderer.py:59"}, "properties": {"repobilityId": "8d89709e25e61640", "scanner": "scanner-primary", "fingerprint": "bd5f6cca7446513c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6fbbf896607f5123", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/cast_server/requirements_render/goal_card.py:46"}, "properties": {"repobilityId": "7eafabd7f30bee2f", "scanner": "scanner-primary", "fingerprint": "6fbbf896607f5123", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0dfbc7ec70e804c5", "level": "none", "message": {"text": "Commented-code block (7 lines) in cast-server/cast_server/static/requirements_comments.js:165"}, "properties": {"repobilityId": "0a5c75ce096cefbb", "scanner": "scanner-primary", "fingerprint": "0dfbc7ec70e804c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3de236083e731e9a", "level": "none", "message": {"text": "Commented-code block (7 lines) in cast-server/cast_server/cli/hook_events.py:22"}, "properties": {"repobilityId": "1a4fbbe57d268ef2", "scanner": "scanner-primary", "fingerprint": "3de236083e731e9a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f61cf0dfaa9bc989", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/dev_tools/precommit_tests.py:103"}, "properties": {"repobilityId": "c0633b3c2ca6fb4d", "scanner": "scanner-primary", "fingerprint": "f61cf0dfaa9bc989", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a509dcd8d5accc73", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/bootstrap/setup_flow.py:149"}, "properties": {"repobilityId": "6a438e1e76209673", "scanner": "scanner-primary", "fingerprint": "a509dcd8d5accc73", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4b5a8008d7bbb7df", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/cast_server/routes/pages.py:366"}, "properties": {"repobilityId": "d215adade065d79b", "scanner": "scanner-primary", "fingerprint": "4b5a8008d7bbb7df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2885f665cedd3ce", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/cast_server/services/change_request_service.py:209"}, "properties": {"repobilityId": "fd8e9e061a709322", "scanner": "scanner-primary", "fingerprint": "f2885f665cedd3ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3cbeb583cca0d579", "level": "none", "message": {"text": "Commented-code block (5 lines) in cast-server/cast_server/services/requirements_render_service.py:41"}, "properties": {"repobilityId": "6e2e0aad7242be2f", "scanner": "scanner-primary", "fingerprint": "3cbeb583cca0d579", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd3f3f96ef872d0f", "level": "none", "message": {"text": "Commented-code block (6 lines) in cast-server/cast_server/services/render_job_service.py:912"}, "properties": {"repobilityId": "c2964ffc78a80807", "scanner": "scanner-primary", "fingerprint": "dd3f3f96ef872d0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87d042e0b0b7c5cd", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def continue_agent_run` \u2014 cast-server/cast_server/services/agent_service.py:2118"}, "properties": {"repobilityId": "940249e20fb2e245", "scanner": "scanner-primary", "fingerprint": "87d042e0b0b7c5cd", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/services/agent_service.py"}, "region": {"startLine": 2118}}}]}, {"ruleId": "scanner-49ff9ff8b205a36a", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def _launch_agent` \u2014 cast-server/cast_server/services/agent_service.py:2320"}, "properties": {"repobilityId": "8d14e2d3395f0ffc", "scanner": "scanner-primary", "fingerprint": "49ff9ff8b205a36a", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/services/agent_service.py"}, "region": {"startLine": 2320}}}]}, {"ruleId": "scanner-33188860395bd450", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def _launch_agent` \u2014 cast-server/cast_server/services/agent_service.py:2375"}, "properties": {"repobilityId": "e332fc9188b211a0", "scanner": "scanner-primary", "fingerprint": "33188860395bd450", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/services/agent_service.py"}, "region": {"startLine": 2375}}}]}, {"ruleId": "scanner-cead5b185a30a820", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 cast-server/cast_server/infra/tmux_manager.py:197"}, "properties": {"repobilityId": "60b3a750a5048c72", "scanner": "scanner-primary", "fingerprint": "cead5b185a30a820", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-146e8cf9d37c0a50", "level": "none", "message": {"text": "Commented-code block (5 lines) in agents/cast-preso-review/build.py:272"}, "properties": {"repobilityId": "372e736603bd5913", "scanner": "scanner-primary", "fingerprint": "146e8cf9d37c0a50", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-58d196643f8d297c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 agents/cast-preso-review/static/review.js:504"}, "properties": {"repobilityId": "a86d8c1686c4b28d", "scanner": "scanner-primary", "fingerprint": "58d196643f8d297c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0fd8356db3b8be19", "level": "none", "message": {"text": "Commented-code block (5 lines) in agents/cast-preso-review/renderers/_markdown.py:41"}, "properties": {"repobilityId": "ddf8526e346674f1", "scanner": "scanner-primary", "fingerprint": "0fd8356db3b8be19", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "eaa33ab7cec24661", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e7120ec9c8f054f7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ed7ca331f907280e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1a8376ba0836cadc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "09cd6b11df7f715b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "29ca7ccdb303cb0a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "415fae263d2b17f3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "768c3e926e8ff149", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e8abea284a124631", "level": "error", "message": {"text": "FastAPI POST `add_task` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:64"}, "properties": {"repobilityId": "4c36ca60b0e320c7", "scanner": "scanner-primary", "fingerprint": "e8abea284a124631", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_tasks.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-a9aa1d22137b0545", "level": "error", "message": {"text": "FastAPI PUT `change_status` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:175"}, "properties": {"repobilityId": "b222f69c89757b10", "scanner": "scanner-primary", "fingerprint": "a9aa1d22137b0545", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_tasks.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-20c6ee0b4a66298b", "level": "error", "message": {"text": "FastAPI PUT `mark_complete` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:227"}, "properties": {"repobilityId": "97558b51ef646fd6", "scanner": "scanner-primary", "fingerprint": "20c6ee0b4a66298b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_tasks.py"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-7d994889bcdd10b0", "level": "error", "message": {"text": "FastAPI PUT `update_task_fields` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:311"}, "properties": {"repobilityId": "f65277b6f2744441", "scanner": "scanner-primary", "fingerprint": "7d994889bcdd10b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_tasks.py"}, "region": {"startLine": 311}}}]}, {"ruleId": "scanner-367b7d11e2a54be6", "level": "error", "message": {"text": "FastAPI POST `run_agent_for_task` without auth dependency \u2014 cast-server/cast_server/routes/api_tasks.py:362"}, "properties": {"repobilityId": "88cd97b372ef50da", "scanner": "scanner-primary", "fingerprint": "367b7d11e2a54be6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_tasks.py"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-0897a2b8e6547a5b", "level": "error", "message": {"text": "FastAPI POST `create_change_request` without auth dependency \u2014 cast-server/cast_server/routes/change_requests.py:65"}, "properties": {"repobilityId": "725b63f0bfe6061e", "scanner": "scanner-primary", "fingerprint": "0897a2b8e6547a5b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/change_requests.py"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-8e0422ecfbba36f5", "level": "error", "message": {"text": "FastAPI POST `post_inbox` without auth dependency \u2014 cast-server/cast_server/routes/change_requests.py:147"}, "properties": {"repobilityId": "c51c797dacce0841", "scanner": "scanner-primary", "fingerprint": "8e0422ecfbba36f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/change_requests.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-54caa4d0895da3d3", "level": "error", "message": {"text": "FastAPI POST `create_entry` without auth dependency \u2014 cast-server/cast_server/routes/api_scratchpad.py:24"}, "properties": {"repobilityId": "45a5193f4c9388ef", "scanner": "scanner-primary", "fingerprint": "54caa4d0895da3d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_scratchpad.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-ad805207d87ca841", "level": "error", "message": {"text": "FastAPI POST `create_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:143"}, "properties": {"repobilityId": "99db13a4f579aad0", "scanner": "scanner-primary", "fingerprint": "ad805207d87ca841", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-caa2153a61cb3140", "level": "error", "message": {"text": "FastAPI POST `resolve_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:183"}, "properties": {"repobilityId": "5683a367d2169fd0", "scanner": "scanner-primary", "fingerprint": "caa2153a61cb3140", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-d6147adc78d18028", "level": "error", "message": {"text": "FastAPI POST `reopen_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:197"}, "properties": {"repobilityId": "a1f3bce3dfc0688b", "scanner": "scanner-primary", "fingerprint": "d6147adc78d18028", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-660bccc06894a3a9", "level": "error", "message": {"text": "FastAPI POST `orphan_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:211"}, "properties": {"repobilityId": "37be6ec3d093c2ae", "scanner": "scanner-primary", "fingerprint": "660bccc06894a3a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-9e6376370e980a26", "level": "error", "message": {"text": "FastAPI POST `relocate_comment` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:223"}, "properties": {"repobilityId": "9de84965463f5de3", "scanner": "scanner-primary", "fingerprint": "9e6376370e980a26", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-0da51ea69cdd50da", "level": "error", "message": {"text": "FastAPI POST `create_version` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:284"}, "properties": {"repobilityId": "2eb08e4a63239537", "scanner": "scanner-primary", "fingerprint": "0da51ea69cdd50da", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-8947f98ad7b4d03b", "level": "error", "message": {"text": "FastAPI POST `post_narration` without auth dependency \u2014 cast-server/cast_server/routes/api_requirements.py:371"}, "properties": {"repobilityId": "66dfe11f0a152ae1", "scanner": "scanner-primary", "fingerprint": "8947f98ad7b4d03b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_requirements.py"}, "region": {"startLine": 371}}}]}, {"ruleId": "scanner-ce15a0ff2e56c358", "level": "error", "message": {"text": "FastAPI POST `create_goal_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:90"}, "properties": {"repobilityId": "54f1e69c9233354e", "scanner": "scanner-primary", "fingerprint": "ce15a0ff2e56c358", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-4f73ee2a56d6008b", "level": "error", "message": {"text": "FastAPI PUT `update_status` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:104"}, "properties": {"repobilityId": "391e920030f75a7b", "scanner": "scanner-primary", "fingerprint": "4f73ee2a56d6008b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-47365eabb28fdf26", "level": "error", "message": {"text": "FastAPI PUT `update_phase` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:147"}, "properties": {"repobilityId": "e6b4dfdadad13ef0", "scanner": "scanner-primary", "fingerprint": "47365eabb28fdf26", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-9ad0274e1c3f72ed", "level": "error", "message": {"text": "FastAPI POST `route_goal` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:185"}, "properties": {"repobilityId": "6b0590c94c68cef8", "scanner": "scanner-primary", "fingerprint": "9ad0274e1c3f72ed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-4ab16555b26ed556", "level": "error", "message": {"text": "FastAPI PUT `update_focus` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:245"}, "properties": {"repobilityId": "522ef40f2c8ae593", "scanner": "scanner-primary", "fingerprint": "4ab16555b26ed556", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-a541d3a00b286e8c", "level": "error", "message": {"text": "FastAPI PATCH `update_goal_config` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:275"}, "properties": {"repobilityId": "c08797e8c61d0ea0", "scanner": "scanner-primary", "fingerprint": "a541d3a00b286e8c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 275}}}]}, {"ruleId": "scanner-250b77c4567de614", "level": "error", "message": {"text": "FastAPI POST `approve` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:446"}, "properties": {"repobilityId": "6e2cb2c9173c2ca7", "scanner": "scanner-primary", "fingerprint": "250b77c4567de614", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 446}}}]}, {"ruleId": "scanner-355a359b35a73bdc", "level": "error", "message": {"text": "FastAPI POST `decline` without auth dependency \u2014 cast-server/cast_server/routes/api_goals.py:455"}, "properties": {"repobilityId": "6e8dfc4db531a4f5", "scanner": "scanner-primary", "fingerprint": "355a359b35a73bdc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_goals.py"}, "region": {"startLine": 455}}}]}, {"ruleId": "scanner-58477b12edee103b", "level": "error", "message": {"text": "FastAPI PUT `save_artifact` without auth dependency \u2014 cast-server/cast_server/routes/api_artifacts.py:81"}, "properties": {"repobilityId": "7ebed8be2c8f46f9", "scanner": "scanner-primary", "fingerprint": "58477b12edee103b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_artifacts.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-d6c57d600ac5d916", "level": "error", "message": {"text": "FastAPI POST `approve` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:21"}, "properties": {"repobilityId": "f67a19bdc7607429", "scanner": "scanner-primary", "fingerprint": "d6c57d600ac5d916", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_task_suggestions.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-27f786881c908e9d", "level": "error", "message": {"text": "FastAPI POST `decline` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:32"}, "properties": {"repobilityId": "e3cc5ffcdc0b2a3b", "scanner": "scanner-primary", "fingerprint": "27f786881c908e9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_task_suggestions.py"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-ccb045f8776f11b1", "level": "error", "message": {"text": "FastAPI POST `approve_group` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:41"}, "properties": {"repobilityId": "293ea25923a73c33", "scanner": "scanner-primary", "fingerprint": "ccb045f8776f11b1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_task_suggestions.py"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-073d6d4d605ddd28", "level": "error", "message": {"text": "FastAPI POST `approve_parent` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:56"}, "properties": {"repobilityId": "282a2b1cb477f8ef", "scanner": "scanner-primary", "fingerprint": "073d6d4d605ddd28", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_task_suggestions.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-6733626bd3ef6dcc", "level": "error", "message": {"text": "FastAPI POST `decline_group_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:71"}, "properties": {"repobilityId": "b676048614365e3b", "scanner": "scanner-primary", "fingerprint": "6733626bd3ef6dcc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_task_suggestions.py"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-329967c3e092ed54", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 cast-server/cast_server/routes/api_task_suggestions.py:80"}, "properties": {"repobilityId": "e3276bef906affb8", "scanner": "scanner-primary", "fingerprint": "329967c3e092ed54", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_task_suggestions.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-690823b94c27804d", "level": "error", "message": {"text": "FastAPI POST `trigger_agent` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:88"}, "properties": {"repobilityId": "aa5fd449c3b5b454", "scanner": "scanner-primary", "fingerprint": "690823b94c27804d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-9604eebb00ad8c3c", "level": "error", "message": {"text": "FastAPI POST `open_user_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:161"}, "properties": {"repobilityId": "5e7636bbd0d9252c", "scanner": "scanner-primary", "fingerprint": "9604eebb00ad8c3c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-e25fcc3d426d405d", "level": "error", "message": {"text": "FastAPI POST `complete_user_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:176"}, "properties": {"repobilityId": "2ebc081301210edf", "scanner": "scanner-primary", "fingerprint": "e25fcc3d426d405d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-1b004e46f2156c43", "level": "error", "message": {"text": "FastAPI POST `open_subagent_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:187"}, "properties": {"repobilityId": "c615bcaf375fe178", "scanner": "scanner-primary", "fingerprint": "1b004e46f2156c43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-930657e7e836bcf9", "level": "error", "message": {"text": "FastAPI POST `complete_subagent_invocation` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:205"}, "properties": {"repobilityId": "60cf44483776d444", "scanner": "scanner-primary", "fingerprint": "930657e7e836bcf9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-b139dab7b4eb940c", "level": "error", "message": {"text": "FastAPI POST `record_subagent_skill` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:216"}, "properties": {"repobilityId": "c576e0c9988370b6", "scanner": "scanner-primary", "fingerprint": "b139dab7b4eb940c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-2d6d6773204958aa", "level": "error", "message": {"text": "FastAPI POST `recheck_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:284"}, "properties": {"repobilityId": "fe1dbbe2560721d2", "scanner": "scanner-primary", "fingerprint": "2d6d6773204958aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-80afc6a7e3407b88", "level": "error", "message": {"text": "FastAPI POST `backfill_context_usage` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:318"}, "properties": {"repobilityId": "5470889b11ac4fa9", "scanner": "scanner-primary", "fingerprint": "80afc6a7e3407b88", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-0cebffe72faaa043", "level": "error", "message": {"text": "FastAPI POST `invoke_agent` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:365"}, "properties": {"repobilityId": "d5a8bbeb7aa858f9", "scanner": "scanner-primary", "fingerprint": "0cebffe72faaa043", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 365}}}]}, {"ruleId": "scanner-22cb5792ab032d51", "level": "error", "message": {"text": "FastAPI POST `continue_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:380"}, "properties": {"repobilityId": "6cd3c5b3109a494e", "scanner": "scanner-primary", "fingerprint": "22cb5792ab032d51", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 380}}}]}, {"ruleId": "scanner-79f9b9e32d5e5acf", "level": "error", "message": {"text": "FastAPI POST `complete_run` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:390"}, "properties": {"repobilityId": "3431969fccf4a629", "scanner": "scanner-primary", "fingerprint": "79f9b9e32d5e5acf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 390}}}]}, {"ruleId": "scanner-1664481aa1618e6d", "level": "error", "message": {"text": "FastAPI POST `cancel_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:415"}, "properties": {"repobilityId": "99ace6bb0707fc75", "scanner": "scanner-primary", "fingerprint": "1664481aa1618e6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 415}}}]}, {"ruleId": "scanner-a002443ff2f9f3ce", "level": "error", "message": {"text": "FastAPI DELETE `delete_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:433"}, "properties": {"repobilityId": "c41d7b2519141f52", "scanner": "scanner-primary", "fingerprint": "a002443ff2f9f3ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 433}}}]}, {"ruleId": "scanner-6a76f224fa5e3249", "level": "error", "message": {"text": "FastAPI POST `fail_run_endpoint` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:445"}, "properties": {"repobilityId": "d0698d9f98f5e30a", "scanner": "scanner-primary", "fingerprint": "6a76f224fa5e3249", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 445}}}]}, {"ruleId": "scanner-64fc070a9c2936a9", "level": "error", "message": {"text": "FastAPI POST `resolve_error_memory` without auth dependency \u2014 cast-server/cast_server/routes/api_agents.py:455"}, "properties": {"repobilityId": "90ebc233add6184a", "scanner": "scanner-primary", "fingerprint": "64fc070a9c2936a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cast-server/cast_server/routes/api_agents.py"}, "region": {"startLine": 455}}}]}, {"ruleId": "scanner-7b640f3771a0e748", "level": "error", "message": {"text": "Dangling fetch: POST /feedback (agents/cast-preso-review/static/review.js:504)"}, "properties": {"repobilityId": "f47455ad3dba31c4", "scanner": "scanner-primary", "fingerprint": "7b640f3771a0e748", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "f2fdafd2377d0d65", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-988745aa2e856a1f", "level": "note", "message": {"text": "Unused endpoint: GET /goals/{slug}/tasks"}, "properties": {"repobilityId": "0e0e8cda1ddbb3b7", "scanner": "scanner-primary", "fingerprint": "988745aa2e856a1f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fa3862c821d1975", "level": "note", "message": {"text": "Unused endpoint: POST /goals/{slug}/tasks"}, "properties": {"repobilityId": "61cb326076f42b09", "scanner": "scanner-primary", "fingerprint": "4fa3862c821d1975", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d639334023917d1c", "level": "note", "message": {"text": "Unused endpoint: PUT /tasks/{task_id}/status"}, "properties": {"repobilityId": "a2c5c992fdc3f051", "scanner": "scanner-primary", "fingerprint": "d639334023917d1c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b06441de864177d", "level": "note", "message": {"text": "Unused endpoint: PUT /tasks/{task_id}/complete"}, "properties": {"repobilityId": "0cf1c2f3c4092c06", "scanner": "scanner-primary", "fingerprint": "7b06441de864177d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e30433c1fac6e869", "level": "note", "message": {"text": "Unused endpoint: GET /tasks/{task_id}"}, "properties": {"repobilityId": "5e5a10cbef1cddbd", "scanner": "scanner-primary", "fingerprint": "e30433c1fac6e869", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7d71cf388a6922e", "level": "note", "message": {"text": "Unused endpoint: GET /tasks/{task_id}/edit"}, "properties": {"repobilityId": "4b38d9112aa93483", "scanner": "scanner-primary", "fingerprint": "d7d71cf388a6922e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-06138fdfa02bf80e", "level": "note", "message": {"text": "Unused endpoint: PUT /tasks/{task_id}"}, "properties": {"repobilityId": "4c39aeba33c01809", "scanner": "scanner-primary", "fingerprint": "06138fdfa02bf80e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-818bf1e917e6ff35", "level": "note", "message": {"text": "Unused endpoint: POST /tasks/{task_id}/run-agent"}, "properties": {"repobilityId": "7ed3794497ee0dd2", "scanner": "scanner-primary", "fingerprint": "818bf1e917e6ff35", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-75568d6b8eb49728", "level": "note", "message": {"text": "Unused endpoint: POST /change-requests"}, "properties": {"repobilityId": "06dad028ecee8b4b", "scanner": "scanner-primary", "fingerprint": "75568d6b8eb49728", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d315efa0f1b0f8fb", "level": "note", "message": {"text": "Unused endpoint: GET /inbox"}, "properties": {"repobilityId": "86fb09824a2ec54c", "scanner": "scanner-primary", "fingerprint": "d315efa0f1b0f8fb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1af1cf9559446a09", "level": "note", "message": {"text": "Unused endpoint: POST /inbox"}, "properties": {"repobilityId": "5c45595c20a40d00", "scanner": "scanner-primary", "fingerprint": "1af1cf9559446a09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "e66da05d929ce05e", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-429ac987f08d1c86", "level": "note", "message": {"text": "Unused endpoint: GET /comments"}, "properties": {"repobilityId": "8e412f64eb1716ed", "scanner": "scanner-primary", "fingerprint": "429ac987f08d1c86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f45a153048d9870", "level": "note", "message": {"text": "Unused endpoint: POST /comments"}, "properties": {"repobilityId": "dff27f212b7cfebe", "scanner": "scanner-primary", "fingerprint": "2f45a153048d9870", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf4f0992c187443b", "level": "note", "message": {"text": "Unused endpoint: POST /comments/{comment_id}/resolve"}, "properties": {"repobilityId": "d4c293171c41af5a", "scanner": "scanner-primary", "fingerprint": "cf4f0992c187443b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d9054328a02caf15", "level": "note", "message": {"text": "Unused endpoint: POST /comments/{comment_id}/reopen"}, "properties": {"repobilityId": "d483f5d9102c7f3d", "scanner": "scanner-primary", "fingerprint": "d9054328a02caf15", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d90732a12b85a1b6", "level": "note", "message": {"text": "Unused endpoint: POST /comments/{comment_id}/orphan"}, "properties": {"repobilityId": "d135d253bc98a2be", "scanner": "scanner-primary", "fingerprint": "d90732a12b85a1b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b61b5a3ca1d082d", "level": "note", "message": {"text": "Unused endpoint: POST /comments/{comment_id}/relocate"}, "properties": {"repobilityId": "fd8f0ee66759b936", "scanner": "scanner-primary", "fingerprint": "8b61b5a3ca1d082d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fdc7447dc98123d", "level": "note", "message": {"text": "Unused endpoint: GET /changes"}, "properties": {"repobilityId": "f50fb490c6750af2", "scanner": "scanner-primary", "fingerprint": "4fdc7447dc98123d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d504b80adc9409ec", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard"}, "properties": {"repobilityId": "fb49a92185ac4587", "scanner": "scanner-primary", "fingerprint": "d504b80adc9409ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f13ec8c7fc1fe52", "level": "note", "message": {"text": "Unused endpoint: GET /goals/{slug}"}, "properties": {"repobilityId": "f34c8775c9092df5", "scanner": "scanner-primary", "fingerprint": "2f13ec8c7fc1fe52", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aa80979f93b09b9b", "level": "note", "message": {"text": "Unused endpoint: GET /scratchpad"}, "properties": {"repobilityId": "43c5581cc65f971d", "scanner": "scanner-primary", "fingerprint": "aa80979f93b09b9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3be912c6187ea599", "level": "note", "message": {"text": "Unused endpoint: GET /runs"}, "properties": {"repobilityId": "713137a0ab792188", "scanner": "scanner-primary", "fingerprint": "3be912c6187ea599", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3140e61d7cac5091", "level": "note", "message": {"text": "Unused endpoint: GET /agents"}, "properties": {"repobilityId": "ea9b6a81894f4961", "scanner": "scanner-primary", "fingerprint": "3140e61d7cac5091", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-66ced633faf594fe", "level": "note", "message": {"text": "Unused endpoint: GET /focus"}, "properties": {"repobilityId": "4584891ef3a41168", "scanner": "scanner-primary", "fingerprint": "66ced633faf594fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-610dff8275175b9a", "level": "note", "message": {"text": "Unused endpoint: GET /preso/review/{goal_slug}"}, "properties": {"repobilityId": "3226c7290848555b", "scanner": "scanner-primary", "fingerprint": "610dff8275175b9a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-027e2f96294a4a9b", "level": "note", "message": {"text": "Unused endpoint: GET /goals/{slug}/render"}, "properties": {"repobilityId": "dbef1fb500bd8587", "scanner": "scanner-primary", "fingerprint": "027e2f96294a4a9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e368d44ad58fba1", "level": "note", "message": {"text": "Unused endpoint: GET /goals/{slug}/render/status"}, "properties": {"repobilityId": "bf7dcd6206d9640f", "scanner": "scanner-primary", "fingerprint": "8e368d44ad58fba1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01a47f393cd11ae8", "level": "note", "message": {"text": "Unused endpoint: GET /goals/{slug}/render/diff"}, "properties": {"repobilityId": "b82ddf44bf10a857", "scanner": "scanner-primary", "fingerprint": "01a47f393cd11ae8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fff7d7c74ad81e4", "level": "note", "message": {"text": "Unused endpoint: GET /about"}, "properties": {"repobilityId": "aee4ad84c93dd6a9", "scanner": "scanner-primary", "fingerprint": "5fff7d7c74ad81e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2689c069fa1b20c6", "level": "note", "message": {"text": "Unused endpoint: PUT /{slug}/status"}, "properties": {"repobilityId": "b03bf2baac3911fa", "scanner": "scanner-primary", "fingerprint": "2689c069fa1b20c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd924151b73ebe12", "level": "note", "message": {"text": "Unused endpoint: PUT /{slug}/phase"}, "properties": {"repobilityId": "7244565d34ba83a4", "scanner": "scanner-primary", "fingerprint": "fd924151b73ebe12", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2ac63247c6648b4", "level": "note", "message": {"text": "Unused endpoint: POST /{slug}/route"}, "properties": {"repobilityId": "f720555daa0b20ea", "scanner": "scanner-primary", "fingerprint": "b2ac63247c6648b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7bad2c66e9f7a0c", "level": "note", "message": {"text": "Unused endpoint: PUT /{slug}/focus"}, "properties": {"repobilityId": "34a55057e03c6d96", "scanner": "scanner-primary", "fingerprint": "f7bad2c66e9f7a0c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ccb6d09aea5f5859", "level": "note", "message": {"text": "Unused endpoint: PATCH /{slug}/config"}, "properties": {"repobilityId": "a62bbb019fe70dfa", "scanner": "scanner-primary", "fingerprint": "ccb6d09aea5f5859", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1dde0f1847c837d", "level": "note", "message": {"text": "Unused endpoint: GET /{slug}/config/edit"}, "properties": {"repobilityId": "2acb5e3395b7b622", "scanner": "scanner-primary", "fingerprint": "c1dde0f1847c837d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-428906facdfe1731", "level": "note", "message": {"text": "Unused endpoint: GET /{slug}/config/view"}, "properties": {"repobilityId": "e5acc0df665ccd9d", "scanner": "scanner-primary", "fingerprint": "428906facdfe1731", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0dab903859366e93", "level": "note", "message": {"text": "Unused endpoint: GET /{slug}/tab/{phase}"}, "properties": {"repobilityId": "e69542d19fcab73f", "scanner": "scanner-primary", "fingerprint": "0dab903859366e93", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-840ab824fcbed1f8", "level": "note", "message": {"text": "Unused endpoint: POST /suggestions/{suggestion_id}/approve"}, "properties": {"repobilityId": "5a0f39a7fd66d657", "scanner": "scanner-primary", "fingerprint": "840ab824fcbed1f8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f64d45c14c0c07ba", "level": "note", "message": {"text": "Unused endpoint: POST /suggestions/{suggestion_id}/decline"}, "properties": {"repobilityId": "2ef8b1b62011ccde", "scanner": "scanner-primary", "fingerprint": "f64d45c14c0c07ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9838537f519e109c", "level": "note", "message": {"text": "Unused endpoint: GET /edit"}, "properties": {"repobilityId": "fe0a61665d161c6f", "scanner": "scanner-primary", "fingerprint": "9838537f519e109c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-700adbeca0a13527", "level": "note", "message": {"text": "Unused endpoint: PUT /save"}, "properties": {"repobilityId": "3ae258694a20cf36", "scanner": "scanner-primary", "fingerprint": "700adbeca0a13527", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-818430e88b3b4480", "level": "note", "message": {"text": "Unused endpoint: GET /artifact-sidebar"}, "properties": {"repobilityId": "5d386d97abf54500", "scanner": "scanner-primary", "fingerprint": "818430e88b3b4480", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a75f5660fad363d", "level": "note", "message": {"text": "Unused endpoint: POST /{suggestion_id}/approve"}, "properties": {"repobilityId": "75ab1d18618c25be", "scanner": "scanner-primary", "fingerprint": "1a75f5660fad363d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eb7bd5cb45f32ee", "level": "note", "message": {"text": "Unused endpoint: POST /{suggestion_id}/decline"}, "properties": {"repobilityId": "f54e780e7cf70356", "scanner": "scanner-primary", "fingerprint": "6eb7bd5cb45f32ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-193ac8bb421cdddd", "level": "note", "message": {"text": "Unused endpoint: POST /{suggestion_id}/approve-group"}, "properties": {"repobilityId": "92635922b95769dc", "scanner": "scanner-primary", "fingerprint": "193ac8bb421cdddd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41e81f00d4801846", "level": "note", "message": {"text": "Unused endpoint: POST /{suggestion_id}/approve-parent-only"}, "properties": {"repobilityId": "83043483446e3dfd", "scanner": "scanner-primary", "fingerprint": "41e81f00d4801846", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b5aa8d37ddad2dd", "level": "note", "message": {"text": "Unused endpoint: POST /{suggestion_id}/decline-group"}, "properties": {"repobilityId": "a7908f4f78e4829d", "scanner": "scanner-primary", "fingerprint": "8b5aa8d37ddad2dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-970eb92d6ec2bfaa", "level": "note", "message": {"text": "Unused endpoint: POST /generate"}, "properties": {"repobilityId": "57682054856492d7", "scanner": "scanner-primary", "fingerprint": "970eb92d6ec2bfaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}