{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7587be70bc92b947", "name": "Stray `console.log` in TS/JS \u2014 frontend/scripts/reset-project.js:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/scripts/reset-project.js:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-838e7c0e929c3a4b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/+html.tsx:22", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/+html.tsx:22"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8ebe617241bfdd9", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/push.ts:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/push.ts:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae4433e918786dcb", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/app/+html.tsx:22", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/app/+html.tsx:22"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cc9b3fad5435e61", "name": "Very large file: backend/server.py (1804 lines)", "shortDescription": {"text": "Very large file: backend/server.py (1804 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 31 source file(s) (ratio 0.03). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 26 placeholder/mock markers across 9 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1e701be98651c6b", "name": "Commented-code block (5 lines) in backend/server.py:665", "shortDescription": {"text": "Commented-code block (5 lines) in backend/server.py:665"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c693062bd6919c6c", "name": "Legacy-named symbol `TEST_Old` in backend/tests/test_remindly_api.py:147", "shortDescription": {"text": "Legacy-named symbol `TEST_Old` in backend/tests/test_remindly_api.py:147"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/server.py:reset_password_request, backend/server.py:reset_password\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fb88422d45fc8aa", "name": "Unused endpoint: POST /auth/send-code", "shortDescription": {"text": "Unused endpoint: POST /auth/send-code"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/send-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c24523ddc468eef", "name": "Unused endpoint: POST /auth/verify-code", "shortDescription": {"text": "Unused endpoint: POST /auth/verify-code"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/verify-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b7ad707a2b96b29", "name": "Unused endpoint: POST /auth/reset-password-request", "shortDescription": {"text": "Unused endpoint: POST /auth/reset-password-request"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/reset-password-request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-deb8df763a50c73a", "name": "Unused endpoint: POST /auth/reset-password", "shortDescription": {"text": "Unused endpoint: POST /auth/reset-password"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/reset-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a12d5ed34c864c6", "name": "Unused endpoint: POST /auth/signup", "shortDescription": {"text": "Unused endpoint: POST /auth/signup"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fdbacfe9430a6ed", "name": "Unused endpoint: POST /auth/login", "shortDescription": {"text": "Unused endpoint: POST /auth/login"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac42422b23e45104", "name": "Unused endpoint: GET /auth/me", "shortDescription": {"text": "Unused endpoint: GET /auth/me"}, "fullDescription": {"text": "`backend/server.py` declares `GET /auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39832dd80e82d0fa", "name": "Unused endpoint: POST /auth/push-token", "shortDescription": {"text": "Unused endpoint: POST /auth/push-token"}, "fullDescription": {"text": "`backend/server.py` declares `POST /auth/push-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2346b4b4a8d305f0", "name": "Unused endpoint: DELETE /auth/account", "shortDescription": {"text": "Unused endpoint: DELETE /auth/account"}, "fullDescription": {"text": "`backend/server.py` declares `DELETE /auth/account` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e79039ad8da0927c", "name": "Unused endpoint: POST /reminders", "shortDescription": {"text": "Unused endpoint: POST /reminders"}, "fullDescription": {"text": "`backend/server.py` declares `POST /reminders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1164a22ef94d3196", "name": "Unused endpoint: GET /reminders", "shortDescription": {"text": "Unused endpoint: GET /reminders"}, "fullDescription": {"text": "`backend/server.py` declares `GET /reminders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99c101ceb0428066", "name": "Unused endpoint: GET /reminders/history", "shortDescription": {"text": "Unused endpoint: GET /reminders/history"}, "fullDescription": {"text": "`backend/server.py` declares `GET /reminders/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2095a0dc7121e9a9", "name": "Unused endpoint: DELETE /reminders/history", "shortDescription": {"text": "Unused endpoint: DELETE /reminders/history"}, "fullDescription": {"text": "`backend/server.py` declares `DELETE /reminders/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac2cbd468affb982", "name": "Unused endpoint: GET /reminders/{rid}", "shortDescription": {"text": "Unused endpoint: GET /reminders/{rid}"}, "fullDescription": {"text": "`backend/server.py` declares `GET /reminders/{rid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef85384a557e3869", "name": "Unused endpoint: POST /reminders/{rid}/mark-sent", "shortDescription": {"text": "Unused endpoint: POST /reminders/{rid}/mark-sent"}, "fullDescription": {"text": "`backend/server.py` declares `POST /reminders/{rid}/mark-sent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a88de0ea1bd53886", "name": "Unused endpoint: PATCH /reminders/{rid}", "shortDescription": {"text": "Unused endpoint: PATCH /reminders/{rid}"}, "fullDescription": {"text": "`backend/server.py` declares `PATCH /reminders/{rid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c5117f9dec98d44", "name": "Unused endpoint: POST /reminders/{rid}/action", "shortDescription": {"text": "Unused endpoint: POST /reminders/{rid}/action"}, "fullDescription": {"text": "`backend/server.py` declares `POST /reminders/{rid}/action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20d308541479f986", "name": "Unused endpoint: DELETE /reminders/{rid}", "shortDescription": {"text": "Unused endpoint: DELETE /reminders/{rid}"}, "fullDescription": {"text": "`backend/server.py` declares `DELETE /reminders/{rid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4321271f647e2bd0", "name": "Unused endpoint: POST /contacts", "shortDescription": {"text": "Unused endpoint: POST /contacts"}, "fullDescription": {"text": "`backend/server.py` declares `POST /contacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40ec1e2bfc96d290", "name": "Unused endpoint: PUT /contacts/{cid}", "shortDescription": {"text": "Unused endpoint: PUT /contacts/{cid}"}, "fullDescription": {"text": "`backend/server.py` declares `PUT /contacts/{cid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6327e7d63f12d827", "name": "Unused endpoint: GET /contacts", "shortDescription": {"text": "Unused endpoint: GET /contacts"}, "fullDescription": {"text": "`backend/server.py` declares `GET /contacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0a5aa8c4e589001", "name": "Unused endpoint: DELETE /contacts/{cid}", "shortDescription": {"text": "Unused endpoint: DELETE /contacts/{cid}"}, "fullDescription": {"text": "`backend/server.py` declares `DELETE /contacts/{cid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1231dff87195190a", "name": "Unused endpoint: POST /web-sessions", "shortDescription": {"text": "Unused endpoint: POST /web-sessions"}, "fullDescription": {"text": "`backend/server.py` declares `POST /web-sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-633cd75325bd29cb", "name": "Unused endpoint: GET /web-sessions/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /web-sessions/{session_id}"}, "fullDescription": {"text": "`backend/server.py` declares `GET /web-sessions/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f15b377fca224c9c", "name": "Unused endpoint: POST /web-sessions/{session_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /web-sessions/{session_id}/approve"}, "fullDescription": {"text": "`backend/server.py` declares `POST /web-sessions/{session_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e99d514b08f449ca", "name": "Unused endpoint: GET /web-sessions", "shortDescription": {"text": "Unused endpoint: GET /web-sessions"}, "fullDescription": {"text": "`backend/server.py` declares `GET /web-sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96ee5ec6b419e0d3", "name": "Unused endpoint: DELETE /web-sessions/{session_id}", "shortDescription": {"text": "Unused endpoint: DELETE /web-sessions/{session_id}"}, "fullDescription": {"text": "`backend/server.py` declares `DELETE /web-sessions/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d39ad2c752743497", "name": "Unused endpoint: GET /admin/analytics", "shortDescription": {"text": "Unused endpoint: GET /admin/analytics"}, "fullDescription": {"text": "`backend/server.py` declares `GET /admin/analytics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d5883e360954f99", "name": "Unused endpoint: GET /admin/user-activity", "shortDescription": {"text": "Unused endpoint: GET /admin/user-activity"}, "fullDescription": {"text": "`backend/server.py` declares `GET /admin/user-activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21834"}, "properties": {"repository": "UditBangra/Reminder-App", "repoUrl": "https://github.com/UditBangra/Reminder-App", "branch": "main"}, "results": [{"ruleId": "scanner-7587be70bc92b947", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/scripts/reset-project.js:53"}, "properties": {"repobilityId": "75cafd723f0c53c5", "scanner": "scanner-primary", "fingerprint": "7587be70bc92b947", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-838e7c0e929c3a4b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/app/+html.tsx:22"}, "properties": {"repobilityId": "742a806330c86a56", "scanner": "scanner-primary", "fingerprint": "838e7c0e929c3a4b", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-b8ebe617241bfdd9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/push.ts:48"}, "properties": {"repobilityId": "0da4ac5e4063da59", "scanner": "scanner-primary", "fingerprint": "b8ebe617241bfdd9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ae4433e918786dcb", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/app/+html.tsx:22"}, "properties": {"repobilityId": "48cfa8386f399b78", "scanner": "scanner-primary", "fingerprint": "ae4433e918786dcb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/app/+html.tsx"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8cc9b3fad5435e61", "level": "note", "message": {"text": "Very large file: backend/server.py (1804 lines)"}, "properties": {"repobilityId": "e1d9e208de42fc1a", "scanner": "scanner-primary", "fingerprint": "8cc9b3fad5435e61", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "3485ddf93accaae8", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ad5636cff6fd11b1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "37d3359df7180f9d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f8adfdefe295db7b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "50d742fe096fdebe", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "250dfaced524b24d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "9f06506df4380762", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7abdf325a913054b", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f1e701be98651c6b", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/server.py:665"}, "properties": {"repobilityId": "70271154a08f8a3f", "scanner": "scanner-primary", "fingerprint": "f1e701be98651c6b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c693062bd6919c6c", "level": "note", "message": {"text": "Legacy-named symbol `TEST_Old` in backend/tests/test_remindly_api.py:147"}, "properties": {"repobilityId": "308462a77e90e92a", "scanner": "scanner-primary", "fingerprint": "c693062bd6919c6c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d6b8ef2e82905b8e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "4d7a07964b620763", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0fb88422d45fc8aa", "level": "note", "message": {"text": "Unused endpoint: POST /auth/send-code"}, "properties": {"repobilityId": "435221930c931982", "scanner": "scanner-primary", "fingerprint": "0fb88422d45fc8aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c24523ddc468eef", "level": "note", "message": {"text": "Unused endpoint: POST /auth/verify-code"}, "properties": {"repobilityId": "3041810522aa7e5f", "scanner": "scanner-primary", "fingerprint": "7c24523ddc468eef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9b7ad707a2b96b29", "level": "note", "message": {"text": "Unused endpoint: POST /auth/reset-password-request"}, "properties": {"repobilityId": "8767a27457b3e2d5", "scanner": "scanner-primary", "fingerprint": "9b7ad707a2b96b29", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-deb8df763a50c73a", "level": "note", "message": {"text": "Unused endpoint: POST /auth/reset-password"}, "properties": {"repobilityId": "f5b4d22e74b0eaf5", "scanner": "scanner-primary", "fingerprint": "deb8df763a50c73a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a12d5ed34c864c6", "level": "note", "message": {"text": "Unused endpoint: POST /auth/signup"}, "properties": {"repobilityId": "f1c4dc4bf1154efa", "scanner": "scanner-primary", "fingerprint": "4a12d5ed34c864c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8fdbacfe9430a6ed", "level": "note", "message": {"text": "Unused endpoint: POST /auth/login"}, "properties": {"repobilityId": "aad3f9c8d4d206a3", "scanner": "scanner-primary", "fingerprint": "8fdbacfe9430a6ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac42422b23e45104", "level": "note", "message": {"text": "Unused endpoint: GET /auth/me"}, "properties": {"repobilityId": "61e5527166b392b4", "scanner": "scanner-primary", "fingerprint": "ac42422b23e45104", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-39832dd80e82d0fa", "level": "note", "message": {"text": "Unused endpoint: POST /auth/push-token"}, "properties": {"repobilityId": "c61eacb7b7d5edb2", "scanner": "scanner-primary", "fingerprint": "39832dd80e82d0fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2346b4b4a8d305f0", "level": "note", "message": {"text": "Unused endpoint: DELETE /auth/account"}, "properties": {"repobilityId": "aaa3dba8558a693f", "scanner": "scanner-primary", "fingerprint": "2346b4b4a8d305f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e79039ad8da0927c", "level": "note", "message": {"text": "Unused endpoint: POST /reminders"}, "properties": {"repobilityId": "a5958fb5a0e3ca07", "scanner": "scanner-primary", "fingerprint": "e79039ad8da0927c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1164a22ef94d3196", "level": "note", "message": {"text": "Unused endpoint: GET /reminders"}, "properties": {"repobilityId": "3bfcda411a73983c", "scanner": "scanner-primary", "fingerprint": "1164a22ef94d3196", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99c101ceb0428066", "level": "note", "message": {"text": "Unused endpoint: GET /reminders/history"}, "properties": {"repobilityId": "bfb1c118022f2e86", "scanner": "scanner-primary", "fingerprint": "99c101ceb0428066", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2095a0dc7121e9a9", "level": "note", "message": {"text": "Unused endpoint: DELETE /reminders/history"}, "properties": {"repobilityId": "caaa40ce0b48c6f4", "scanner": "scanner-primary", "fingerprint": "2095a0dc7121e9a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac2cbd468affb982", "level": "note", "message": {"text": "Unused endpoint: GET /reminders/{rid}"}, "properties": {"repobilityId": "fb2efc4ee099c9e2", "scanner": "scanner-primary", "fingerprint": "ac2cbd468affb982", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ef85384a557e3869", "level": "note", "message": {"text": "Unused endpoint: POST /reminders/{rid}/mark-sent"}, "properties": {"repobilityId": "e3a25d1f507666ad", "scanner": "scanner-primary", "fingerprint": "ef85384a557e3869", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a88de0ea1bd53886", "level": "note", "message": {"text": "Unused endpoint: PATCH /reminders/{rid}"}, "properties": {"repobilityId": "6488bbc08d494f00", "scanner": "scanner-primary", "fingerprint": "a88de0ea1bd53886", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c5117f9dec98d44", "level": "note", "message": {"text": "Unused endpoint: POST /reminders/{rid}/action"}, "properties": {"repobilityId": "9b2fb99060fc1381", "scanner": "scanner-primary", "fingerprint": "9c5117f9dec98d44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-20d308541479f986", "level": "note", "message": {"text": "Unused endpoint: DELETE /reminders/{rid}"}, "properties": {"repobilityId": "3f8e86c61c45bd76", "scanner": "scanner-primary", "fingerprint": "20d308541479f986", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4321271f647e2bd0", "level": "note", "message": {"text": "Unused endpoint: POST /contacts"}, "properties": {"repobilityId": "e97a5d2d9766784f", "scanner": "scanner-primary", "fingerprint": "4321271f647e2bd0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40ec1e2bfc96d290", "level": "note", "message": {"text": "Unused endpoint: PUT /contacts/{cid}"}, "properties": {"repobilityId": "3eaee57608477ae6", "scanner": "scanner-primary", "fingerprint": "40ec1e2bfc96d290", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6327e7d63f12d827", "level": "note", "message": {"text": "Unused endpoint: GET /contacts"}, "properties": {"repobilityId": "4a731f3cecd414d0", "scanner": "scanner-primary", "fingerprint": "6327e7d63f12d827", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0a5aa8c4e589001", "level": "note", "message": {"text": "Unused endpoint: DELETE /contacts/{cid}"}, "properties": {"repobilityId": "e871fb8354da8b81", "scanner": "scanner-primary", "fingerprint": "e0a5aa8c4e589001", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1231dff87195190a", "level": "note", "message": {"text": "Unused endpoint: POST /web-sessions"}, "properties": {"repobilityId": "d0b3b765350da035", "scanner": "scanner-primary", "fingerprint": "1231dff87195190a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-633cd75325bd29cb", "level": "note", "message": {"text": "Unused endpoint: GET /web-sessions/{session_id}"}, "properties": {"repobilityId": "d744b38ddb9ef9c8", "scanner": "scanner-primary", "fingerprint": "633cd75325bd29cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f15b377fca224c9c", "level": "note", "message": {"text": "Unused endpoint: POST /web-sessions/{session_id}/approve"}, "properties": {"repobilityId": "9e61a10af3aafe70", "scanner": "scanner-primary", "fingerprint": "f15b377fca224c9c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e99d514b08f449ca", "level": "note", "message": {"text": "Unused endpoint: GET /web-sessions"}, "properties": {"repobilityId": "9975362a28257ebd", "scanner": "scanner-primary", "fingerprint": "e99d514b08f449ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-96ee5ec6b419e0d3", "level": "note", "message": {"text": "Unused endpoint: DELETE /web-sessions/{session_id}"}, "properties": {"repobilityId": "083af9d7fb082ece", "scanner": "scanner-primary", "fingerprint": "96ee5ec6b419e0d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d39ad2c752743497", "level": "note", "message": {"text": "Unused endpoint: GET /admin/analytics"}, "properties": {"repobilityId": "2848336923980ed4", "scanner": "scanner-primary", "fingerprint": "d39ad2c752743497", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d5883e360954f99", "level": "note", "message": {"text": "Unused endpoint: GET /admin/user-activity"}, "properties": {"repobilityId": "d2d5d2faec9533a0", "scanner": "scanner-primary", "fingerprint": "6d5883e360954f99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}