{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-dbecd3702fe170a4", "name": "Possibly dead Python function: list_change_requests", "shortDescription": {"text": "Possibly dead Python function: list_change_requests"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e6ad913a0b36dc0", "name": "Possibly dead Python function: reject_change_request", "shortDescription": {"text": "Possibly dead Python function: reject_change_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2305aded2736c5c", "name": "Possibly dead Python function: default_mcp_scopes", "shortDescription": {"text": "Possibly dead Python function: default_mcp_scopes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37612356b749bcc7", "name": "Possibly dead Python function: dependency", "shortDescription": {"text": "Possibly dead Python function: dependency"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab7251f57841a958", "name": "Possibly dead Python function: require_mcp_read", "shortDescription": {"text": "Possibly dead Python function: require_mcp_read"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba9c3ee3b707fb54", "name": "Possibly dead Python function: prometheus_metrics", "shortDescription": {"text": "Possibly dead Python function: prometheus_metrics"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f1fc0695e1c6c45", "name": "Possibly dead Python function: send_verification_email", "shortDescription": {"text": "Possibly dead Python function: send_verification_email"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77fae8b1192e6389", "name": "Possibly dead Python function: distance_from_current", "shortDescription": {"text": "Possibly dead Python function: distance_from_current"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff0ecc7c758f906b", "name": "Possibly dead Python function: make_user_id_from_subject", "shortDescription": {"text": "Possibly dead Python function: make_user_id_from_subject"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-688cba1eae8085ef", "name": "Possibly dead Python function: do_run_migrations", "shortDescription": {"text": "Possibly dead Python function: do_run_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ada44f6b11557997", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c66d2c45f6e2f906", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3ce9ae8a2ecb824", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/MapSearchBox.tsx:68", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/MapSearchBox.tsx:68"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3cabb9a65e5f77b", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/FeatureMapView.tsx:481", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/FeatureMapView.tsx:481"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a148d3cc7603ace0", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/MapView.tsx:265", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/MapView.tsx:265"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3dc1e8a13c9e72ff", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/notice-plans/NoticePlanShelf.tsx:143", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/notice-plans/NoticePlanShelf.tsx:143"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fb00214ff98f752c", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/notice-plans/NoticePlanCopyDialog.tsx:85", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/notice-plans/NoticePlanCopyDialog.tsx:85"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3873da8b5fb72013", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripShareLinks.tsx:118", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripShareLinks.tsx:118"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-549ff4b36cd61cfc", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripDetail.tsx:237", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripDetail.tsx:237"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae633c0c241f2ca2", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripAttachments.tsx:143", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripAttachments.tsx:143"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87103ce2322b02c0", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripPoiList.tsx:124", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripPoiList.tsx:124"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ab8f17d103bd739", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripDashboard.tsx:275", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripDashboard.tsx:275"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65881ef613a9f36d", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/SharedTripView.tsx:106", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/SharedTripView.tsx:106"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9980d9104825b19", "name": "Dockerfile runs as root: apps/api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c36b30587c620ebd", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7673561931a5dd33", "name": "Dockerfile runs as root: apps/web/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/web/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88e7ed79fae8010e", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-feb11bca66c37b39", "name": "Insecure pattern 'direct_innerhtml_assignment' in airbnb-marker-palette.html:532", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in airbnb-marker-palette.html:532"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73b22d23d303a3a0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffedab22286ba37f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e14a8ca6641ce534", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db7d3075d24c48f3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d5abecaf3592d03", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15f168072880d542", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "87 tests / 367 src (ratio 0.24)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14047004e0b8270b", "name": "Node manifest has dependencies but no lockfile: packages/schemas/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/schemas/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-002002f2508ee68a", "name": "Node manifest has dependencies but no lockfile: packages/hooks/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/hooks/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-892d4f964c9036e2", "name": "Node manifest has dependencies but no lockfile: packages/api-client/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/api-client/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93fcd5491cacc8cd", "name": "Node manifest has dependencies but no lockfile: packages/state/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/state/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98a1332ba54526ae", "name": "Node manifest has dependencies but no lockfile: packages/i18n/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/i18n/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bcfee846e2ec548b", "name": "Node manifest has dependencies but no lockfile: packages/design-tokens/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/design-tokens/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9acab6e258601a71", "name": "Node manifest has dependencies but no lockfile: packages/domain/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/domain/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0c2205560692580", "name": "Node manifest has dependencies but no lockfile: apps/mobile/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/mobile/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 6 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 45 placeholder/mock markers across 24 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd267cc638649d16", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api-client/src/client.ts:7", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api-client/src/client.ts:7"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ddf712cd79b556b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/domain/src/upload.ts:44", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/domain/src/upload.ts:44"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d4dc844b5edebf5", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/pr_review_monitor.py:45", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/pr_review_monitor.py:45"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d05354e9cdbc08b1", "name": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/app/clients/kor_travel_map.py:463", "shortDescription": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/app/clients/kor_travel_map.py:463"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71cc7707894ed3f0", "name": "Commented-code block (5 lines) in apps/api/app/core/deps.py:22", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/app/core/deps.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4a770c868c71da58", "name": "Legacy-named symbol `list_objects_v2` in apps/api/app/services/rustfs_admin.py:35", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in apps/api/app/services/rustfs_admin.py:35"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bb02b1bda2d87c6", "name": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/app/services/notice_plan.py:45", "shortDescription": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/app/services/notice_plan.py:45"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf8961e93fb1ffc2", "name": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/tests/unit/test_kor_travel_map_client.py:342", "shortDescription": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/tests/unit/test_kor_travel_map_client.py:342"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b76b07d01616b38", "name": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/tests/integration/test_admin_kor_travel_map_curated_import.py:2", "shortDescription": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/tests/integration/test_admin_kor_travel_map_curated_import.py:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e047ab7af03962f", "name": "7 env vars used in code but missing from .env.example", "shortDescription": {"text": "7 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APPDATA`, `CI`, `GH_BIN`, `GITHUB_REPOSITORY`, `NODE_ENV`, `PLAYWRIGHT_BASE_URL`, `PROMETHEUS_MULTIPROC_DIR`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napps/api/app/clients/kor_travel_map_admin.py:approve_change_request, apps/api/app/clients/kor_travel_map_admin.py:reject_change_request\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napps/api/app/middleware/rate_limit.py:hit, apps/api/app/middleware/rate_limit.py:hit, apps/api/app/middleware/rate_limit.py:hit\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-155adaedd6d13c18", "name": "FastAPI POST `create_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:91", "shortDescription": {"text": "FastAPI POST `create_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:91"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd9934b0c5de7333", "name": "FastAPI POST `verify_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:117", "shortDescription": {"text": "FastAPI POST `verify_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:117"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f116c78313bf967", "name": "FastAPI DELETE `delete_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:142", "shortDescription": {"text": "FastAPI DELETE `delete_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:142"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-294ac0b755e07bbe", "name": "FastAPI POST `copy_plan` without auth dependency \u2014 apps/api/app/api/v1/notice_plans.py:95", "shortDescription": {"text": "FastAPI POST `copy_plan` without auth dependency \u2014 apps/api/app/api/v1/notice_plans.py:95"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbced1ceb3a6e437", "name": "FastAPI POST `create_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:82", "shortDescription": {"text": "FastAPI POST `create_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:82"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-627830576ddb2034", "name": "FastAPI PATCH `update_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:130", "shortDescription": {"text": "FastAPI PATCH `update_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:130"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ecf46136c99401f", "name": "FastAPI DELETE `delete_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:174", "shortDescription": {"text": "FastAPI DELETE `delete_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:174"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-270744bdd73124cb", "name": "FastAPI POST `reorder_pois_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:198", "shortDescription": {"text": "FastAPI POST `reorder_pois_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:198"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df239fb48c207074", "name": "FastAPI POST `request_feature` without auth dependency \u2014 apps/api/app/api/v1/features.py:498", "shortDescription": {"text": "FastAPI POST `request_feature` without auth dependency \u2014 apps/api/app/api/v1/features.py:498"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90c1cd4c58ab1453", "name": "FastAPI POST `link_trip_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/trip_telegram_targets.py:58", "shortDescription": {"text": "FastAPI POST `link_trip_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/trip_telegram_targets.py:58"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06e3f11995b47374", "name": "FastAPI DELETE `unlink_trip_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/trip_telegram_targets.py:92", "shortDescription": {"text": "FastAPI DELETE `unlink_trip_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/trip_telegram_targets.py:92"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2a3170bd6105bf2", "name": "FastAPI POST `verify_email_endpoint` without auth dependency \u2014 apps/api/app/api/v1/auth.py:179", "shortDescription": {"text": "FastAPI POST `verify_email_endpoint` without auth dependency \u2014 apps/api/app/api/v1/auth.py:179"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0306c3d01f76d431", "name": "FastAPI POST `password_reset_request` without auth dependency \u2014 apps/api/app/api/v1/auth.py:201", "shortDescription": {"text": "FastAPI POST `password_reset_request` without auth dependency \u2014 apps/api/app/api/v1/auth.py:201"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8776f77e6e104baf", "name": "FastAPI POST `password_reset` without auth dependency \u2014 apps/api/app/api/v1/auth.py:213", "shortDescription": {"text": "FastAPI POST `password_reset` without auth dependency \u2014 apps/api/app/api/v1/auth.py:213"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3f2f4c97eeb6b19", "name": "FastAPI POST `refresh_session` without auth dependency \u2014 apps/api/app/api/v1/auth.py:260", "shortDescription": {"text": "FastAPI POST `refresh_session` without auth dependency \u2014 apps/api/app/api/v1/auth.py:260"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9625ac6962205a19", "name": "FastAPI POST `complete_profile` without auth dependency \u2014 apps/api/app/api/v1/users.py:57", "shortDescription": {"text": "FastAPI POST `complete_profile` without auth dependency \u2014 apps/api/app/api/v1/users.py:57"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2b68d49ac70c3f0f", "name": "FastAPI PUT `put_consents` without auth dependency \u2014 apps/api/app/api/v1/users.py:93", "shortDescription": {"text": "FastAPI PUT `put_consents` without auth dependency \u2014 apps/api/app/api/v1/users.py:93"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-456660fecd37028e", "name": "FastAPI DELETE `delete_consent` without auth dependency \u2014 apps/api/app/api/v1/users.py:104", "shortDescription": {"text": "FastAPI DELETE `delete_consent` without auth dependency \u2014 apps/api/app/api/v1/users.py:104"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27f96e6fa0e41602", "name": "FastAPI POST `issue_mcp_token_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:147", "shortDescription": {"text": "FastAPI POST `issue_mcp_token_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8edc5eeaa3a6f56", "name": "FastAPI DELETE `revoke_mcp_token_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:166", "shortDescription": {"text": "FastAPI DELETE `revoke_mcp_token_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:166"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c9600ee3e18ca496", "name": "FastAPI POST `withdraw_consent_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:182", "shortDescription": {"text": "FastAPI POST `withdraw_consent_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:182"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbf40849c11afa1f", "name": "FastAPI POST `google_start` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:99", "shortDescription": {"text": "FastAPI POST `google_start` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:99"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-729241d477e065da", "name": "FastAPI POST `google_link` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:122", "shortDescription": {"text": "FastAPI POST `google_link` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:122"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-991b500517737345", "name": "FastAPI DELETE `unlink_google` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:214", "shortDescription": {"text": "FastAPI DELETE `unlink_google` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:214"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e943b08686e6931d", "name": "FastAPI POST `create_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:307", "shortDescription": {"text": "FastAPI POST `create_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:307"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-180ea59084b5802d", "name": "FastAPI PATCH `update_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:377", "shortDescription": {"text": "FastAPI PATCH `update_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:377"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c47ad942954e9ea", "name": "FastAPI DELETE `delete_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:415", "shortDescription": {"text": "FastAPI DELETE `delete_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:415"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06b6a3c55e1a65ef", "name": "FastAPI POST `copy_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:448", "shortDescription": {"text": "FastAPI POST `copy_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:448"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3b479d8e1746cc2", "name": "FastAPI POST `create_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:498", "shortDescription": {"text": "FastAPI POST `create_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:498"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a3ce35df9d15be8b", "name": "FastAPI PATCH `update_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:537", "shortDescription": {"text": "FastAPI PATCH `update_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:537"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-102f54ddcd68bb18", "name": "FastAPI DELETE `delete_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:571", "shortDescription": {"text": "FastAPI DELETE `delete_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:571"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a2fd6f0aaad32df", "name": "FastAPI POST `create_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:646", "shortDescription": {"text": "FastAPI POST `create_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:646"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-505b0232cdbe8ed4", "name": "FastAPI PATCH `update_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:677", "shortDescription": {"text": "FastAPI PATCH `update_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:677"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b7f33f9b444c08bc", "name": "FastAPI DELETE `delete_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:706", "shortDescription": {"text": "FastAPI DELETE `delete_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:706"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b9d1275d43bba3a", "name": "FastAPI POST `create_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:782", "shortDescription": {"text": "FastAPI POST `create_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:782"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6672d51cf737119c", "name": "FastAPI PATCH `update_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:820", "shortDescription": {"text": "FastAPI PATCH `update_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:820"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01d5e743a6818ee4", "name": "FastAPI DELETE `delete_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:852", "shortDescription": {"text": "FastAPI DELETE `delete_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:852"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97da331cd29a811c", "name": "FastAPI POST `optimize_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:934", "shortDescription": {"text": "FastAPI POST `optimize_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:934"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee4909805a8acde5", "name": "FastAPI POST `invite_trip_member` without auth dependency \u2014 apps/api/app/api/v1/trips.py:991", "shortDescription": {"text": "FastAPI POST `invite_trip_member` without auth dependency \u2014 apps/api/app/api/v1/trips.py:991"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-667c4f19e94fd28e", "name": "FastAPI DELETE `remove_trip_member` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1042", "shortDescription": {"text": "FastAPI DELETE `remove_trip_member` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1042"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-535552d7320f585b", "name": "FastAPI POST `create_trip_comment` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1084", "shortDescription": {"text": "FastAPI POST `create_trip_comment` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1084"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-950df01bc3636469", "name": "FastAPI DELETE `delete_trip_comment` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1119", "shortDescription": {"text": "FastAPI DELETE `delete_trip_comment` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1119"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea38d613330161e5", "name": "FastAPI POST `create_share_token` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1148", "shortDescription": {"text": "FastAPI POST `create_share_token` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1148"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35f506af6eeaf14f", "name": "FastAPI DELETE `revoke_share_token` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1191", "shortDescription": {"text": "FastAPI DELETE `revoke_share_token` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1191"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52a0b2c9f1606da6", "name": "FastAPI POST `upload_urls` without auth dependency \u2014 apps/api/app/api/v1/storage.py:24", "shortDescription": {"text": "FastAPI POST `upload_urls` without auth dependency \u2014 apps/api/app/api/v1/storage.py:24"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f99ca4e495fd359", "name": "FastAPI POST `import_kor_travel_map_curated_feature_route` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_pl", "shortDescription": {"text": "FastAPI POST `import_kor_travel_map_curated_feature_route` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-458bd6243f6abd41", "name": "FastAPI POST `create_plan_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:243", "shortDescription": {"text": "FastAPI POST `create_plan_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:243"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c0eee828537ee785", "name": "FastAPI DELETE `delete_plan_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:284", "shortDescription": {"text": "FastAPI DELETE `delete_plan_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:284"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23b515c6a2f606c9", "name": "FastAPI POST `create_poi_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:330", "shortDescription": {"text": "FastAPI POST `create_poi_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:330"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28671d8463bb9f07", "name": "FastAPI DELETE `delete_poi_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:372", "shortDescription": {"text": "FastAPI DELETE `delete_poi_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:372"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-284063ace17433b6", "name": "FastAPI POST `resend_webhook` without auth dependency \u2014 apps/api/app/webhooks/resend.py:116", "shortDescription": {"text": "FastAPI POST `resend_webhook` without auth dependency \u2014 apps/api/app/webhooks/resend.py:116"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6d1bf11f5e4635b", "name": "Dangling fetch: GET /features/in-bounds?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:38)", "shortDescription": {"text": "Dangling fetch: GET /features/in-bounds?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:38)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:38` calls `GET /features/in-bounds?${qs.toString()}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/in-bounds`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e86e1c9db83075f2", "name": "Dangling fetch: GET /features/nearby?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:60)", "shortDescription": {"text": "Dangling fetch: GET /features/nearby?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:60)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:60` calls `GET /features/nearby?${qs.toString()}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/nearby`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-578b154069439204", "name": "Dangling fetch: GET /features/search?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:80)", "shortDescription": {"text": "Dangling fetch: GET /features/search?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:80)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:80` calls `GET /features/search?${qs.toString()}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/search`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f5f10182331b3b5f", "name": "Dangling fetch: GET /features/${featureId} (packages/api-client/src/endpoints/feature.ts:88)", "shortDescription": {"text": "Dangling fetch: GET /features/${featureId} (packages/api-client/src/endpoints/feature.ts:88)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:88` calls `GET /features/${featureId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e43c8718a4f1cfe", "name": "Dangling fetch: GET /features/${featureId}/weather (packages/api-client/src/endpoints/feature.ts:95)", "shortDescription": {"text": "Dangling fetch: GET /features/${featureId}/weather (packages/api-client/src/endpoints/feature.ts:95)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:95` calls `GET /features/${featureId}/weather` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/<p>/weather`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85fd3c1c86acd88e", "name": "Dangling fetch: POST /features/requests (packages/api-client/src/endpoints/feature.ts:110)", "shortDescription": {"text": "Dangling fetch: POST /features/requests (packages/api-client/src/endpoints/feature.ts:110)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:110` calls `POST /features/requests` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/requests`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b626d2b3c6cba05", "name": "Dangling fetch: GET /features/requests/${requestId} (packages/api-client/src/endpoints/feature.ts:118)", "shortDescription": {"text": "Dangling fetch: GET /features/requests/${requestId} (packages/api-client/src/endpoints/feature.ts:118)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/feature.ts:118` calls `GET /features/requests/${requestId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/features/requests/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aff25a7891fd710d", "name": "Dangling fetch: POST /trips/${tripId}/pois (packages/api-client/src/endpoints/pois.ts:14)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/pois (packages/api-client/src/endpoints/pois.ts:14)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/pois.ts:14` calls `POST /trips/${tripId}/pois` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/pois`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6752893087fafb47", "name": "Dangling fetch: PATCH /trips/${tripId}/pois/${poiId} (packages/api-client/src/endpoints/pois.ts:21)", "shortDescription": {"text": "Dangling fetch: PATCH /trips/${tripId}/pois/${poiId} (packages/api-client/src/endpoints/pois.ts:21)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/pois.ts:21` calls `PATCH /trips/${tripId}/pois/${poiId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/pois/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80fddbbf4f9494bd", "name": "Dangling fetch: POST /trips/${tripId}/pois/reorder (packages/api-client/src/endpoints/pois.ts:34)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/pois/reorder (packages/api-client/src/endpoints/pois.ts:34)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/pois.ts:34` calls `POST /trips/${tripId}/pois/reorder` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/pois/reorder`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b99f08480f71c904", "name": "Dangling fetch: GET /users/me/telegram-targets (packages/api-client/src/endpoints/telegram.ts:11)", "shortDescription": {"text": "Dangling fetch: GET /users/me/telegram-targets (packages/api-client/src/endpoints/telegram.ts:11)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/telegram.ts:11` calls `GET /users/me/telegram-targets` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/me/telegram-targets`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e3da1eb4a3bf87ac", "name": "Dangling fetch: POST /users/me/telegram-targets (packages/api-client/src/endpoints/telegram.ts:17)", "shortDescription": {"text": "Dangling fetch: POST /users/me/telegram-targets (packages/api-client/src/endpoints/telegram.ts:17)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/telegram.ts:17` calls `POST /users/me/telegram-targets` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/me/telegram-targets`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c84d4b1aa96da6f7", "name": "Dangling fetch: POST /users/me/telegram-targets/${targetId}/verify (packages/api-client/src/endpoints/telegram.ts:24)", "shortDescription": {"text": "Dangling fetch: POST /users/me/telegram-targets/${targetId}/verify (packages/api-client/src/endpoints/telegram.ts:24)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/telegram.ts:24` calls `POST /users/me/telegram-targets/${targetId}/verify` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/me/telegram-targets/<p>/verify`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caa67688bbca203e", "name": "Dangling fetch: GET /trips/${tripId}/telegram-targets (packages/api-client/src/endpoints/telegram.ts:36)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/telegram-targets (packages/api-client/src/endpoints/telegram.ts:36)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/telegram.ts:36` calls `GET /trips/${tripId}/telegram-targets` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/telegram-targets`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7438f901acbdd369", "name": "Dangling fetch: POST /trips/${tripId}/telegram-targets (packages/api-client/src/endpoints/telegram.ts:42)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/telegram-targets (packages/api-client/src/endpoints/telegram.ts:42)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/telegram.ts:42` calls `POST /trips/${tripId}/telegram-targets` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/telegram-targets`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1485eb1c29f9084", "name": "Dangling fetch: GET /users/consents (packages/api-client/src/endpoints/users.ts:19)", "shortDescription": {"text": "Dangling fetch: GET /users/consents (packages/api-client/src/endpoints/users.ts:19)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/users.ts:19` calls `GET /users/consents` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/consents`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5892d39beeff7974", "name": "Dangling fetch: PUT /users/consents (packages/api-client/src/endpoints/users.ts:26)", "shortDescription": {"text": "Dangling fetch: PUT /users/consents (packages/api-client/src/endpoints/users.ts:26)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/users.ts:26` calls `PUT /users/consents` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/consents`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e0de2b3bc4ce6970", "name": "Dangling fetch: GET /users/me/mcp-tokens (packages/api-client/src/endpoints/users.ts:39)", "shortDescription": {"text": "Dangling fetch: GET /users/me/mcp-tokens (packages/api-client/src/endpoints/users.ts:39)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/users.ts:39` calls `GET /users/me/mcp-tokens` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/me/mcp-tokens`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5c299ccf0836f570", "name": "Dangling fetch: POST /users/me/mcp-tokens (packages/api-client/src/endpoints/users.ts:45)", "shortDescription": {"text": "Dangling fetch: POST /users/me/mcp-tokens (packages/api-client/src/endpoints/users.ts:45)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/users.ts:45` calls `POST /users/me/mcp-tokens` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/me/mcp-tokens`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aabd508edf011b89", "name": "Dangling fetch: POST /storage/upload-urls (packages/api-client/src/endpoints/storage.ts:8)", "shortDescription": {"text": "Dangling fetch: POST /storage/upload-urls (packages/api-client/src/endpoints/storage.ts:8)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/storage.ts:8` calls `POST /storage/upload-urls` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/storage/upload-urls`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94779f1ce97d9cbc", "name": "Dangling fetch: GET /public/festivals/${featureId} (packages/api-client/src/endpoints/public.ts:115)", "shortDescription": {"text": "Dangling fetch: GET /public/festivals/${featureId} (packages/api-client/src/endpoints/public.ts:115)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/public.ts:115` calls `GET /public/festivals/${featureId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/public/festivals/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9bc2a2a947319986", "name": "Dangling fetch: POST /auth/register (packages/api-client/src/endpoints/auth.ts:17)", "shortDescription": {"text": "Dangling fetch: POST /auth/register (packages/api-client/src/endpoints/auth.ts:17)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:17` calls `POST /auth/register` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/register`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-77de0c4bf449e6c7", "name": "Dangling fetch: POST /auth/verify-email (packages/api-client/src/endpoints/auth.ts:24)", "shortDescription": {"text": "Dangling fetch: POST /auth/verify-email (packages/api-client/src/endpoints/auth.ts:24)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:24` calls `POST /auth/verify-email` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/verify-email`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ecbbd4f8482a6cf", "name": "Dangling fetch: POST /auth/login (packages/api-client/src/endpoints/auth.ts:34)", "shortDescription": {"text": "Dangling fetch: POST /auth/login (packages/api-client/src/endpoints/auth.ts:34)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:34` calls `POST /auth/login` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/login`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-204d629ceaeed7a8", "name": "Dangling fetch: POST /auth/refresh (packages/api-client/src/endpoints/auth.ts:41)", "shortDescription": {"text": "Dangling fetch: POST /auth/refresh (packages/api-client/src/endpoints/auth.ts:41)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:41` calls `POST /auth/refresh` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/refresh`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-537e3eb5eaa74197", "name": "Dangling fetch: GET /auth/me (packages/api-client/src/endpoints/auth.ts:52)", "shortDescription": {"text": "Dangling fetch: GET /auth/me (packages/api-client/src/endpoints/auth.ts:52)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:52` calls `GET /auth/me` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/me`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e0639eabf1467822", "name": "Dangling fetch: GET /auth/oauth/providers (packages/api-client/src/endpoints/auth.ts:58)", "shortDescription": {"text": "Dangling fetch: GET /auth/oauth/providers (packages/api-client/src/endpoints/auth.ts:58)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:58` calls `GET /auth/oauth/providers` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/oauth/providers`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8228662f6fa60f4e", "name": "Dangling fetch: POST /auth/oauth/google/start (packages/api-client/src/endpoints/auth.ts:64)", "shortDescription": {"text": "Dangling fetch: POST /auth/oauth/google/start (packages/api-client/src/endpoints/auth.ts:64)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:64` calls `POST /auth/oauth/google/start` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/oauth/google/start`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d3371c6ed3f1fa3", "name": "Dangling fetch: POST /auth/oauth/google/link (packages/api-client/src/endpoints/auth.ts:71)", "shortDescription": {"text": "Dangling fetch: POST /auth/oauth/google/link (packages/api-client/src/endpoints/auth.ts:71)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/auth.ts:71` calls `POST /auth/oauth/google/link` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/oauth/google/link`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2f32d0c331269327", "name": "Dangling fetch: POST /trips (packages/api-client/src/endpoints/trips.ts:116)", "shortDescription": {"text": "Dangling fetch: POST /trips (packages/api-client/src/endpoints/trips.ts:116)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:116` calls `POST /trips` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc6a93370899b002", "name": "Dangling fetch: GET /trips/${tripId} (packages/api-client/src/endpoints/trips.ts:123)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId} (packages/api-client/src/endpoints/trips.ts:123)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:123` calls `GET /trips/${tripId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2416a3ee7d8ab9f9", "name": "Dangling fetch: PATCH /trips/${tripId} (packages/api-client/src/endpoints/trips.ts:129)", "shortDescription": {"text": "Dangling fetch: PATCH /trips/${tripId} (packages/api-client/src/endpoints/trips.ts:129)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:129` calls `PATCH /trips/${tripId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a51feb22acecd4c8", "name": "Dangling fetch: POST /trips/${tripId}/copy (packages/api-client/src/endpoints/trips.ts:143)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/copy (packages/api-client/src/endpoints/trips.ts:143)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:143` calls `POST /trips/${tripId}/copy` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/copy`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51fa38857ce3b913", "name": "Dangling fetch: POST /trips/${tripId}/days (packages/api-client/src/endpoints/trips.ts:150)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/days (packages/api-client/src/endpoints/trips.ts:150)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:150` calls `POST /trips/${tripId}/days` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/days`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3413cecf475d2efb", "name": "Dangling fetch: PATCH /trips/${tripId}/days/${dayIndex} (packages/api-client/src/endpoints/trips.ts:157)", "shortDescription": {"text": "Dangling fetch: PATCH /trips/${tripId}/days/${dayIndex} (packages/api-client/src/endpoints/trips.ts:157)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:157` calls `PATCH /trips/${tripId}/days/${dayIndex}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/days/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b152cc71c10cda3", "name": "Dangling fetch: GET /trips/${tripId}/shared/${token} (packages/api-client/src/endpoints/trips.ts:169)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/shared/${token} (packages/api-client/src/endpoints/trips.ts:169)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:169` calls `GET /trips/${tripId}/shared/${token}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/shared/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-171bdd0d68c3651b", "name": "Dangling fetch: GET /trips/${tripId}/attachments (packages/api-client/src/endpoints/trips.ts:175)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/attachments (packages/api-client/src/endpoints/trips.ts:175)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:175` calls `GET /trips/${tripId}/attachments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/attachments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8703b49f2fb96919", "name": "Dangling fetch: POST /trips/${tripId}/attachments (packages/api-client/src/endpoints/trips.ts:181)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/attachments (packages/api-client/src/endpoints/trips.ts:181)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:181` calls `POST /trips/${tripId}/attachments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/attachments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9311e66bae41bd61", "name": "Dangling fetch: GET /trips/${tripId}/attachments/${attachmentId}/download-url (packages/api-client/src/endpoints/trips.t", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/attachments/${attachmentId}/download-url (packages/api-client/src/endpoints/trips.ts:193)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:193` calls `GET /trips/${tripId}/attachments/${attachmentId}/download-url` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/attachments/<p>/download-url`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5050175466860c65", "name": "Dangling fetch: GET /trips/${tripId}/pois/${poiId}/attachments (packages/api-client/src/endpoints/trips.ts:199)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/pois/${poiId}/attachments (packages/api-client/src/endpoints/trips.ts:199)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:199` calls `GET /trips/${tripId}/pois/${poiId}/attachments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/pois/<p>/attachments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-95f49f23eaa1c795", "name": "Dangling fetch: POST /trips/${tripId}/pois/${poiId}/attachments (packages/api-client/src/endpoints/trips.ts:205)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/pois/${poiId}/attachments (packages/api-client/src/endpoints/trips.ts:205)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:205` calls `POST /trips/${tripId}/pois/${poiId}/attachments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/pois/<p>/attachments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60e110d160ba773f", "name": "Dangling fetch: GET /trips/${tripId}/days/${dayIndex}/distance-matrix (packages/api-client/src/endpoints/trips.ts:217)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/days/${dayIndex}/distance-matrix (packages/api-client/src/endpoints/trips.ts:217)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:217` calls `GET /trips/${tripId}/days/${dayIndex}/distance-matrix` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/days/<p>/distance-matrix`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-40879819762df298", "name": "Dangling fetch: POST /trips/${tripId}/days/${dayIndex}/optimize (packages/api-client/src/endpoints/trips.ts:227)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/days/${dayIndex}/optimize (packages/api-client/src/endpoints/trips.ts:227)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:227` calls `POST /trips/${tripId}/days/${dayIndex}/optimize` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/days/<p>/optimize`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7210abdb05ff66db", "name": "Dangling fetch: POST /trips/${tripId}/members (packages/api-client/src/endpoints/trips.ts:234)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/members (packages/api-client/src/endpoints/trips.ts:234)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:234` calls `POST /trips/${tripId}/members` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/members`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23677905fa7ce5ed", "name": "Dangling fetch: GET /trips/${tripId}/comments?limit=${limit} (packages/api-client/src/endpoints/trips.ts:246)", "shortDescription": {"text": "Dangling fetch: GET /trips/${tripId}/comments?limit=${limit} (packages/api-client/src/endpoints/trips.ts:246)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:246` calls `GET /trips/${tripId}/comments?limit=${limit}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/comments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47a99027743c253d", "name": "Dangling fetch: POST /trips/${tripId}/comments (packages/api-client/src/endpoints/trips.ts:252)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/comments (packages/api-client/src/endpoints/trips.ts:252)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:252` calls `POST /trips/${tripId}/comments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/comments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d12c275906eeed7", "name": "Dangling fetch: POST /trips/${tripId}/share-tokens (packages/api-client/src/endpoints/trips.ts:264)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/share-tokens (packages/api-client/src/endpoints/trips.ts:264)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/trips.ts:264` calls `POST /trips/${tripId}/share-tokens` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/trips/<p>/share-tokens`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0baaedaf97d107e3", "name": "Dangling fetch: GET /notice-plans/${noticePlanId} (packages/api-client/src/endpoints/notice-plans.ts:35)", "shortDescription": {"text": "Dangling fetch: GET /notice-plans/${noticePlanId} (packages/api-client/src/endpoints/notice-plans.ts:35)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/notice-plans.ts:35` calls `GET /notice-plans/${noticePlanId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/notice-plans/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6cce09725164f32e", "name": "Dangling fetch: POST /notice-plans/${noticePlanId}/copy (packages/api-client/src/endpoints/notice-plans.ts:41)", "shortDescription": {"text": "Dangling fetch: POST /notice-plans/${noticePlanId}/copy (packages/api-client/src/endpoints/notice-plans.ts:41)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/notice-plans.ts:41` calls `POST /notice-plans/${noticePlanId}/copy` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/notice-plans/<p>/copy`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78f654096fa3ad7c", "name": "Dangling fetch: GET /admin/stats/overview (packages/api-client/src/endpoints/admin.ts:36)", "shortDescription": {"text": "Dangling fetch: GET /admin/stats/overview (packages/api-client/src/endpoints/admin.ts:36)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:36` calls `GET /admin/stats/overview` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/stats/overview`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c64c2c013eec1684", "name": "Dangling fetch: POST /admin/feature-requests/${requestId}/approve (packages/api-client/src/endpoints/admin.ts:60)", "shortDescription": {"text": "Dangling fetch: POST /admin/feature-requests/${requestId}/approve (packages/api-client/src/endpoints/admin.ts:60)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:60` calls `POST /admin/feature-requests/${requestId}/approve` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/feature-requests/<p>/approve`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-49fba2ccfd281c5c", "name": "Dangling fetch: POST /admin/feature-requests/${requestId}/reject (packages/api-client/src/endpoints/admin.ts:70)", "shortDescription": {"text": "Dangling fetch: POST /admin/feature-requests/${requestId}/reject (packages/api-client/src/endpoints/admin.ts:70)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:70` calls `POST /admin/feature-requests/${requestId}/reject` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/feature-requests/<p>/reject`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65a4b69323b99433", "name": "Dangling fetch: GET /admin/users/${userId} (packages/api-client/src/endpoints/admin.ts:90)", "shortDescription": {"text": "Dangling fetch: GET /admin/users/${userId} (packages/api-client/src/endpoints/admin.ts:90)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:90` calls `GET /admin/users/${userId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/users/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b53ac530b9a9c821", "name": "Dangling fetch: POST /admin/users/${userId}/reveal-pii (packages/api-client/src/endpoints/admin.ts:96)", "shortDescription": {"text": "Dangling fetch: POST /admin/users/${userId}/reveal-pii (packages/api-client/src/endpoints/admin.ts:96)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:96` calls `POST /admin/users/${userId}/reveal-pii` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/users/<p>/reveal-pii`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e90686bc52f2624", "name": "Dangling fetch: POST /admin/users/${userId}/force-verify (packages/api-client/src/endpoints/admin.ts:103)", "shortDescription": {"text": "Dangling fetch: POST /admin/users/${userId}/force-verify (packages/api-client/src/endpoints/admin.ts:103)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:103` calls `POST /admin/users/${userId}/force-verify` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/users/<p>/force-verify`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-763af1690cf54f23", "name": "Dangling fetch: POST /admin/users/${userId}/disable (packages/api-client/src/endpoints/admin.ts:110)", "shortDescription": {"text": "Dangling fetch: POST /admin/users/${userId}/disable (packages/api-client/src/endpoints/admin.ts:110)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:110` calls `POST /admin/users/${userId}/disable` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/users/<p>/disable`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-511244666c420562", "name": "Dangling fetch: GET /admin/trips/${tripId} (packages/api-client/src/endpoints/admin.ts:141)", "shortDescription": {"text": "Dangling fetch: GET /admin/trips/${tripId} (packages/api-client/src/endpoints/admin.ts:141)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:141` calls `GET /admin/trips/${tripId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/trips/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d161da17966e135d", "name": "Dangling fetch: PATCH /admin/trips/${tripId}/status (packages/api-client/src/endpoints/admin.ts:150)", "shortDescription": {"text": "Dangling fetch: PATCH /admin/trips/${tripId}/status (packages/api-client/src/endpoints/admin.ts:150)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:150` calls `PATCH /admin/trips/${tripId}/status` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/trips/<p>/status`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f3f94690c4a3e580", "name": "Dangling fetch: GET /admin/pois/${poiId} (packages/api-client/src/endpoints/admin.ts:181)", "shortDescription": {"text": "Dangling fetch: GET /admin/pois/${poiId} (packages/api-client/src/endpoints/admin.ts:181)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:181` calls `GET /admin/pois/${poiId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/pois/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdce6e4f341ccf53", "name": "Dangling fetch: PATCH /admin/pois/${poiId}/link-status (packages/api-client/src/endpoints/admin.ts:190)", "shortDescription": {"text": "Dangling fetch: PATCH /admin/pois/${poiId}/link-status (packages/api-client/src/endpoints/admin.ts:190)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:190` calls `PATCH /admin/pois/${poiId}/link-status` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/pois/<p>/link-status`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8b5b5635e56008a", "name": "Dangling fetch: GET /admin/audit?limit=${limit} (packages/api-client/src/endpoints/admin.ts:197)", "shortDescription": {"text": "Dangling fetch: GET /admin/audit?limit=${limit} (packages/api-client/src/endpoints/admin.ts:197)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:197` calls `GET /admin/audit?limit=${limit}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/audit`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13a79420c5a907df", "name": "Dangling fetch: GET /admin/audit/verify-chain (packages/api-client/src/endpoints/admin.ts:203)", "shortDescription": {"text": "Dangling fetch: GET /admin/audit/verify-chain (packages/api-client/src/endpoints/admin.ts:203)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:203` calls `GET /admin/audit/verify-chain` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/audit/verify-chain`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36c8ddd337152dea", "name": "Dangling fetch: POST /admin/emails/${emailId}/resend (packages/api-client/src/endpoints/admin.ts:260)", "shortDescription": {"text": "Dangling fetch: POST /admin/emails/${emailId}/resend (packages/api-client/src/endpoints/admin.ts:260)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:260` calls `POST /admin/emails/${emailId}/resend` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/emails/<p>/resend`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41376e592e71a633", "name": "Dangling fetch: GET /admin/backup/snapshots?limit=${limit} (packages/api-client/src/endpoints/admin.ts:266)", "shortDescription": {"text": "Dangling fetch: GET /admin/backup/snapshots?limit=${limit} (packages/api-client/src/endpoints/admin.ts:266)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:266` calls `GET /admin/backup/snapshots?limit=${limit}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/backup/snapshots`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-86e51b357cef121b", "name": "Dangling fetch: POST /admin/backup/snapshot (packages/api-client/src/endpoints/admin.ts:272)", "shortDescription": {"text": "Dangling fetch: POST /admin/backup/snapshot (packages/api-client/src/endpoints/admin.ts:272)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:272` calls `POST /admin/backup/snapshot` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/backup/snapshot`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2609be1b1e38bd06", "name": "Dangling fetch: POST /admin/backup/restore-hotswap (packages/api-client/src/endpoints/admin.ts:279)", "shortDescription": {"text": "Dangling fetch: POST /admin/backup/restore-hotswap (packages/api-client/src/endpoints/admin.ts:279)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:279` calls `POST /admin/backup/restore-hotswap` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/backup/restore-hotswap`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a4bbca9909169d38", "name": "Dangling fetch: POST /admin/mcp-tokens (packages/api-client/src/endpoints/admin.ts:306)", "shortDescription": {"text": "Dangling fetch: POST /admin/mcp-tokens (packages/api-client/src/endpoints/admin.ts:306)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:306` calls `POST /admin/mcp-tokens` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/mcp-tokens`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a652c0c0acbc3a5", "name": "Dangling fetch: POST /admin/mcp-tokens/${tokenId}/revoke (packages/api-client/src/endpoints/admin.ts:313)", "shortDescription": {"text": "Dangling fetch: POST /admin/mcp-tokens/${tokenId}/revoke (packages/api-client/src/endpoints/admin.ts:313)"}, "fullDescription": {"text": "`packages/api-client/src/endpoints/admin.ts:313` calls `POST /admin/mcp-tokens/${tokenId}/revoke` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/admin/mcp-tokens/<p>/revoke`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4c0b63a6566e4f70", "name": "Dangling fetch: POST /users/me/profile/complete (apps/web/app/(auth)/profile-complete/page.tsx:80)", "shortDescription": {"text": "Dangling fetch: POST /users/me/profile/complete (apps/web/app/(auth)/profile-complete/page.tsx:80)"}, "fullDescription": {"text": "`apps/web/app/(auth)/profile-complete/page.tsx:80` calls `POST /users/me/profile/complete` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/users/me/profile/complete`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25403"}, "properties": {"repository": "digitie/pinvi", "repoUrl": "https://github.com/digitie/pinvi", "branch": "main"}, "results": [{"ruleId": "scanner-dbecd3702fe170a4", "level": "note", "message": {"text": "Possibly dead Python function: list_change_requests"}, "properties": {"repobilityId": "017e3467be9fef78", "scanner": "scanner-primary", "fingerprint": "dbecd3702fe170a4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/clients/kor_travel_map_admin.py:163"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e6ad913a0b36dc0", "level": "note", "message": {"text": "Possibly dead Python function: reject_change_request"}, "properties": {"repobilityId": "8201406835afa489", "scanner": "scanner-primary", "fingerprint": "7e6ad913a0b36dc0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/clients/kor_travel_map_admin.py:190"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2305aded2736c5c", "level": "note", "message": {"text": "Possibly dead Python function: default_mcp_scopes"}, "properties": {"repobilityId": "9976577e2ba7fd2c", "scanner": "scanner-primary", "fingerprint": "a2305aded2736c5c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/schemas/mcp.py:15"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37612356b749bcc7", "level": "note", "message": {"text": "Possibly dead Python function: dependency"}, "properties": {"repobilityId": "e2f97c76f5b6acb6", "scanner": "scanner-primary", "fingerprint": "37612356b749bcc7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/core/rbac.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab7251f57841a958", "level": "note", "message": {"text": "Possibly dead Python function: require_mcp_read"}, "properties": {"repobilityId": "5e20578f4fee9e20", "scanner": "scanner-primary", "fingerprint": "ab7251f57841a958", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/mcp/auth.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba9c3ee3b707fb54", "level": "note", "message": {"text": "Possibly dead Python function: prometheus_metrics"}, "properties": {"repobilityId": "99bc64c2df07fb25", "scanner": "scanner-primary", "fingerprint": "ba9c3ee3b707fb54", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/middleware/prometheus.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f1fc0695e1c6c45", "level": "note", "message": {"text": "Possibly dead Python function: send_verification_email"}, "properties": {"repobilityId": "2a7832894aab5213", "scanner": "scanner-primary", "fingerprint": "8f1fc0695e1c6c45", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/services/email_service.py:190"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77fae8b1192e6389", "level": "note", "message": {"text": "Possibly dead Python function: distance_from_current"}, "properties": {"repobilityId": "8310e165e78bc63a", "scanner": "scanner-primary", "fingerprint": "77fae8b1192e6389", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/services/trip.py:1133"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff0ecc7c758f906b", "level": "note", "message": {"text": "Possibly dead Python function: make_user_id_from_subject"}, "properties": {"repobilityId": "a058b1408c4d0e17", "scanner": "scanner-primary", "fingerprint": "ff0ecc7c758f906b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/services/user_registration.py:233"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-688cba1eae8085ef", "level": "note", "message": {"text": "Possibly dead Python function: do_run_migrations"}, "properties": {"repobilityId": "087acb17722cfd2f", "scanner": "scanner-primary", "fingerprint": "688cba1eae8085ef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/alembic/env.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ada44f6b11557997", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "ada44f6b11557997", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/alembic/versions/20260609_0014_feature_suggestions.py:129"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c66d2c45f6e2f906", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "c66d2c45f6e2f906", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/alembic/versions/20260606_0008_trip_comments.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3ce9ae8a2ecb824", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/MapSearchBox.tsx:68"}, "properties": {"repobilityId": "834a812a2e5ae2ce", "scanner": "scanner-primary", "fingerprint": "e3ce9ae8a2ecb824", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a3cabb9a65e5f77b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/FeatureMapView.tsx:481"}, "properties": {"repobilityId": "096df136e0b66388", "scanner": "scanner-primary", "fingerprint": "a3cabb9a65e5f77b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a148d3cc7603ace0", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/map/MapView.tsx:265"}, "properties": {"repobilityId": "9cb51e79c4f13d35", "scanner": "scanner-primary", "fingerprint": "a148d3cc7603ace0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3dc1e8a13c9e72ff", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/notice-plans/NoticePlanShelf.tsx:143"}, "properties": {"repobilityId": "dc333303ca8977be", "scanner": "scanner-primary", "fingerprint": "3dc1e8a13c9e72ff", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-fb00214ff98f752c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/notice-plans/NoticePlanCopyDialog.tsx:85"}, "properties": {"repobilityId": "736e5117462b76d3", "scanner": "scanner-primary", "fingerprint": "fb00214ff98f752c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3873da8b5fb72013", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripShareLinks.tsx:118"}, "properties": {"repobilityId": "2555e808abb44c7d", "scanner": "scanner-primary", "fingerprint": "3873da8b5fb72013", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-549ff4b36cd61cfc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripDetail.tsx:237"}, "properties": {"repobilityId": "4700fc9f82d211ed", "scanner": "scanner-primary", "fingerprint": "549ff4b36cd61cfc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ae633c0c241f2ca2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripAttachments.tsx:143"}, "properties": {"repobilityId": "68d3473ee6eed43f", "scanner": "scanner-primary", "fingerprint": "ae633c0c241f2ca2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-87103ce2322b02c0", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripPoiList.tsx:124"}, "properties": {"repobilityId": "744f645128dc681d", "scanner": "scanner-primary", "fingerprint": "87103ce2322b02c0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8ab8f17d103bd739", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/TripDashboard.tsx:275"}, "properties": {"repobilityId": "226c0964c98d67c9", "scanner": "scanner-primary", "fingerprint": "8ab8f17d103bd739", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-65881ef613a9f36d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/trips/SharedTripView.tsx:106"}, "properties": {"repobilityId": "bed5a62c47188b28", "scanner": "scanner-primary", "fingerprint": "65881ef613a9f36d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d9980d9104825b19", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "properties": {"repobilityId": "e591b11d8a0c1fe7", "scanner": "scanner-primary", "fingerprint": "d9980d9104825b19", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c36b30587c620ebd", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "75ca8a0ce4301e89", "scanner": "scanner-primary", "fingerprint": "c36b30587c620ebd", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-7673561931a5dd33", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/web/Dockerfile"}, "properties": {"repobilityId": "d68d7937b96d047d", "scanner": "scanner-primary", "fingerprint": "7673561931a5dd33", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-88e7ed79fae8010e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "properties": {"repobilityId": "13fb22f9b1d605b4", "scanner": "scanner-primary", "fingerprint": "88e7ed79fae8010e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-88e7ed79fae8010e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "properties": {"repobilityId": "603c50c04ab29e6d", "scanner": "scanner-primary", "fingerprint": "88e7ed79fae8010e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-88e7ed79fae8010e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "properties": {"repobilityId": "c7a19b08f582837d", "scanner": "scanner-primary", "fingerprint": "88e7ed79fae8010e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-feb11bca66c37b39", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in airbnb-marker-palette.html:532"}, "properties": {"repobilityId": "c8aaac428cf1b1cc", "scanner": "scanner-primary", "fingerprint": "feb11bca66c37b39", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "airbnb-marker-palette.html"}, "region": {"startLine": 532}}}]}, {"ruleId": "scanner-73b22d23d303a3a0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b9618c8de1f941a", "scanner": "scanner-primary", "fingerprint": "73b22d23d303a3a0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/web.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-ffedab22286ba37f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "652925a0ce0408fd", "scanner": "scanner-primary", "fingerprint": "ffedab22286ba37f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-ffedab22286ba37f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3488eef669e39f6d", "scanner": "scanner-primary", "fingerprint": "ffedab22286ba37f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-ffedab22286ba37f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f69bc22f72030e71", "scanner": "scanner-primary", "fingerprint": "ffedab22286ba37f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-ffedab22286ba37f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aa21131d175801be", "scanner": "scanner-primary", "fingerprint": "ffedab22286ba37f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-ffedab22286ba37f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "818b5a270907f4c1", "scanner": "scanner-primary", "fingerprint": "ffedab22286ba37f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-ffedab22286ba37f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "818b5a270907f4c1", "scanner": "scanner-primary", "fingerprint": "ffedab22286ba37f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-e14a8ca6641ce534", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d1378b1322494869", "scanner": "scanner-primary", "fingerprint": "e14a8ca6641ce534", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-images.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db7d3075d24c48f3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b599d318d1f8eae", "scanner": "scanner-primary", "fingerprint": "db7d3075d24c48f3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codex-pr-review.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-6d5abecaf3592d03", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "288fc466bb5d2b3d", "scanner": "scanner-primary", "fingerprint": "6d5abecaf3592d03", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codex-pr-monitor.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-15f168072880d542", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b3e448ab86aa2ad2", "scanner": "scanner-primary", "fingerprint": "15f168072880d542", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/aggregate-ci.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-14047004e0b8270b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/schemas/package.json"}, "properties": {"repobilityId": "7a6083ee788cc45d", "scanner": "scanner-primary", "fingerprint": "14047004e0b8270b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/schemas/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-002002f2508ee68a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/hooks/package.json"}, "properties": {"repobilityId": "59f800ce16e63eef", "scanner": "scanner-primary", "fingerprint": "002002f2508ee68a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/hooks/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-892d4f964c9036e2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/api-client/package.json"}, "properties": {"repobilityId": "e1c2e42c288c295a", "scanner": "scanner-primary", "fingerprint": "892d4f964c9036e2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api-client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93fcd5491cacc8cd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/state/package.json"}, "properties": {"repobilityId": "22c76543f78f84c9", "scanner": "scanner-primary", "fingerprint": "93fcd5491cacc8cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/state/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98a1332ba54526ae", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/i18n/package.json"}, "properties": {"repobilityId": "d914a9bdf5957152", "scanner": "scanner-primary", "fingerprint": "98a1332ba54526ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/i18n/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bcfee846e2ec548b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/design-tokens/package.json"}, "properties": {"repobilityId": "e14fd044e4f21085", "scanner": "scanner-primary", "fingerprint": "bcfee846e2ec548b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/design-tokens/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9acab6e258601a71", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/domain/package.json"}, "properties": {"repobilityId": "355a076ceb659600", "scanner": "scanner-primary", "fingerprint": "9acab6e258601a71", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/domain/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0c2205560692580", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/mobile/package.json"}, "properties": {"repobilityId": "b3dfed7bb3d70ed3", "scanner": "scanner-primary", "fingerprint": "d0c2205560692580", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "11c35201f4381cca", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "a412cc046bb7973a", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "17bde0b215c30078", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "18650b4b29391234", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-bd267cc638649d16", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/api-client/src/client.ts:7"}, "properties": {"repobilityId": "2a9fab994a7b2437", "scanner": "scanner-primary", "fingerprint": "bd267cc638649d16", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7ddf712cd79b556b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/domain/src/upload.ts:44"}, "properties": {"repobilityId": "87e9d2cbee44d024", "scanner": "scanner-primary", "fingerprint": "7ddf712cd79b556b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4d4dc844b5edebf5", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/pr_review_monitor.py:45"}, "properties": {"repobilityId": "399138a2fb1cd6a7", "scanner": "scanner-primary", "fingerprint": "4d4dc844b5edebf5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d05354e9cdbc08b1", "level": "note", "message": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/app/clients/kor_travel_map.py:463"}, "properties": {"repobilityId": "72e29a375addcb0c", "scanner": "scanner-primary", "fingerprint": "d05354e9cdbc08b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-71cc7707894ed3f0", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/app/core/deps.py:22"}, "properties": {"repobilityId": "31e958fe856868c6", "scanner": "scanner-primary", "fingerprint": "71cc7707894ed3f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4a770c868c71da58", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in apps/api/app/services/rustfs_admin.py:35"}, "properties": {"repobilityId": "3b0e33da6e27f00c", "scanner": "scanner-primary", "fingerprint": "4a770c868c71da58", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6bb02b1bda2d87c6", "level": "note", "message": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/app/services/notice_plan.py:45"}, "properties": {"repobilityId": "e3f677d77fb19c67", "scanner": "scanner-primary", "fingerprint": "6bb02b1bda2d87c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cf8961e93fb1ffc2", "level": "note", "message": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/tests/unit/test_kor_travel_map_client.py:342"}, "properties": {"repobilityId": "31f4f08785088533", "scanner": "scanner-primary", "fingerprint": "cf8961e93fb1ffc2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7b76b07d01616b38", "level": "note", "message": {"text": "Legacy-named symbol `get_curated_pinvi_copy` in apps/api/tests/integration/test_admin_kor_travel_map_curated_import.py:20"}, "properties": {"repobilityId": "90a59fb8ad5357d7", "scanner": "scanner-primary", "fingerprint": "7b76b07d01616b38", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8e047ab7af03962f", "level": "note", "message": {"text": "7 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5a0455f6498c27ad", "scanner": "scanner-primary", "fingerprint": "8e047ab7af03962f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "abd12b7076866973", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "29abc11540ee12db", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e7ada9948ea4d495", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c39ac9d5b989e0e1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d9b40154b2f4fc68", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "29e16cf02f8c2e35", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "63714fc3d56d2923", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9337768c7c273237", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e7041ccd3e9675a2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ac62148e35ec8a03", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d2942ecfb50c1d54", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ea3e90c59859a63a", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "07426f61f4ea19fa", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9bfae6527fa1c85c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "21967514eecca06a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-155adaedd6d13c18", "level": "error", "message": {"text": "FastAPI POST `create_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:91"}, "properties": {"repobilityId": "33b902ec688a97f1", "scanner": "scanner-primary", "fingerprint": "155adaedd6d13c18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/telegram_targets.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-cd9934b0c5de7333", "level": "error", "message": {"text": "FastAPI POST `verify_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:117"}, "properties": {"repobilityId": "4c65ede69690020d", "scanner": "scanner-primary", "fingerprint": "cd9934b0c5de7333", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/telegram_targets.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-3f116c78313bf967", "level": "error", "message": {"text": "FastAPI DELETE `delete_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/telegram_targets.py:142"}, "properties": {"repobilityId": "a71bea461e3ffed9", "scanner": "scanner-primary", "fingerprint": "3f116c78313bf967", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/telegram_targets.py"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-294ac0b755e07bbe", "level": "error", "message": {"text": "FastAPI POST `copy_plan` without auth dependency \u2014 apps/api/app/api/v1/notice_plans.py:95"}, "properties": {"repobilityId": "da3c5d130f986982", "scanner": "scanner-primary", "fingerprint": "294ac0b755e07bbe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/notice_plans.py"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-cbced1ceb3a6e437", "level": "error", "message": {"text": "FastAPI POST `create_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:82"}, "properties": {"repobilityId": "e532e67cdd2cd258", "scanner": "scanner-primary", "fingerprint": "cbced1ceb3a6e437", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/pois.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-627830576ddb2034", "level": "error", "message": {"text": "FastAPI PATCH `update_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:130"}, "properties": {"repobilityId": "280e14d4c2bd842c", "scanner": "scanner-primary", "fingerprint": "627830576ddb2034", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/pois.py"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-3ecf46136c99401f", "level": "error", "message": {"text": "FastAPI DELETE `delete_poi_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:174"}, "properties": {"repobilityId": "9f68b2e92f75ebc6", "scanner": "scanner-primary", "fingerprint": "3ecf46136c99401f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/pois.py"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-270744bdd73124cb", "level": "error", "message": {"text": "FastAPI POST `reorder_pois_endpoint` without auth dependency \u2014 apps/api/app/api/v1/pois.py:198"}, "properties": {"repobilityId": "0aea5bfe776ff772", "scanner": "scanner-primary", "fingerprint": "270744bdd73124cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/pois.py"}, "region": {"startLine": 198}}}]}, {"ruleId": "scanner-df239fb48c207074", "level": "error", "message": {"text": "FastAPI POST `request_feature` without auth dependency \u2014 apps/api/app/api/v1/features.py:498"}, "properties": {"repobilityId": "2df78e7b2534829e", "scanner": "scanner-primary", "fingerprint": "df239fb48c207074", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/features.py"}, "region": {"startLine": 498}}}]}, {"ruleId": "scanner-90c1cd4c58ab1453", "level": "error", "message": {"text": "FastAPI POST `link_trip_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/trip_telegram_targets.py:58"}, "properties": {"repobilityId": "e4ce4ca5bfb36091", "scanner": "scanner-primary", "fingerprint": "90c1cd4c58ab1453", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trip_telegram_targets.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-06e3f11995b47374", "level": "error", "message": {"text": "FastAPI DELETE `unlink_trip_telegram_target` without auth dependency \u2014 apps/api/app/api/v1/trip_telegram_targets.py:92"}, "properties": {"repobilityId": "5d9851c7db481e46", "scanner": "scanner-primary", "fingerprint": "06e3f11995b47374", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trip_telegram_targets.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-e2a3170bd6105bf2", "level": "error", "message": {"text": "FastAPI POST `verify_email_endpoint` without auth dependency \u2014 apps/api/app/api/v1/auth.py:179"}, "properties": {"repobilityId": "cf793ccb3c35d999", "scanner": "scanner-primary", "fingerprint": "e2a3170bd6105bf2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/auth.py"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-0306c3d01f76d431", "level": "error", "message": {"text": "FastAPI POST `password_reset_request` without auth dependency \u2014 apps/api/app/api/v1/auth.py:201"}, "properties": {"repobilityId": "46ceeb497ab4bc8c", "scanner": "scanner-primary", "fingerprint": "0306c3d01f76d431", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/auth.py"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-8776f77e6e104baf", "level": "error", "message": {"text": "FastAPI POST `password_reset` without auth dependency \u2014 apps/api/app/api/v1/auth.py:213"}, "properties": {"repobilityId": "7cdc39db5524c697", "scanner": "scanner-primary", "fingerprint": "8776f77e6e104baf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/auth.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-c3f2f4c97eeb6b19", "level": "error", "message": {"text": "FastAPI POST `refresh_session` without auth dependency \u2014 apps/api/app/api/v1/auth.py:260"}, "properties": {"repobilityId": "d72306aa62e5fc90", "scanner": "scanner-primary", "fingerprint": "c3f2f4c97eeb6b19", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/auth.py"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-9625ac6962205a19", "level": "error", "message": {"text": "FastAPI POST `complete_profile` without auth dependency \u2014 apps/api/app/api/v1/users.py:57"}, "properties": {"repobilityId": "a78085622b09d328", "scanner": "scanner-primary", "fingerprint": "9625ac6962205a19", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/users.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-2b68d49ac70c3f0f", "level": "error", "message": {"text": "FastAPI PUT `put_consents` without auth dependency \u2014 apps/api/app/api/v1/users.py:93"}, "properties": {"repobilityId": "8d57edb74d6581a9", "scanner": "scanner-primary", "fingerprint": "2b68d49ac70c3f0f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/users.py"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-456660fecd37028e", "level": "error", "message": {"text": "FastAPI DELETE `delete_consent` without auth dependency \u2014 apps/api/app/api/v1/users.py:104"}, "properties": {"repobilityId": "444a4e77db4c47ec", "scanner": "scanner-primary", "fingerprint": "456660fecd37028e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/users.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-27f96e6fa0e41602", "level": "error", "message": {"text": "FastAPI POST `issue_mcp_token_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:147"}, "properties": {"repobilityId": "037ad63a6d96ae3d", "scanner": "scanner-primary", "fingerprint": "27f96e6fa0e41602", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/users.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-d8edc5eeaa3a6f56", "level": "error", "message": {"text": "FastAPI DELETE `revoke_mcp_token_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:166"}, "properties": {"repobilityId": "3bbb9a574695e3cb", "scanner": "scanner-primary", "fingerprint": "d8edc5eeaa3a6f56", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/users.py"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-c9600ee3e18ca496", "level": "error", "message": {"text": "FastAPI POST `withdraw_consent_endpoint` without auth dependency \u2014 apps/api/app/api/v1/users.py:182"}, "properties": {"repobilityId": "d5c77b5bad8f5516", "scanner": "scanner-primary", "fingerprint": "c9600ee3e18ca496", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/users.py"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-cbf40849c11afa1f", "level": "error", "message": {"text": "FastAPI POST `google_start` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:99"}, "properties": {"repobilityId": "9a5826e675c5717b", "scanner": "scanner-primary", "fingerprint": "cbf40849c11afa1f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/oauth.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-729241d477e065da", "level": "error", "message": {"text": "FastAPI POST `google_link` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:122"}, "properties": {"repobilityId": "53b7c01274a50471", "scanner": "scanner-primary", "fingerprint": "729241d477e065da", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/oauth.py"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-991b500517737345", "level": "error", "message": {"text": "FastAPI DELETE `unlink_google` without auth dependency \u2014 apps/api/app/api/v1/oauth.py:214"}, "properties": {"repobilityId": "28ed1419d11f1977", "scanner": "scanner-primary", "fingerprint": "991b500517737345", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/oauth.py"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-e943b08686e6931d", "level": "error", "message": {"text": "FastAPI POST `create_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:307"}, "properties": {"repobilityId": "3b3b180523fc50c1", "scanner": "scanner-primary", "fingerprint": "e943b08686e6931d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 307}}}]}, {"ruleId": "scanner-180ea59084b5802d", "level": "error", "message": {"text": "FastAPI PATCH `update_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:377"}, "properties": {"repobilityId": "4053b6bad7b3831a", "scanner": "scanner-primary", "fingerprint": "180ea59084b5802d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-7c47ad942954e9ea", "level": "error", "message": {"text": "FastAPI DELETE `delete_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:415"}, "properties": {"repobilityId": "db175b0d906775ec", "scanner": "scanner-primary", "fingerprint": "7c47ad942954e9ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 415}}}]}, {"ruleId": "scanner-06b6a3c55e1a65ef", "level": "error", "message": {"text": "FastAPI POST `copy_trip_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:448"}, "properties": {"repobilityId": "006dcd49ebb36c7c", "scanner": "scanner-primary", "fingerprint": "06b6a3c55e1a65ef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 448}}}]}, {"ruleId": "scanner-b3b479d8e1746cc2", "level": "error", "message": {"text": "FastAPI POST `create_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:498"}, "properties": {"repobilityId": "65a622be48064ad2", "scanner": "scanner-primary", "fingerprint": "b3b479d8e1746cc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 498}}}]}, {"ruleId": "scanner-a3ce35df9d15be8b", "level": "error", "message": {"text": "FastAPI PATCH `update_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:537"}, "properties": {"repobilityId": "281cdcd738430482", "scanner": "scanner-primary", "fingerprint": "a3ce35df9d15be8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 537}}}]}, {"ruleId": "scanner-102f54ddcd68bb18", "level": "error", "message": {"text": "FastAPI DELETE `delete_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:571"}, "properties": {"repobilityId": "6ee2ae1f02c62752", "scanner": "scanner-primary", "fingerprint": "102f54ddcd68bb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 571}}}]}, {"ruleId": "scanner-0a2fd6f0aaad32df", "level": "error", "message": {"text": "FastAPI POST `create_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:646"}, "properties": {"repobilityId": "3aaf440974984b73", "scanner": "scanner-primary", "fingerprint": "0a2fd6f0aaad32df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 646}}}]}, {"ruleId": "scanner-505b0232cdbe8ed4", "level": "error", "message": {"text": "FastAPI PATCH `update_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:677"}, "properties": {"repobilityId": "def7e0bbccfe4a61", "scanner": "scanner-primary", "fingerprint": "505b0232cdbe8ed4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 677}}}]}, {"ruleId": "scanner-b7f33f9b444c08bc", "level": "error", "message": {"text": "FastAPI DELETE `delete_trip_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:706"}, "properties": {"repobilityId": "6a30673f80a3d3e5", "scanner": "scanner-primary", "fingerprint": "b7f33f9b444c08bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 706}}}]}, {"ruleId": "scanner-1b9d1275d43bba3a", "level": "error", "message": {"text": "FastAPI POST `create_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:782"}, "properties": {"repobilityId": "141d61ffc6c4e2c1", "scanner": "scanner-primary", "fingerprint": "1b9d1275d43bba3a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 782}}}]}, {"ruleId": "scanner-6672d51cf737119c", "level": "error", "message": {"text": "FastAPI PATCH `update_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:820"}, "properties": {"repobilityId": "75ca9aa1df094945", "scanner": "scanner-primary", "fingerprint": "6672d51cf737119c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 820}}}]}, {"ruleId": "scanner-01d5e743a6818ee4", "level": "error", "message": {"text": "FastAPI DELETE `delete_trip_poi_attachment_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:852"}, "properties": {"repobilityId": "82949e8bf871d87d", "scanner": "scanner-primary", "fingerprint": "01d5e743a6818ee4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 852}}}]}, {"ruleId": "scanner-97da331cd29a811c", "level": "error", "message": {"text": "FastAPI POST `optimize_trip_day_endpoint` without auth dependency \u2014 apps/api/app/api/v1/trips.py:934"}, "properties": {"repobilityId": "7c40e0e6e7fec889", "scanner": "scanner-primary", "fingerprint": "97da331cd29a811c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 934}}}]}, {"ruleId": "scanner-ee4909805a8acde5", "level": "error", "message": {"text": "FastAPI POST `invite_trip_member` without auth dependency \u2014 apps/api/app/api/v1/trips.py:991"}, "properties": {"repobilityId": "7dea63a736ebdd1d", "scanner": "scanner-primary", "fingerprint": "ee4909805a8acde5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 991}}}]}, {"ruleId": "scanner-667c4f19e94fd28e", "level": "error", "message": {"text": "FastAPI DELETE `remove_trip_member` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1042"}, "properties": {"repobilityId": "a18f6952b20382b4", "scanner": "scanner-primary", "fingerprint": "667c4f19e94fd28e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 1042}}}]}, {"ruleId": "scanner-535552d7320f585b", "level": "error", "message": {"text": "FastAPI POST `create_trip_comment` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1084"}, "properties": {"repobilityId": "e68a1695efd9b059", "scanner": "scanner-primary", "fingerprint": "535552d7320f585b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 1084}}}]}, {"ruleId": "scanner-950df01bc3636469", "level": "error", "message": {"text": "FastAPI DELETE `delete_trip_comment` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1119"}, "properties": {"repobilityId": "3fcea06d1209c91b", "scanner": "scanner-primary", "fingerprint": "950df01bc3636469", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 1119}}}]}, {"ruleId": "scanner-ea38d613330161e5", "level": "error", "message": {"text": "FastAPI POST `create_share_token` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1148"}, "properties": {"repobilityId": "d1ddd30814aa1f87", "scanner": "scanner-primary", "fingerprint": "ea38d613330161e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 1148}}}]}, {"ruleId": "scanner-35f506af6eeaf14f", "level": "error", "message": {"text": "FastAPI DELETE `revoke_share_token` without auth dependency \u2014 apps/api/app/api/v1/trips.py:1191"}, "properties": {"repobilityId": "82f143ca28916c55", "scanner": "scanner-primary", "fingerprint": "35f506af6eeaf14f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/trips.py"}, "region": {"startLine": 1191}}}]}, {"ruleId": "scanner-52a0b2c9f1606da6", "level": "error", "message": {"text": "FastAPI POST `upload_urls` without auth dependency \u2014 apps/api/app/api/v1/storage.py:24"}, "properties": {"repobilityId": "efc4ab9cd8892651", "scanner": "scanner-primary", "fingerprint": "52a0b2c9f1606da6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/storage.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-3f99ca4e495fd359", "level": "error", "message": {"text": "FastAPI POST `import_kor_travel_map_curated_feature_route` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:147"}, "properties": {"repobilityId": "a8177f5a11a6acb8", "scanner": "scanner-primary", "fingerprint": "3f99ca4e495fd359", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/admin/notice_plans.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-458bd6243f6abd41", "level": "error", "message": {"text": "FastAPI POST `create_plan_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:243"}, "properties": {"repobilityId": "d1d904628e55ac6f", "scanner": "scanner-primary", "fingerprint": "458bd6243f6abd41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/admin/notice_plans.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-c0eee828537ee785", "level": "error", "message": {"text": "FastAPI DELETE `delete_plan_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:284"}, "properties": {"repobilityId": "363b8620ce40c3b4", "scanner": "scanner-primary", "fingerprint": "c0eee828537ee785", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/admin/notice_plans.py"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-23b515c6a2f606c9", "level": "error", "message": {"text": "FastAPI POST `create_poi_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:330"}, "properties": {"repobilityId": "5bbf7bdbffae0fd7", "scanner": "scanner-primary", "fingerprint": "23b515c6a2f606c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/admin/notice_plans.py"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-28671d8463bb9f07", "level": "error", "message": {"text": "FastAPI DELETE `delete_poi_attachment` without auth dependency \u2014 apps/api/app/api/v1/admin/notice_plans.py:372"}, "properties": {"repobilityId": "38febccbc6d13f7b", "scanner": "scanner-primary", "fingerprint": "28671d8463bb9f07", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/api/v1/admin/notice_plans.py"}, "region": {"startLine": 372}}}]}, {"ruleId": "scanner-284063ace17433b6", "level": "error", "message": {"text": "FastAPI POST `resend_webhook` without auth dependency \u2014 apps/api/app/webhooks/resend.py:116"}, "properties": {"repobilityId": "3ed3fc19a5240d5c", "scanner": "scanner-primary", "fingerprint": "284063ace17433b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/app/webhooks/resend.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-d6d1bf11f5e4635b", "level": "error", "message": {"text": "Dangling fetch: GET /features/in-bounds?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:38)"}, "properties": {"repobilityId": "5ab595bfe273954a", "scanner": "scanner-primary", "fingerprint": "d6d1bf11f5e4635b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e86e1c9db83075f2", "level": "error", "message": {"text": "Dangling fetch: GET /features/nearby?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:60)"}, "properties": {"repobilityId": "574025172d57adc6", "scanner": "scanner-primary", "fingerprint": "e86e1c9db83075f2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-578b154069439204", "level": "error", "message": {"text": "Dangling fetch: GET /features/search?${qs.toString()} (packages/api-client/src/endpoints/feature.ts:80)"}, "properties": {"repobilityId": "b95cdc951d4c2a15", "scanner": "scanner-primary", "fingerprint": "578b154069439204", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-f5f10182331b3b5f", "level": "error", "message": {"text": "Dangling fetch: GET /features/${featureId} (packages/api-client/src/endpoints/feature.ts:88)"}, "properties": {"repobilityId": "3ee6707bf760a644", "scanner": "scanner-primary", "fingerprint": "f5f10182331b3b5f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-6e43c8718a4f1cfe", "level": "error", "message": {"text": "Dangling fetch: GET /features/${featureId}/weather (packages/api-client/src/endpoints/feature.ts:95)"}, "properties": {"repobilityId": "14a1c8c1adb1a86e", "scanner": "scanner-primary", "fingerprint": "6e43c8718a4f1cfe", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-85fd3c1c86acd88e", "level": "error", "message": {"text": "Dangling fetch: POST /features/requests (packages/api-client/src/endpoints/feature.ts:110)"}, "properties": {"repobilityId": "dcacd6ca2071bcf1", "scanner": "scanner-primary", "fingerprint": "85fd3c1c86acd88e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-7b626d2b3c6cba05", "level": "error", "message": {"text": "Dangling fetch: GET /features/requests/${requestId} (packages/api-client/src/endpoints/feature.ts:118)"}, "properties": {"repobilityId": "1d4031a940faa756", "scanner": "scanner-primary", "fingerprint": "7b626d2b3c6cba05", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-aff25a7891fd710d", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/pois (packages/api-client/src/endpoints/pois.ts:14)"}, "properties": {"repobilityId": "3815e767dac95d74", "scanner": "scanner-primary", "fingerprint": "aff25a7891fd710d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-6752893087fafb47", "level": "error", "message": {"text": "Dangling fetch: PATCH /trips/${tripId}/pois/${poiId} (packages/api-client/src/endpoints/pois.ts:21)"}, "properties": {"repobilityId": "ffe1ba77d328ce08", "scanner": "scanner-primary", "fingerprint": "6752893087fafb47", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-80fddbbf4f9494bd", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/pois/reorder (packages/api-client/src/endpoints/pois.ts:34)"}, "properties": {"repobilityId": "ab08726c1acfd2dc", "scanner": "scanner-primary", "fingerprint": "80fddbbf4f9494bd", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-b99f08480f71c904", "level": "error", "message": {"text": "Dangling fetch: GET /users/me/telegram-targets (packages/api-client/src/endpoints/telegram.ts:11)"}, "properties": {"repobilityId": "02acfebfad272c78", "scanner": "scanner-primary", "fingerprint": "b99f08480f71c904", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e3da1eb4a3bf87ac", "level": "error", "message": {"text": "Dangling fetch: POST /users/me/telegram-targets (packages/api-client/src/endpoints/telegram.ts:17)"}, "properties": {"repobilityId": "8e28f180c82c4fd0", "scanner": "scanner-primary", "fingerprint": "e3da1eb4a3bf87ac", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-c84d4b1aa96da6f7", "level": "error", "message": {"text": "Dangling fetch: POST /users/me/telegram-targets/${targetId}/verify (packages/api-client/src/endpoints/telegram.ts:24)"}, "properties": {"repobilityId": "d6d907501bb2aed9", "scanner": "scanner-primary", "fingerprint": "c84d4b1aa96da6f7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-caa67688bbca203e", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/telegram-targets (packages/api-client/src/endpoints/telegram.ts:36)"}, "properties": {"repobilityId": "bdbaacdbfc6e39f7", "scanner": "scanner-primary", "fingerprint": "caa67688bbca203e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-7438f901acbdd369", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/telegram-targets (packages/api-client/src/endpoints/telegram.ts:42)"}, "properties": {"repobilityId": "2ec058a9dc3b702e", "scanner": "scanner-primary", "fingerprint": "7438f901acbdd369", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-d1485eb1c29f9084", "level": "error", "message": {"text": "Dangling fetch: GET /users/consents (packages/api-client/src/endpoints/users.ts:19)"}, "properties": {"repobilityId": "291e31e606b3b243", "scanner": "scanner-primary", "fingerprint": "d1485eb1c29f9084", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5892d39beeff7974", "level": "error", "message": {"text": "Dangling fetch: PUT /users/consents (packages/api-client/src/endpoints/users.ts:26)"}, "properties": {"repobilityId": "6ecc09b89fc071b2", "scanner": "scanner-primary", "fingerprint": "5892d39beeff7974", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e0de2b3bc4ce6970", "level": "error", "message": {"text": "Dangling fetch: GET /users/me/mcp-tokens (packages/api-client/src/endpoints/users.ts:39)"}, "properties": {"repobilityId": "e3e650c769625664", "scanner": "scanner-primary", "fingerprint": "e0de2b3bc4ce6970", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5c299ccf0836f570", "level": "error", "message": {"text": "Dangling fetch: POST /users/me/mcp-tokens (packages/api-client/src/endpoints/users.ts:45)"}, "properties": {"repobilityId": "8ac2d92e79c77781", "scanner": "scanner-primary", "fingerprint": "5c299ccf0836f570", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-aabd508edf011b89", "level": "error", "message": {"text": "Dangling fetch: POST /storage/upload-urls (packages/api-client/src/endpoints/storage.ts:8)"}, "properties": {"repobilityId": "efd76bfd03214f26", "scanner": "scanner-primary", "fingerprint": "aabd508edf011b89", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-94779f1ce97d9cbc", "level": "error", "message": {"text": "Dangling fetch: GET /public/festivals/${featureId} (packages/api-client/src/endpoints/public.ts:115)"}, "properties": {"repobilityId": "8c2a9c79dc0d5359", "scanner": "scanner-primary", "fingerprint": "94779f1ce97d9cbc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-9bc2a2a947319986", "level": "error", "message": {"text": "Dangling fetch: POST /auth/register (packages/api-client/src/endpoints/auth.ts:17)"}, "properties": {"repobilityId": "c6e87f2367735b04", "scanner": "scanner-primary", "fingerprint": "9bc2a2a947319986", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-77de0c4bf449e6c7", "level": "error", "message": {"text": "Dangling fetch: POST /auth/verify-email (packages/api-client/src/endpoints/auth.ts:24)"}, "properties": {"repobilityId": "5c127f254fd6bcec", "scanner": "scanner-primary", "fingerprint": "77de0c4bf449e6c7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-0ecbbd4f8482a6cf", "level": "error", "message": {"text": "Dangling fetch: POST /auth/login (packages/api-client/src/endpoints/auth.ts:34)"}, "properties": {"repobilityId": "641a626970cefd80", "scanner": "scanner-primary", "fingerprint": "0ecbbd4f8482a6cf", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-204d629ceaeed7a8", "level": "error", "message": {"text": "Dangling fetch: POST /auth/refresh (packages/api-client/src/endpoints/auth.ts:41)"}, "properties": {"repobilityId": "5ae82d07d1ad612e", "scanner": "scanner-primary", "fingerprint": "204d629ceaeed7a8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-537e3eb5eaa74197", "level": "error", "message": {"text": "Dangling fetch: GET /auth/me (packages/api-client/src/endpoints/auth.ts:52)"}, "properties": {"repobilityId": "8b6868824f81b71e", "scanner": "scanner-primary", "fingerprint": "537e3eb5eaa74197", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-e0639eabf1467822", "level": "error", "message": {"text": "Dangling fetch: GET /auth/oauth/providers (packages/api-client/src/endpoints/auth.ts:58)"}, "properties": {"repobilityId": "fd66504233c01d99", "scanner": "scanner-primary", "fingerprint": "e0639eabf1467822", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-8228662f6fa60f4e", "level": "error", "message": {"text": "Dangling fetch: POST /auth/oauth/google/start (packages/api-client/src/endpoints/auth.ts:64)"}, "properties": {"repobilityId": "343811cf267bbe7c", "scanner": "scanner-primary", "fingerprint": "8228662f6fa60f4e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-1d3371c6ed3f1fa3", "level": "error", "message": {"text": "Dangling fetch: POST /auth/oauth/google/link (packages/api-client/src/endpoints/auth.ts:71)"}, "properties": {"repobilityId": "b84b4e4f22328e14", "scanner": "scanner-primary", "fingerprint": "1d3371c6ed3f1fa3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-2f32d0c331269327", "level": "error", "message": {"text": "Dangling fetch: POST /trips (packages/api-client/src/endpoints/trips.ts:116)"}, "properties": {"repobilityId": "521dccd14228281e", "scanner": "scanner-primary", "fingerprint": "2f32d0c331269327", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-bc6a93370899b002", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId} (packages/api-client/src/endpoints/trips.ts:123)"}, "properties": {"repobilityId": "5377e48ed13c6b0b", "scanner": "scanner-primary", "fingerprint": "bc6a93370899b002", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-2416a3ee7d8ab9f9", "level": "error", "message": {"text": "Dangling fetch: PATCH /trips/${tripId} (packages/api-client/src/endpoints/trips.ts:129)"}, "properties": {"repobilityId": "4fa884b34a52d75a", "scanner": "scanner-primary", "fingerprint": "2416a3ee7d8ab9f9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-a51feb22acecd4c8", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/copy (packages/api-client/src/endpoints/trips.ts:143)"}, "properties": {"repobilityId": "2610003cdbc2b05a", "scanner": "scanner-primary", "fingerprint": "a51feb22acecd4c8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-51fa38857ce3b913", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/days (packages/api-client/src/endpoints/trips.ts:150)"}, "properties": {"repobilityId": "ebd95fb4d4f145f1", "scanner": "scanner-primary", "fingerprint": "51fa38857ce3b913", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-3413cecf475d2efb", "level": "error", "message": {"text": "Dangling fetch: PATCH /trips/${tripId}/days/${dayIndex} (packages/api-client/src/endpoints/trips.ts:157)"}, "properties": {"repobilityId": "f330bdf40429cc2b", "scanner": "scanner-primary", "fingerprint": "3413cecf475d2efb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-8b152cc71c10cda3", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/shared/${token} (packages/api-client/src/endpoints/trips.ts:169)"}, "properties": {"repobilityId": "15fc549416e3d77e", "scanner": "scanner-primary", "fingerprint": "8b152cc71c10cda3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-171bdd0d68c3651b", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/attachments (packages/api-client/src/endpoints/trips.ts:175)"}, "properties": {"repobilityId": "1002fe7319d0c7a9", "scanner": "scanner-primary", "fingerprint": "171bdd0d68c3651b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-8703b49f2fb96919", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/attachments (packages/api-client/src/endpoints/trips.ts:181)"}, "properties": {"repobilityId": "07c6caecfe432fc3", "scanner": "scanner-primary", "fingerprint": "8703b49f2fb96919", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-9311e66bae41bd61", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/attachments/${attachmentId}/download-url (packages/api-client/src/endpoints/trips.ts:193)"}, "properties": {"repobilityId": "f65c5587bb3fc890", "scanner": "scanner-primary", "fingerprint": "9311e66bae41bd61", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5050175466860c65", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/pois/${poiId}/attachments (packages/api-client/src/endpoints/trips.ts:199)"}, "properties": {"repobilityId": "45b8b803ac341d55", "scanner": "scanner-primary", "fingerprint": "5050175466860c65", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-95f49f23eaa1c795", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/pois/${poiId}/attachments (packages/api-client/src/endpoints/trips.ts:205)"}, "properties": {"repobilityId": "1cf02b45de8fdd80", "scanner": "scanner-primary", "fingerprint": "95f49f23eaa1c795", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-60e110d160ba773f", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/days/${dayIndex}/distance-matrix (packages/api-client/src/endpoints/trips.ts:217)"}, "properties": {"repobilityId": "3748c7a02be10a2c", "scanner": "scanner-primary", "fingerprint": "60e110d160ba773f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-40879819762df298", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/days/${dayIndex}/optimize (packages/api-client/src/endpoints/trips.ts:227)"}, "properties": {"repobilityId": "72e7666f53d0ad1e", "scanner": "scanner-primary", "fingerprint": "40879819762df298", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-7210abdb05ff66db", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/members (packages/api-client/src/endpoints/trips.ts:234)"}, "properties": {"repobilityId": "4a7185c2a9475c66", "scanner": "scanner-primary", "fingerprint": "7210abdb05ff66db", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-23677905fa7ce5ed", "level": "error", "message": {"text": "Dangling fetch: GET /trips/${tripId}/comments?limit=${limit} (packages/api-client/src/endpoints/trips.ts:246)"}, "properties": {"repobilityId": "c53af6d2094ec6bc", "scanner": "scanner-primary", "fingerprint": "23677905fa7ce5ed", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-47a99027743c253d", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/comments (packages/api-client/src/endpoints/trips.ts:252)"}, "properties": {"repobilityId": "d081b7ae72f184e7", "scanner": "scanner-primary", "fingerprint": "47a99027743c253d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-3d12c275906eeed7", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/share-tokens (packages/api-client/src/endpoints/trips.ts:264)"}, "properties": {"repobilityId": "9df39c5f56bc16f9", "scanner": "scanner-primary", "fingerprint": "3d12c275906eeed7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-0baaedaf97d107e3", "level": "error", "message": {"text": "Dangling fetch: GET /notice-plans/${noticePlanId} (packages/api-client/src/endpoints/notice-plans.ts:35)"}, "properties": {"repobilityId": "0b03340bbdc13449", "scanner": "scanner-primary", "fingerprint": "0baaedaf97d107e3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-6cce09725164f32e", "level": "error", "message": {"text": "Dangling fetch: POST /notice-plans/${noticePlanId}/copy (packages/api-client/src/endpoints/notice-plans.ts:41)"}, "properties": {"repobilityId": "8b45d5f38c5e5d25", "scanner": "scanner-primary", "fingerprint": "6cce09725164f32e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-78f654096fa3ad7c", "level": "error", "message": {"text": "Dangling fetch: GET /admin/stats/overview (packages/api-client/src/endpoints/admin.ts:36)"}, "properties": {"repobilityId": "6b55c2de1a48bd87", "scanner": "scanner-primary", "fingerprint": "78f654096fa3ad7c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-c64c2c013eec1684", "level": "error", "message": {"text": "Dangling fetch: POST /admin/feature-requests/${requestId}/approve (packages/api-client/src/endpoints/admin.ts:60)"}, "properties": {"repobilityId": "5ba8cd89574f4986", "scanner": "scanner-primary", "fingerprint": "c64c2c013eec1684", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-49fba2ccfd281c5c", "level": "error", "message": {"text": "Dangling fetch: POST /admin/feature-requests/${requestId}/reject (packages/api-client/src/endpoints/admin.ts:70)"}, "properties": {"repobilityId": "22d4aed234af7b68", "scanner": "scanner-primary", "fingerprint": "49fba2ccfd281c5c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-65a4b69323b99433", "level": "error", "message": {"text": "Dangling fetch: GET /admin/users/${userId} (packages/api-client/src/endpoints/admin.ts:90)"}, "properties": {"repobilityId": "1748ad3f6e7ae581", "scanner": "scanner-primary", "fingerprint": "65a4b69323b99433", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-b53ac530b9a9c821", "level": "error", "message": {"text": "Dangling fetch: POST /admin/users/${userId}/reveal-pii (packages/api-client/src/endpoints/admin.ts:96)"}, "properties": {"repobilityId": "bfe99a78448d3342", "scanner": "scanner-primary", "fingerprint": "b53ac530b9a9c821", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-8e90686bc52f2624", "level": "error", "message": {"text": "Dangling fetch: POST /admin/users/${userId}/force-verify (packages/api-client/src/endpoints/admin.ts:103)"}, "properties": {"repobilityId": "2462207df45aa45f", "scanner": "scanner-primary", "fingerprint": "8e90686bc52f2624", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-763af1690cf54f23", "level": "error", "message": {"text": "Dangling fetch: POST /admin/users/${userId}/disable (packages/api-client/src/endpoints/admin.ts:110)"}, "properties": {"repobilityId": "f546ea11070027c6", "scanner": "scanner-primary", "fingerprint": "763af1690cf54f23", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-511244666c420562", "level": "error", "message": {"text": "Dangling fetch: GET /admin/trips/${tripId} (packages/api-client/src/endpoints/admin.ts:141)"}, "properties": {"repobilityId": "76fdb69ff2bcab7d", "scanner": "scanner-primary", "fingerprint": "511244666c420562", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-d161da17966e135d", "level": "error", "message": {"text": "Dangling fetch: PATCH /admin/trips/${tripId}/status (packages/api-client/src/endpoints/admin.ts:150)"}, "properties": {"repobilityId": "69e2f8e0fb34f83b", "scanner": "scanner-primary", "fingerprint": "d161da17966e135d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-f3f94690c4a3e580", "level": "error", "message": {"text": "Dangling fetch: GET /admin/pois/${poiId} (packages/api-client/src/endpoints/admin.ts:181)"}, "properties": {"repobilityId": "5de7a2ee1090ec8b", "scanner": "scanner-primary", "fingerprint": "f3f94690c4a3e580", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-cdce6e4f341ccf53", "level": "error", "message": {"text": "Dangling fetch: PATCH /admin/pois/${poiId}/link-status (packages/api-client/src/endpoints/admin.ts:190)"}, "properties": {"repobilityId": "9b77e06672fabd88", "scanner": "scanner-primary", "fingerprint": "cdce6e4f341ccf53", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-d8b5b5635e56008a", "level": "error", "message": {"text": "Dangling fetch: GET /admin/audit?limit=${limit} (packages/api-client/src/endpoints/admin.ts:197)"}, "properties": {"repobilityId": "fd8299da99ce14c3", "scanner": "scanner-primary", "fingerprint": "d8b5b5635e56008a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-13a79420c5a907df", "level": "error", "message": {"text": "Dangling fetch: GET /admin/audit/verify-chain (packages/api-client/src/endpoints/admin.ts:203)"}, "properties": {"repobilityId": "8c97aa638e0bdc14", "scanner": "scanner-primary", "fingerprint": "13a79420c5a907df", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-36c8ddd337152dea", "level": "error", "message": {"text": "Dangling fetch: POST /admin/emails/${emailId}/resend (packages/api-client/src/endpoints/admin.ts:260)"}, "properties": {"repobilityId": "233159df1872a7fb", "scanner": "scanner-primary", "fingerprint": "36c8ddd337152dea", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-41376e592e71a633", "level": "error", "message": {"text": "Dangling fetch: GET /admin/backup/snapshots?limit=${limit} (packages/api-client/src/endpoints/admin.ts:266)"}, "properties": {"repobilityId": "de330e1d06aa26e8", "scanner": "scanner-primary", "fingerprint": "41376e592e71a633", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-86e51b357cef121b", "level": "error", "message": {"text": "Dangling fetch: POST /admin/backup/snapshot (packages/api-client/src/endpoints/admin.ts:272)"}, "properties": {"repobilityId": "f907225262892857", "scanner": "scanner-primary", "fingerprint": "86e51b357cef121b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-2609be1b1e38bd06", "level": "error", "message": {"text": "Dangling fetch: POST /admin/backup/restore-hotswap (packages/api-client/src/endpoints/admin.ts:279)"}, "properties": {"repobilityId": "4850f0a21ad3f0b1", "scanner": "scanner-primary", "fingerprint": "2609be1b1e38bd06", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-a4bbca9909169d38", "level": "error", "message": {"text": "Dangling fetch: POST /admin/mcp-tokens (packages/api-client/src/endpoints/admin.ts:306)"}, "properties": {"repobilityId": "0ce20f9cba34e2c0", "scanner": "scanner-primary", "fingerprint": "a4bbca9909169d38", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-9a652c0c0acbc3a5", "level": "error", "message": {"text": "Dangling fetch: POST /admin/mcp-tokens/${tokenId}/revoke (packages/api-client/src/endpoints/admin.ts:313)"}, "properties": {"repobilityId": "cd266cd59670ea2a", "scanner": "scanner-primary", "fingerprint": "9a652c0c0acbc3a5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-4c0b63a6566e4f70", "level": "error", "message": {"text": "Dangling fetch: POST /users/me/profile/complete (apps/web/app/(auth)/profile-complete/page.tsx:80)"}, "properties": {"repobilityId": "28c1653e150a013a", "scanner": "scanner-primary", "fingerprint": "4c0b63a6566e4f70", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}]}]}