{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-78feddd244afb80c", "name": "Possibly dead Python function: send_template", "shortDescription": {"text": "Possibly dead Python function: send_template"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47da2f938220019a", "name": "Possibly dead Python function: send_media", "shortDescription": {"text": "Possibly dead Python function: send_media"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3f1ed418e152667", "name": "Possibly dead Python function: send_wa_template", "shortDescription": {"text": "Possibly dead Python function: send_wa_template"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7408f12aeeec7ff8", "name": "Possibly dead Python function: send_reply_quoted", "shortDescription": {"text": "Possibly dead Python function: send_reply_quoted"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57e6881076b42106", "name": "Possibly dead Python function: send_general_pay_direct", "shortDescription": {"text": "Possibly dead Python function: send_general_pay_direct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30080514d0f7e0a5", "name": "Possibly dead Python function: search_conversations", "shortDescription": {"text": "Possibly dead Python function: search_conversations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d81b336b587311f4", "name": "Possibly dead Python function: media_list", "shortDescription": {"text": "Possibly dead Python function: media_list"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0599bca1cd4e99ce", "name": "Possibly dead Python function: account_tags", "shortDescription": {"text": "Possibly dead Python function: account_tags"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89f96cb8d1ee807c", "name": "Possibly dead Python function: contact_card", "shortDescription": {"text": "Possibly dead Python function: contact_card"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b279223f4c758b65", "name": "Possibly dead Python function: set_tag", "shortDescription": {"text": "Possibly dead Python function: set_tag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4129bd995b80e00", "name": "Possibly dead Python function: archive", "shortDescription": {"text": "Possibly dead Python function: archive"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a56bebb90a9b22a4", "name": "Possibly dead Python function: set_human", "shortDescription": {"text": "Possibly dead Python function: set_human"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ac1d2c62655b744", "name": "Possibly dead Python function: transfer_manual_count", "shortDescription": {"text": "Possibly dead Python function: transfer_manual_count"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35289660f6102487", "name": "Possibly dead Python function: transfer_search_text", "shortDescription": {"text": "Possibly dead Python function: transfer_search_text"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60d161be7a4ffcce", "name": "Possibly dead Python function: transfer_state_counts", "shortDescription": {"text": "Possibly dead Python function: transfer_state_counts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35d77cff4c0215d6", "name": "Possibly dead Python function: transfer_receivers", "shortDescription": {"text": "Possibly dead Python function: transfer_receivers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12e2161a972e848c", "name": "Possibly dead Python function: plan_count", "shortDescription": {"text": "Possibly dead Python function: plan_count"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af2cc6fa9d6942d0", "name": "Possibly dead Python function: plan_for_branch", "shortDescription": {"text": "Possibly dead Python function: plan_for_branch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d88e0c17d6d7b8ba", "name": "Possibly dead Python function: wa_msg_set_media_url", "shortDescription": {"text": "Possibly dead Python function: wa_msg_set_media_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3b23e01f0e7796a", "name": "Possibly dead Python function: wa_contact_get", "shortDescription": {"text": "Possibly dead Python function: wa_contact_get"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfeffa0768132c93", "name": "Possibly dead Python function: find_product_by_barcode", "shortDescription": {"text": "Possibly dead Python function: find_product_by_barcode"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd79c978e7c65f2f", "name": "Insecure pattern 'document_write' in static/index.html:1930", "shortDescription": {"text": "Insecure pattern 'document_write' in static/index.html:1930"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c2d97424b0a3d7f", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/index.html:596", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/index.html:596"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c882404e57a5304", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/checks.html:2039", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/checks.html:2039"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-158f772eaaa3bcd7", "name": "Very large file: db.py (2405 lines)", "shortDescription": {"text": "Very large file: db.py (2405 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bed2a99aa49a7902", "name": "Very large file: main.py (4069 lines)", "shortDescription": {"text": "Very large file: main.py (4069 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 27 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bbe2366dd80aacc6", "name": "Legacy-named symbol `_archive_legacy` in wa.py:1008", "shortDescription": {"text": "Legacy-named symbol `_archive_legacy` in wa.py:1008"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3643c290867c906d", "name": "Commented-code block (6 lines) in wa.py:704", "shortDescription": {"text": "Commented-code block (6 lines) in wa.py:704"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90c33e7021180013", "name": "Legacy-named symbol `wa_archive_old` in main.py:2053", "shortDescription": {"text": "Legacy-named symbol `wa_archive_old` in main.py:2053"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21811ca36d2adb11", "name": "Commented-code block (5 lines) in main.py:1270", "shortDescription": {"text": "Commented-code block (5 lines) in main.py:1270"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06e53eca94d5a92a", "name": "Commented-code block (5 lines) in shared/chatrace_dashboard_client.py:300", "shortDescription": {"text": "Commented-code block (5 lines) in shared/chatrace_dashboard_client.py:300"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad6ef29fecbd291f", "name": "48 env vars used in code but missing from .env.example", "shortDescription": {"text": "48 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APP_BASE_URL`, `AUTO_TR_STATUSES`, `BOT_WHITELIST`, `CHATRACE_DASHBOARD_ACCOUNT_ID`, `CHATRACE_DASHBOARD_BASE_URL`, `CHATRACE_DASHBOARD_TOKEN`, `CHATRACE_DASHBOARD_USER_ID`, `CHECKS_PASSWORD` + 40 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nwa.py:send_pay_template_direct, wa.py:send_pay_template\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e207b45886c3a85", "name": "FastAPI POST `wa_webhook_recv` without auth dependency \u2014 main.py:401", "shortDescription": {"text": "FastAPI POST `wa_webhook_recv` without auth dependency \u2014 main.py:401"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-289265ff279720d6", "name": "FastAPI POST `wa_backfill_start` without auth dependency \u2014 main.py:478", "shortDescription": {"text": "FastAPI POST `wa_backfill_start` without auth dependency \u2014 main.py:478"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a2730b07bc20a6b", "name": "FastAPI POST `wa_backfill_stop` without auth dependency \u2014 main.py:488", "shortDescription": {"text": "FastAPI POST `wa_backfill_stop` without auth dependency \u2014 main.py:488"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d9210cae2e297a43", "name": "FastAPI POST `admin_login` without auth dependency \u2014 main.py:522", "shortDescription": {"text": "FastAPI POST `admin_login` without auth dependency \u2014 main.py:522"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a5f4e420e931bbc", "name": "FastAPI POST `close_transfer` without auth dependency \u2014 main.py:562", "shortDescription": {"text": "FastAPI POST `close_transfer` without auth dependency \u2014 main.py:562"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-09177f3a09d474d5", "name": "FastAPI POST `scan` without auth dependency \u2014 main.py:579", "shortDescription": {"text": "FastAPI POST `scan` without auth dependency \u2014 main.py:579"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-29ed1a1e44a0a792", "name": "FastAPI POST `admin_broadcast` without auth dependency \u2014 main.py:609", "shortDescription": {"text": "FastAPI POST `admin_broadcast` without auth dependency \u2014 main.py:609"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5ae8060377b19a15", "name": "FastAPI POST `dismiss_broadcast` without auth dependency \u2014 main.py:661", "shortDescription": {"text": "FastAPI POST `dismiss_broadcast` without auth dependency \u2014 main.py:661"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca8af45ec0c6f27f", "name": "FastAPI POST `manual_poll` without auth dependency \u2014 main.py:705", "shortDescription": {"text": "FastAPI POST `manual_poll` without auth dependency \u2014 main.py:705"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2c41235ca4a157e", "name": "FastAPI POST `admin_serial_sync` without auth dependency \u2014 main.py:710", "shortDescription": {"text": "FastAPI POST `admin_serial_sync` without auth dependency \u2014 main.py:710"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8d59f097bb104ec", "name": "FastAPI POST `admin_plan_add` without auth dependency \u2014 main.py:761", "shortDescription": {"text": "FastAPI POST `admin_plan_add` without auth dependency \u2014 main.py:761"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-682043442c4e171d", "name": "FastAPI POST `admin_plan_replace` without auth dependency \u2014 main.py:826", "shortDescription": {"text": "FastAPI POST `admin_plan_replace` without auth dependency \u2014 main.py:826"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d48066080c7ca33", "name": "FastAPI DELETE `admin_plan_delete` without auth dependency \u2014 main.py:834", "shortDescription": {"text": "FastAPI DELETE `admin_plan_delete` without auth dependency \u2014 main.py:834"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1701bb5b0483410c", "name": "FastAPI POST `admin_plan_clear` without auth dependency \u2014 main.py:840", "shortDescription": {"text": "FastAPI POST `admin_plan_clear` without auth dependency \u2014 main.py:840"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2138839e2d27bf1", "name": "FastAPI POST `admin_rebalance_scan` without auth dependency \u2014 main.py:847", "shortDescription": {"text": "FastAPI POST `admin_rebalance_scan` without auth dependency \u2014 main.py:847"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8a36316f54796e0", "name": "FastAPI POST `admin_relabel_receiver` without auth dependency \u2014 main.py:867", "shortDescription": {"text": "FastAPI POST `admin_relabel_receiver` without auth dependency \u2014 main.py:867"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6ef47a1f81f4e85", "name": "FastAPI POST `admin_resolve_misroute` without auth dependency \u2014 main.py:874", "shortDescription": {"text": "FastAPI POST `admin_resolve_misroute` without auth dependency \u2014 main.py:874"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2e408374ddbca9ab", "name": "FastAPI POST `admin_catalog_refresh` without auth dependency \u2014 main.py:900", "shortDescription": {"text": "FastAPI POST `admin_catalog_refresh` without auth dependency \u2014 main.py:900"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67b939353ef542ec", "name": "FastAPI POST `admin_wc_connect` without auth dependency \u2014 main.py:1340", "shortDescription": {"text": "FastAPI POST `admin_wc_connect` without auth dependency \u2014 main.py:1340"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7e4c0516e30da20", "name": "FastAPI POST `device_register` without auth dependency \u2014 main.py:1483", "shortDescription": {"text": "FastAPI POST `device_register` without auth dependency \u2014 main.py:1483"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d6b492a2255e4ef", "name": "FastAPI POST `device_branch_change` without auth dependency \u2014 main.py:1530", "shortDescription": {"text": "FastAPI POST `device_branch_change` without auth dependency \u2014 main.py:1530"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59abfc99cd346816", "name": "FastAPI POST `admin_device_set` without auth dependency \u2014 main.py:1624", "shortDescription": {"text": "FastAPI POST `admin_device_set` without auth dependency \u2014 main.py:1624"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf1ab45d526dc43c", "name": "FastAPI POST `sentinel_report` without auth dependency \u2014 main.py:1637", "shortDescription": {"text": "FastAPI POST `sentinel_report` without auth dependency \u2014 main.py:1637"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b328bd8dbf72c407", "name": "FastAPI POST `embed_session` without auth dependency \u2014 main.py:1676", "shortDescription": {"text": "FastAPI POST `embed_session` without auth dependency \u2014 main.py:1676"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d454e8ee2369c88", "name": "FastAPI POST `checks_gql` without auth dependency \u2014 main.py:1715", "shortDescription": {"text": "FastAPI POST `checks_gql` without auth dependency \u2014 main.py:1715"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31550e3213f8cdfe", "name": "FastAPI POST `checks_upload` without auth dependency \u2014 main.py:1739", "shortDescription": {"text": "FastAPI POST `checks_upload` without auth dependency \u2014 main.py:1739"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fae468bebc8750f1", "name": "FastAPI POST `admin_task_status` without auth dependency \u2014 main.py:1804", "shortDescription": {"text": "FastAPI POST `admin_task_status` without auth dependency \u2014 main.py:1804"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e56a1818a88f44a", "name": "FastAPI POST `admin_removals_ingest` without auth dependency \u2014 main.py:1842", "shortDescription": {"text": "FastAPI POST `admin_removals_ingest` without auth dependency \u2014 main.py:1842"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b9a70c03dd887cd", "name": "FastAPI POST `admin_removals_backfill` without auth dependency \u2014 main.py:1850", "shortDescription": {"text": "FastAPI POST `admin_removals_backfill` without auth dependency \u2014 main.py:1850"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8a15703180b5f71f", "name": "FastAPI POST `admin_sales_ingest` without auth dependency \u2014 main.py:1867", "shortDescription": {"text": "FastAPI POST `admin_sales_ingest` without auth dependency \u2014 main.py:1867"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6156bef433959c4", "name": "FastAPI POST `admin_sold_reconcile` without auth dependency \u2014 main.py:1876", "shortDescription": {"text": "FastAPI POST `admin_sold_reconcile` without auth dependency \u2014 main.py:1876"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b5ff8321387e1c5", "name": "FastAPI POST `admin_sales_backfill` without auth dependency \u2014 main.py:1899", "shortDescription": {"text": "FastAPI POST `admin_sales_backfill` without auth dependency \u2014 main.py:1899"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed34a3d327115f67", "name": "FastAPI POST `admin_order_add` without auth dependency \u2014 main.py:1935", "shortDescription": {"text": "FastAPI POST `admin_order_add` without auth dependency \u2014 main.py:1935"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab722229be3ad3e1", "name": "FastAPI POST `admin_order_replace` without auth dependency \u2014 main.py:1941", "shortDescription": {"text": "FastAPI POST `admin_order_replace` without auth dependency \u2014 main.py:1941"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba0091524b6d62ae", "name": "FastAPI DELETE `admin_order_delete` without auth dependency \u2014 main.py:1948", "shortDescription": {"text": "FastAPI DELETE `admin_order_delete` without auth dependency \u2014 main.py:1948"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34ed14804cfb99fe", "name": "FastAPI POST `admin_order_clear` without auth dependency \u2014 main.py:1954", "shortDescription": {"text": "FastAPI POST `admin_order_clear` without auth dependency \u2014 main.py:1954"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-95352fc336231cbb", "name": "FastAPI POST `wa_send` without auth dependency \u2014 main.py:2018", "shortDescription": {"text": "FastAPI POST `wa_send` without auth dependency \u2014 main.py:2018"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-89a43a9400febe7d", "name": "FastAPI POST `wa_send_template` without auth dependency \u2014 main.py:2030", "shortDescription": {"text": "FastAPI POST `wa_send_template` without auth dependency \u2014 main.py:2030"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5ab4b15cf61baeb3", "name": "FastAPI POST `wa_archive_old` without auth dependency \u2014 main.py:2052", "shortDescription": {"text": "FastAPI POST `wa_archive_old` without auth dependency \u2014 main.py:2052"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a6f67f924a7e0ac5", "name": "FastAPI POST `wa_archive` without auth dependency \u2014 main.py:2070", "shortDescription": {"text": "FastAPI POST `wa_archive` without auth dependency \u2014 main.py:2070"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cc2358248a040424", "name": "FastAPI POST `wa_human` without auth dependency \u2014 main.py:2077", "shortDescription": {"text": "FastAPI POST `wa_human` without auth dependency \u2014 main.py:2077"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d8e25668f3f3093", "name": "FastAPI POST `wa_tag` without auth dependency \u2014 main.py:2128", "shortDescription": {"text": "FastAPI POST `wa_tag` without auth dependency \u2014 main.py:2128"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e129614fd19353d", "name": "FastAPI POST `wa_note_add` without auth dependency \u2014 main.py:2135", "shortDescription": {"text": "FastAPI POST `wa_note_add` without auth dependency \u2014 main.py:2135"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2627dbdcf933ce4e", "name": "FastAPI DELETE `wa_note_del` without auth dependency \u2014 main.py:2142", "shortDescription": {"text": "FastAPI DELETE `wa_note_del` without auth dependency \u2014 main.py:2142"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-103a64b14fb0a109", "name": "FastAPI POST `wa_star` without auth dependency \u2014 main.py:2148", "shortDescription": {"text": "FastAPI POST `wa_star` without auth dependency \u2014 main.py:2148"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63a3fb6f1e344006", "name": "FastAPI POST `wa_send_file` without auth dependency \u2014 main.py:2156", "shortDescription": {"text": "FastAPI POST `wa_send_file` without auth dependency \u2014 main.py:2156"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14db095c158a78af", "name": "FastAPI POST `wa_send_wa_template` without auth dependency \u2014 main.py:2203", "shortDescription": {"text": "FastAPI POST `wa_send_wa_template` without auth dependency \u2014 main.py:2203"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03c2bf62938fae25", "name": "FastAPI POST `wa_canned_add` without auth dependency \u2014 main.py:2210", "shortDescription": {"text": "FastAPI POST `wa_canned_add` without auth dependency \u2014 main.py:2210"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a9a0956a71406ae", "name": "FastAPI DELETE `wa_canned_del` without auth dependency \u2014 main.py:2217", "shortDescription": {"text": "FastAPI DELETE `wa_canned_del` without auth dependency \u2014 main.py:2217"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-70b6352423b958b0", "name": "FastAPI POST `uri_ask` without auth dependency \u2014 main.py:2243", "shortDescription": {"text": "FastAPI POST `uri_ask` without auth dependency \u2014 main.py:2243"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3fc04e237bb11d41", "name": "FastAPI POST `bridge_answer` without auth dependency \u2014 main.py:2295", "shortDescription": {"text": "FastAPI POST `bridge_answer` without auth dependency \u2014 main.py:2295"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1f902e5a280da29c", "name": "FastAPI POST `bridge_note` without auth dependency \u2014 main.py:2335", "shortDescription": {"text": "FastAPI POST `bridge_note` without auth dependency \u2014 main.py:2335"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f74a05d44566716", "name": "FastAPI POST `payplus_ipn` without auth dependency \u2014 main.py:2502", "shortDescription": {"text": "FastAPI POST `payplus_ipn` without auth dependency \u2014 main.py:2502"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9cc0d33c2ca57b00", "name": "FastAPI POST `admin_order_return` without auth dependency \u2014 main.py:2879", "shortDescription": {"text": "FastAPI POST `admin_order_return` without auth dependency \u2014 main.py:2879"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-421cbfcc44acdd13", "name": "FastAPI POST `admin_order_auto_transfer` without auth dependency \u2014 main.py:2920", "shortDescription": {"text": "FastAPI POST `admin_order_auto_transfer` without auth dependency \u2014 main.py:2920"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-032d09f8edfbf062", "name": "FastAPI POST `admin_order_status` without auth dependency \u2014 main.py:2961", "shortDescription": {"text": "FastAPI POST `admin_order_status` without auth dependency \u2014 main.py:2961"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a6394e9f9747a66f", "name": "FastAPI POST `admin_order_status_schedule` without auth dependency \u2014 main.py:2998", "shortDescription": {"text": "FastAPI POST `admin_order_status_schedule` without auth dependency \u2014 main.py:2998"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed5f344ba68b0824", "name": "FastAPI DELETE `admin_scheduled_status_cancel` without auth dependency \u2014 main.py:3039", "shortDescription": {"text": "FastAPI DELETE `admin_scheduled_status_cancel` without auth dependency \u2014 main.py:3039"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b703631ec382831", "name": "FastAPI POST `admin_invoice_send` without auth dependency \u2014 main.py:3242", "shortDescription": {"text": "FastAPI POST `admin_invoice_send` without auth dependency \u2014 main.py:3242"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb88100f8d3c9b77", "name": "FastAPI POST `admin_invoices_capture` without auth dependency \u2014 main.py:3262", "shortDescription": {"text": "FastAPI POST `admin_invoices_capture` without auth dependency \u2014 main.py:3262"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ff23d4009b78b9d", "name": "FastAPI DELETE `admin_order_trash` without auth dependency \u2014 main.py:3292", "shortDescription": {"text": "FastAPI DELETE `admin_order_trash` without auth dependency \u2014 main.py:3292"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b9193ea2000b5b85", "name": "FastAPI POST `admin_order_cargo` without auth dependency \u2014 main.py:3347", "shortDescription": {"text": "FastAPI POST `admin_order_cargo` without auth dependency \u2014 main.py:3347"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4e5898da9d04131", "name": "FastAPI POST `admin_order_note` without auth dependency \u2014 main.py:3401", "shortDescription": {"text": "FastAPI POST `admin_order_note` without auth dependency \u2014 main.py:3401"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3dfdf739ac0566d4", "name": "FastAPI POST `admin_order_customer` without auth dependency \u2014 main.py:3425", "shortDescription": {"text": "FastAPI POST `admin_order_customer` without auth dependency \u2014 main.py:3425"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4048e27db1a141c9", "name": "FastAPI POST `pay_standalone` without auth dependency \u2014 main.py:3457", "shortDescription": {"text": "FastAPI POST `pay_standalone` without auth dependency \u2014 main.py:3457"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f9c2d168110ca12", "name": "FastAPI POST `wa_order_create` without auth dependency \u2014 main.py:3679", "shortDescription": {"text": "FastAPI POST `wa_order_create` without auth dependency \u2014 main.py:3679"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cb2c3cc32ca950e1", "name": "FastAPI POST `wa_send_guaranteed` without auth dependency \u2014 main.py:3785", "shortDescription": {"text": "FastAPI POST `wa_send_guaranteed` without auth dependency \u2014 main.py:3785"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3a30024b71b600f", "name": "FastAPI POST `wa_schedule` without auth dependency \u2014 main.py:3862", "shortDescription": {"text": "FastAPI POST `wa_schedule` without auth dependency \u2014 main.py:3862"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83587dcc48670aea", "name": "FastAPI DELETE `wa_scheduled_cancel` without auth dependency \u2014 main.py:3886", "shortDescription": {"text": "FastAPI DELETE `wa_scheduled_cancel` without auth dependency \u2014 main.py:3886"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf8a8e43884a4841", "name": "FastAPI POST `wa_order_charge` without auth dependency \u2014 main.py:3957", "shortDescription": {"text": "FastAPI POST `wa_order_charge` without auth dependency \u2014 main.py:3957"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-231d5d6388ba63c4", "name": "FastAPI POST `wa_push_subscribe` without auth dependency \u2014 main.py:4026", "shortDescription": {"text": "FastAPI POST `wa_push_subscribe` without auth dependency \u2014 main.py:4026"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b75310929dd2af9", "name": "FastAPI POST `wa_push_test` without auth dependency \u2014 main.py:4033", "shortDescription": {"text": "FastAPI POST `wa_push_test` without auth dependency \u2014 main.py:4033"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97cd3b13854db0e9", "name": "Unused endpoint: GET /api/wa/webhook", "shortDescription": {"text": "Unused endpoint: GET /api/wa/webhook"}, "fullDescription": {"text": "`main.py` declares `GET /api/wa/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d68a015f281582d", "name": "Unused endpoint: POST /api/wa/webhook", "shortDescription": {"text": "Unused endpoint: POST /api/wa/webhook"}, "fullDescription": {"text": "`main.py` declares `POST /api/wa/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e955768430f7b38", "name": "Unused endpoint: GET /api/wa/media", "shortDescription": {"text": "Unused endpoint: GET /api/wa/media"}, "fullDescription": {"text": "`main.py` declares `GET /api/wa/media` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52f5c84fef4b38e5", "name": "Unused endpoint: GET /api/admin/wa/store-stats", "shortDescription": {"text": "Unused endpoint: GET /api/admin/wa/store-stats"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/wa/store-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52747ef5f5111812", "name": "Unused endpoint: POST /api/admin/wa/backfill", "shortDescription": {"text": "Unused endpoint: POST /api/admin/wa/backfill"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/wa/backfill` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a951f52fc7f3755a", "name": "Unused endpoint: POST /api/admin/wa/backfill/stop", "shortDescription": {"text": "Unused endpoint: POST /api/admin/wa/backfill/stop"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/wa/backfill/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c24f131f3aeb6152", "name": "Unused endpoint: GET /api/admin/wa/conversations-native", "shortDescription": {"text": "Unused endpoint: GET /api/admin/wa/conversations-native"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/wa/conversations-native` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bdc4c50ed40fbad", "name": "Unused endpoint: GET /api/admin/wa/thread-native/{phone}", "shortDescription": {"text": "Unused endpoint: GET /api/admin/wa/thread-native/{phone}"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/wa/thread-native/{phone}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aa4b2518cbbbfa2", "name": "Unused endpoint: GET /api/config", "shortDescription": {"text": "Unused endpoint: GET /api/config"}, "fullDescription": {"text": "`main.py` declares `GET /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc1b63be5d263466", "name": "Unused endpoint: POST /api/admin/login", "shortDescription": {"text": "Unused endpoint: POST /api/admin/login"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36f0ff5fafcfaa4b", "name": "Unused endpoint: GET /api/branches", "shortDescription": {"text": "Unused endpoint: GET /api/branches"}, "fullDescription": {"text": "`main.py` declares `GET /api/branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f54802578f2f0d2c", "name": "Unused endpoint: GET /api/transfers", "shortDescription": {"text": "Unused endpoint: GET /api/transfers"}, "fullDescription": {"text": "`main.py` declares `GET /api/transfers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af6403f524f43b6d", "name": "Unused endpoint: GET /api/transfers/{op_id}", "shortDescription": {"text": "Unused endpoint: GET /api/transfers/{op_id}"}, "fullDescription": {"text": "`main.py` declares `GET /api/transfers/{op_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47f6c74748ea2eec", "name": "Unused endpoint: POST /api/transfers/{op_id}/close", "shortDescription": {"text": "Unused endpoint: POST /api/transfers/{op_id}/close"}, "fullDescription": {"text": "`main.py` declares `POST /api/transfers/{op_id}/close` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c60f4d5b3ed2d108", "name": "Unused endpoint: POST /api/scan", "shortDescription": {"text": "Unused endpoint: POST /api/scan"}, "fullDescription": {"text": "`main.py` declares `POST /api/scan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b37265900e79a8a", "name": "Unused endpoint: GET /api/stats", "shortDescription": {"text": "Unused endpoint: GET /api/stats"}, "fullDescription": {"text": "`main.py` declares `GET /api/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-270b11d60b0ae8b8", "name": "Unused endpoint: POST /api/admin/broadcast", "shortDescription": {"text": "Unused endpoint: POST /api/admin/broadcast"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/broadcast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f52e44b9e8d45ee", "name": "Unused endpoint: GET /api/admin/broadcasts", "shortDescription": {"text": "Unused endpoint: GET /api/admin/broadcasts"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/broadcasts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf27b4971f052e7e", "name": "Unused endpoint: GET /api/broadcast", "shortDescription": {"text": "Unused endpoint: GET /api/broadcast"}, "fullDescription": {"text": "`main.py` declares `GET /api/broadcast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8d455c4c2af509f", "name": "Unused endpoint: POST /api/broadcast/dismiss", "shortDescription": {"text": "Unused endpoint: POST /api/broadcast/dismiss"}, "fullDescription": {"text": "`main.py` declares `POST /api/broadcast/dismiss` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e150ecfd4e11c48c", "name": "Unused endpoint: GET /api/admin/overview", "shortDescription": {"text": "Unused endpoint: GET /api/admin/overview"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b6da9daa0ccb924", "name": "Unused endpoint: POST /api/poll", "shortDescription": {"text": "Unused endpoint: POST /api/poll"}, "fullDescription": {"text": "`main.py` declares `POST /api/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78b0da9fa0759844", "name": "Unused endpoint: POST /api/admin/serial-sync", "shortDescription": {"text": "Unused endpoint: POST /api/admin/serial-sync"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/serial-sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7afa1dc476370c79", "name": "Unused endpoint: GET /api/admin/serial-index", "shortDescription": {"text": "Unused endpoint: GET /api/admin/serial-index"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/serial-index` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d1553c09f2642b9", "name": "Unused endpoint: GET /api/admin/rebalance", "shortDescription": {"text": "Unused endpoint: GET /api/admin/rebalance"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/rebalance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c951995d6171461c", "name": "Unused endpoint: GET /api/admin/plan", "shortDescription": {"text": "Unused endpoint: GET /api/admin/plan"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6977fecab4f46d4e", "name": "Unused endpoint: POST /api/admin/plan", "shortDescription": {"text": "Unused endpoint: POST /api/admin/plan"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e09adc0cd6e0cb9", "name": "Unused endpoint: GET /plan-action", "shortDescription": {"text": "Unused endpoint: GET /plan-action"}, "fullDescription": {"text": "`main.py` declares `GET /plan-action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2b9bee3b28d5489", "name": "Unused endpoint: POST /api/admin/plan/replace", "shortDescription": {"text": "Unused endpoint: POST /api/admin/plan/replace"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/plan/replace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cac22669243af22f", "name": "Unused endpoint: DELETE /api/admin/plan/{pid}", "shortDescription": {"text": "Unused endpoint: DELETE /api/admin/plan/{pid}"}, "fullDescription": {"text": "`main.py` declares `DELETE /api/admin/plan/{pid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34ca78883ddea7d5", "name": "Unused endpoint: POST /api/admin/plan/clear", "shortDescription": {"text": "Unused endpoint: POST /api/admin/plan/clear"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/plan/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-915ac390d7d0381a", "name": "Unused endpoint: POST /api/admin/rebalance-scan", "shortDescription": {"text": "Unused endpoint: POST /api/admin/rebalance-scan"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/rebalance-scan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68c7a4473f1039de", "name": "Unused endpoint: GET /api/admin/numeric-receivers", "shortDescription": {"text": "Unused endpoint: GET /api/admin/numeric-receivers"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/numeric-receivers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-682f461d32e5ac66", "name": "Unused endpoint: POST /api/admin/relabel-receiver", "shortDescription": {"text": "Unused endpoint: POST /api/admin/relabel-receiver"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/relabel-receiver` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23198aae6d0a88ed", "name": "Unused endpoint: POST /api/admin/misroute/{mid}/resolve", "shortDescription": {"text": "Unused endpoint: POST /api/admin/misroute/{mid}/resolve"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/misroute/{mid}/resolve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89ee0682fb20c904", "name": "Unused endpoint: GET /api/admin/recommendations", "shortDescription": {"text": "Unused endpoint: GET /api/admin/recommendations"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/recommendations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d457c47fbc20ab76", "name": "Unused endpoint: POST /api/admin/catalog-refresh", "shortDescription": {"text": "Unused endpoint: POST /api/admin/catalog-refresh"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/catalog-refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05bcecda44bea41c", "name": "Unused endpoint: GET /api/admin/live-search/catalog", "shortDescription": {"text": "Unused endpoint: GET /api/admin/live-search/catalog"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/live-search/catalog` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63896b1169772972", "name": "Unused endpoint: GET /api/admin/live-search/serial", "shortDescription": {"text": "Unused endpoint: GET /api/admin/live-search/serial"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/live-search/serial` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63fa8d79731c38b0", "name": "Unused endpoint: GET /api/admin/live-stock/{pid}", "shortDescription": {"text": "Unused endpoint: GET /api/admin/live-stock/{pid}"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/live-stock/{pid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-507a49c333c4ec35", "name": "Unused endpoint: GET /api/admin/wc-link/{sku}", "shortDescription": {"text": "Unused endpoint: GET /api/admin/wc-link/{sku}"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/wc-link/{sku}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8f1ebef3e50ecd4", "name": "Unused endpoint: GET /api/admin/wc-search", "shortDescription": {"text": "Unused endpoint: GET /api/admin/wc-search"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/wc-search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4549771dbf80202d", "name": "Unused endpoint: POST /api/admin/wc-connect", "shortDescription": {"text": "Unused endpoint: POST /api/admin/wc-connect"}, "fullDescription": {"text": "`main.py` declares `POST /api/admin/wc-connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb48fd2ec3346e05", "name": "Unused endpoint: POST /api/device/register", "shortDescription": {"text": "Unused endpoint: POST /api/device/register"}, "fullDescription": {"text": "`main.py` declares `POST /api/device/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fecc8618cca0bcc", "name": "Unused endpoint: GET /api/device/status", "shortDescription": {"text": "Unused endpoint: GET /api/device/status"}, "fullDescription": {"text": "`main.py` declares `GET /api/device/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b4d931e4e6ca732", "name": "Unused endpoint: POST /api/device/branch-change", "shortDescription": {"text": "Unused endpoint: POST /api/device/branch-change"}, "fullDescription": {"text": "`main.py` declares `POST /api/device/branch-change` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ec5c48e88587d17", "name": "Unused endpoint: GET /api/device/branch-status", "shortDescription": {"text": "Unused endpoint: GET /api/device/branch-status"}, "fullDescription": {"text": "`main.py` declares `GET /api/device/branch-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd9f5e49b91628cb", "name": "Unused endpoint: GET /branch-action", "shortDescription": {"text": "Unused endpoint: GET /branch-action"}, "fullDescription": {"text": "`main.py` declares `GET /branch-action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54202e5eedf322a1", "name": "Unused endpoint: GET /device-action", "shortDescription": {"text": "Unused endpoint: GET /device-action"}, "fullDescription": {"text": "`main.py` declares `GET /device-action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cda379c8cd718742", "name": "Unused endpoint: GET /api/admin/devices", "shortDescription": {"text": "Unused endpoint: GET /api/admin/devices"}, "fullDescription": {"text": "`main.py` declares `GET /api/admin/devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20472"}, "properties": {"repository": "suissa1002-cyber/gm-transfers", "repoUrl": "https://github.com/suissa1002-cyber/gm-transfers", "branch": "main"}, "results": [{"ruleId": "scanner-78feddd244afb80c", "level": "note", "message": {"text": "Possibly dead Python function: send_template"}, "properties": {"repobilityId": "b7b050a40bf1f199", "scanner": "scanner-primary", "fingerprint": "78feddd244afb80c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:587"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47da2f938220019a", "level": "note", "message": {"text": "Possibly dead Python function: send_media"}, "properties": {"repobilityId": "8b6993223e594e32", "scanner": "scanner-primary", "fingerprint": "47da2f938220019a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:603"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3f1ed418e152667", "level": "note", "message": {"text": "Possibly dead Python function: send_wa_template"}, "properties": {"repobilityId": "60b8cffa9dcde877", "scanner": "scanner-primary", "fingerprint": "b3f1ed418e152667", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:689"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7408f12aeeec7ff8", "level": "note", "message": {"text": "Possibly dead Python function: send_reply_quoted"}, "properties": {"repobilityId": "876e188163b551df", "scanner": "scanner-primary", "fingerprint": "7408f12aeeec7ff8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:787"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57e6881076b42106", "level": "note", "message": {"text": "Possibly dead Python function: send_general_pay_direct"}, "properties": {"repobilityId": "54c4e6e35fc0143a", "scanner": "scanner-primary", "fingerprint": "57e6881076b42106", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:826"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-30080514d0f7e0a5", "level": "note", "message": {"text": "Possibly dead Python function: search_conversations"}, "properties": {"repobilityId": "580a43d22a75a4cc", "scanner": "scanner-primary", "fingerprint": "30080514d0f7e0a5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:863"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d81b336b587311f4", "level": "note", "message": {"text": "Possibly dead Python function: media_list"}, "properties": {"repobilityId": "c004e4c9d5dc734c", "scanner": "scanner-primary", "fingerprint": "d81b336b587311f4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:905"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0599bca1cd4e99ce", "level": "note", "message": {"text": "Possibly dead Python function: account_tags"}, "properties": {"repobilityId": "57550ad40aa75fef", "scanner": "scanner-primary", "fingerprint": "0599bca1cd4e99ce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:921"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89f96cb8d1ee807c", "level": "note", "message": {"text": "Possibly dead Python function: contact_card"}, "properties": {"repobilityId": "c8ef340be03c4feb", "scanner": "scanner-primary", "fingerprint": "89f96cb8d1ee807c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:961"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b279223f4c758b65", "level": "note", "message": {"text": "Possibly dead Python function: set_tag"}, "properties": {"repobilityId": "1d1209f88a4d8bbc", "scanner": "scanner-primary", "fingerprint": "b279223f4c758b65", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:990"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4129bd995b80e00", "level": "note", "message": {"text": "Possibly dead Python function: archive"}, "properties": {"repobilityId": "93ee71a07ba10c03", "scanner": "scanner-primary", "fingerprint": "c4129bd995b80e00", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:998"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a56bebb90a9b22a4", "level": "note", "message": {"text": "Possibly dead Python function: set_human"}, "properties": {"repobilityId": "5594d9c4fb690b9a", "scanner": "scanner-primary", "fingerprint": "a56bebb90a9b22a4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wa.py:1015"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ac1d2c62655b744", "level": "note", "message": {"text": "Possibly dead Python function: transfer_manual_count"}, "properties": {"repobilityId": "44f5b121b802d53f", "scanner": "scanner-primary", "fingerprint": "0ac1d2c62655b744", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35289660f6102487", "level": "note", "message": {"text": "Possibly dead Python function: transfer_search_text"}, "properties": {"repobilityId": "36c2665848e1d728", "scanner": "scanner-primary", "fingerprint": "35289660f6102487", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1113"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60d161be7a4ffcce", "level": "note", "message": {"text": "Possibly dead Python function: transfer_state_counts"}, "properties": {"repobilityId": "7b2fe6056d86e37d", "scanner": "scanner-primary", "fingerprint": "60d161be7a4ffcce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1128"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35d77cff4c0215d6", "level": "note", "message": {"text": "Possibly dead Python function: transfer_receivers"}, "properties": {"repobilityId": "4ae154776db563d7", "scanner": "scanner-primary", "fingerprint": "35d77cff4c0215d6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1140"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12e2161a972e848c", "level": "note", "message": {"text": "Possibly dead Python function: plan_count"}, "properties": {"repobilityId": "a4e6640638ad9666", "scanner": "scanner-primary", "fingerprint": "12e2161a972e848c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1289"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af2cc6fa9d6942d0", "level": "note", "message": {"text": "Possibly dead Python function: plan_for_branch"}, "properties": {"repobilityId": "79730228d047cb2a", "scanner": "scanner-primary", "fingerprint": "af2cc6fa9d6942d0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1419"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d88e0c17d6d7b8ba", "level": "note", "message": {"text": "Possibly dead Python function: wa_msg_set_media_url"}, "properties": {"repobilityId": "34637c9874514b75", "scanner": "scanner-primary", "fingerprint": "d88e0c17d6d7b8ba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1595"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3b23e01f0e7796a", "level": "note", "message": {"text": "Possibly dead Python function: wa_contact_get"}, "properties": {"repobilityId": "a3c71c38c731963c", "scanner": "scanner-primary", "fingerprint": "e3b23e01f0e7796a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1770"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfeffa0768132c93", "level": "note", "message": {"text": "Possibly dead Python function: find_product_by_barcode"}, "properties": {"repobilityId": "885b2a4be7101938", "scanner": "scanner-primary", "fingerprint": "cfeffa0768132c93", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/neworder_client.py:246"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "f391052c9bfd7e8b", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-cd79c978e7c65f2f", "level": "note", "message": {"text": "Insecure pattern 'document_write' in static/index.html:1930"}, "properties": {"repobilityId": "32b1532bd3c01eab", "scanner": "scanner-primary", "fingerprint": "cd79c978e7c65f2f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/index.html"}, "region": {"startLine": 1930}}}]}, {"ruleId": "scanner-1c2d97424b0a3d7f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/index.html:596"}, "properties": {"repobilityId": "54c44d8c983139f7", "scanner": "scanner-primary", "fingerprint": "1c2d97424b0a3d7f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/index.html"}, "region": {"startLine": 596}}}]}, {"ruleId": "scanner-5c882404e57a5304", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/checks.html:2039"}, "properties": {"repobilityId": "fe548be2f7fc72d5", "scanner": "scanner-primary", "fingerprint": "5c882404e57a5304", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/checks.html"}, "region": {"startLine": 2039}}}]}, {"ruleId": "scanner-158f772eaaa3bcd7", "level": "note", "message": {"text": "Very large file: db.py (2405 lines)"}, "properties": {"repobilityId": "db396cedc3482ca7", "scanner": "scanner-primary", "fingerprint": "158f772eaaa3bcd7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bed2a99aa49a7902", "level": "note", "message": {"text": "Very large file: main.py (4069 lines)"}, "properties": {"repobilityId": "d28330f452f23706", "scanner": "scanner-primary", "fingerprint": "bed2a99aa49a7902", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "612cf5d75b342456", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "fa36397c49dabaa0", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "a2270fc4ee49ebea", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "406e6604058e4474", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "55e0221ed9df8910", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "835eef048ef8b30d", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bbe2366dd80aacc6", "level": "note", "message": {"text": "Legacy-named symbol `_archive_legacy` in wa.py:1008"}, "properties": {"repobilityId": "e52eb83c300aa07d", "scanner": "scanner-primary", "fingerprint": "bbe2366dd80aacc6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3643c290867c906d", "level": "none", "message": {"text": "Commented-code block (6 lines) in wa.py:704"}, "properties": {"repobilityId": "c8838d463c4b0f07", "scanner": "scanner-primary", "fingerprint": "3643c290867c906d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90c33e7021180013", "level": "note", "message": {"text": "Legacy-named symbol `wa_archive_old` in main.py:2053"}, "properties": {"repobilityId": "6fe0183b8abea204", "scanner": "scanner-primary", "fingerprint": "90c33e7021180013", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-21811ca36d2adb11", "level": "none", "message": {"text": "Commented-code block (5 lines) in main.py:1270"}, "properties": {"repobilityId": "36423b7be99ece0b", "scanner": "scanner-primary", "fingerprint": "21811ca36d2adb11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06e53eca94d5a92a", "level": "none", "message": {"text": "Commented-code block (5 lines) in shared/chatrace_dashboard_client.py:300"}, "properties": {"repobilityId": "634405c649f9de04", "scanner": "scanner-primary", "fingerprint": "06e53eca94d5a92a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad6ef29fecbd291f", "level": "note", "message": {"text": "48 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "774efb1dfe2a68ff", "scanner": "scanner-primary", "fingerprint": "ad6ef29fecbd291f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "36fd540905619def", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fb42ec3ac1ae994c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d4b4a94502f62340", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e0ad5adec37dd1ae", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "20e1c93c139952c6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ea9065d85392aa58", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4a44f1d0c60d5bb1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "24084e25538c46f7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c98851fbbba09d23", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "74259a3138f103c3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c61f1ab7573ab133", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-5e207b45886c3a85", "level": "error", "message": {"text": "FastAPI POST `wa_webhook_recv` without auth dependency \u2014 main.py:401"}, "properties": {"repobilityId": "de1c3c864ba39111", "scanner": "scanner-primary", "fingerprint": "5e207b45886c3a85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 401}}}]}, {"ruleId": "scanner-289265ff279720d6", "level": "error", "message": {"text": "FastAPI POST `wa_backfill_start` without auth dependency \u2014 main.py:478"}, "properties": {"repobilityId": "8ec6e85b661b9b2b", "scanner": "scanner-primary", "fingerprint": "289265ff279720d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 478}}}]}, {"ruleId": "scanner-6a2730b07bc20a6b", "level": "error", "message": {"text": "FastAPI POST `wa_backfill_stop` without auth dependency \u2014 main.py:488"}, "properties": {"repobilityId": "23bf2027073a1bc2", "scanner": "scanner-primary", "fingerprint": "6a2730b07bc20a6b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 488}}}]}, {"ruleId": "scanner-d9210cae2e297a43", "level": "error", "message": {"text": "FastAPI POST `admin_login` without auth dependency \u2014 main.py:522"}, "properties": {"repobilityId": "9dd63ea01a7536fe", "scanner": "scanner-primary", "fingerprint": "d9210cae2e297a43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 522}}}]}, {"ruleId": "scanner-0a5f4e420e931bbc", "level": "error", "message": {"text": "FastAPI POST `close_transfer` without auth dependency \u2014 main.py:562"}, "properties": {"repobilityId": "90b273060042bc13", "scanner": "scanner-primary", "fingerprint": "0a5f4e420e931bbc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 562}}}]}, {"ruleId": "scanner-09177f3a09d474d5", "level": "error", "message": {"text": "FastAPI POST `scan` without auth dependency \u2014 main.py:579"}, "properties": {"repobilityId": "13b77345a71da8f1", "scanner": "scanner-primary", "fingerprint": "09177f3a09d474d5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 579}}}]}, {"ruleId": "scanner-29ed1a1e44a0a792", "level": "error", "message": {"text": "FastAPI POST `admin_broadcast` without auth dependency \u2014 main.py:609"}, "properties": {"repobilityId": "3992f207bda96d06", "scanner": "scanner-primary", "fingerprint": "29ed1a1e44a0a792", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 609}}}]}, {"ruleId": "scanner-5ae8060377b19a15", "level": "error", "message": {"text": "FastAPI POST `dismiss_broadcast` without auth dependency \u2014 main.py:661"}, "properties": {"repobilityId": "80eb4a7f826c58fc", "scanner": "scanner-primary", "fingerprint": "5ae8060377b19a15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 661}}}]}, {"ruleId": "scanner-ca8af45ec0c6f27f", "level": "error", "message": {"text": "FastAPI POST `manual_poll` without auth dependency \u2014 main.py:705"}, "properties": {"repobilityId": "780591533b4cc8bd", "scanner": "scanner-primary", "fingerprint": "ca8af45ec0c6f27f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 705}}}]}, {"ruleId": "scanner-a2c41235ca4a157e", "level": "error", "message": {"text": "FastAPI POST `admin_serial_sync` without auth dependency \u2014 main.py:710"}, "properties": {"repobilityId": "abc595e51b6d9202", "scanner": "scanner-primary", "fingerprint": "a2c41235ca4a157e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 710}}}]}, {"ruleId": "scanner-d8d59f097bb104ec", "level": "error", "message": {"text": "FastAPI POST `admin_plan_add` without auth dependency \u2014 main.py:761"}, "properties": {"repobilityId": "17bef2b305d4e825", "scanner": "scanner-primary", "fingerprint": "d8d59f097bb104ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 761}}}]}, {"ruleId": "scanner-682043442c4e171d", "level": "error", "message": {"text": "FastAPI POST `admin_plan_replace` without auth dependency \u2014 main.py:826"}, "properties": {"repobilityId": "ddc2af155c88a9c0", "scanner": "scanner-primary", "fingerprint": "682043442c4e171d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 826}}}]}, {"ruleId": "scanner-8d48066080c7ca33", "level": "error", "message": {"text": "FastAPI DELETE `admin_plan_delete` without auth dependency \u2014 main.py:834"}, "properties": {"repobilityId": "e2273f289c02650c", "scanner": "scanner-primary", "fingerprint": "8d48066080c7ca33", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 834}}}]}, {"ruleId": "scanner-1701bb5b0483410c", "level": "error", "message": {"text": "FastAPI POST `admin_plan_clear` without auth dependency \u2014 main.py:840"}, "properties": {"repobilityId": "eca919f202662f1f", "scanner": "scanner-primary", "fingerprint": "1701bb5b0483410c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 840}}}]}, {"ruleId": "scanner-c2138839e2d27bf1", "level": "error", "message": {"text": "FastAPI POST `admin_rebalance_scan` without auth dependency \u2014 main.py:847"}, "properties": {"repobilityId": "2d5ee68d354fb66b", "scanner": "scanner-primary", "fingerprint": "c2138839e2d27bf1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 847}}}]}, {"ruleId": "scanner-a8a36316f54796e0", "level": "error", "message": {"text": "FastAPI POST `admin_relabel_receiver` without auth dependency \u2014 main.py:867"}, "properties": {"repobilityId": "c6634b355a19a4fd", "scanner": "scanner-primary", "fingerprint": "a8a36316f54796e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 867}}}]}, {"ruleId": "scanner-b6ef47a1f81f4e85", "level": "error", "message": {"text": "FastAPI POST `admin_resolve_misroute` without auth dependency \u2014 main.py:874"}, "properties": {"repobilityId": "c12454e23da4d28c", "scanner": "scanner-primary", "fingerprint": "b6ef47a1f81f4e85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 874}}}]}, {"ruleId": "scanner-2e408374ddbca9ab", "level": "error", "message": {"text": "FastAPI POST `admin_catalog_refresh` without auth dependency \u2014 main.py:900"}, "properties": {"repobilityId": "7ec41b531db3443c", "scanner": "scanner-primary", "fingerprint": "2e408374ddbca9ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 900}}}]}, {"ruleId": "scanner-67b939353ef542ec", "level": "error", "message": {"text": "FastAPI POST `admin_wc_connect` without auth dependency \u2014 main.py:1340"}, "properties": {"repobilityId": "48cf541b8d7d7596", "scanner": "scanner-primary", "fingerprint": "67b939353ef542ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1340}}}]}, {"ruleId": "scanner-d7e4c0516e30da20", "level": "error", "message": {"text": "FastAPI POST `device_register` without auth dependency \u2014 main.py:1483"}, "properties": {"repobilityId": "f7f1214696ffb7be", "scanner": "scanner-primary", "fingerprint": "d7e4c0516e30da20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1483}}}]}, {"ruleId": "scanner-6d6b492a2255e4ef", "level": "error", "message": {"text": "FastAPI POST `device_branch_change` without auth dependency \u2014 main.py:1530"}, "properties": {"repobilityId": "86a5001de6c3e695", "scanner": "scanner-primary", "fingerprint": "6d6b492a2255e4ef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1530}}}]}, {"ruleId": "scanner-59abfc99cd346816", "level": "error", "message": {"text": "FastAPI POST `admin_device_set` without auth dependency \u2014 main.py:1624"}, "properties": {"repobilityId": "c2be8719e63e86ee", "scanner": "scanner-primary", "fingerprint": "59abfc99cd346816", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1624}}}]}, {"ruleId": "scanner-bf1ab45d526dc43c", "level": "error", "message": {"text": "FastAPI POST `sentinel_report` without auth dependency \u2014 main.py:1637"}, "properties": {"repobilityId": "066edc6b0d1b50ba", "scanner": "scanner-primary", "fingerprint": "bf1ab45d526dc43c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1637}}}]}, {"ruleId": "scanner-b328bd8dbf72c407", "level": "error", "message": {"text": "FastAPI POST `embed_session` without auth dependency \u2014 main.py:1676"}, "properties": {"repobilityId": "a5e7254177081541", "scanner": "scanner-primary", "fingerprint": "b328bd8dbf72c407", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1676}}}]}, {"ruleId": "scanner-0d454e8ee2369c88", "level": "error", "message": {"text": "FastAPI POST `checks_gql` without auth dependency \u2014 main.py:1715"}, "properties": {"repobilityId": "11ad69f5dfabcddc", "scanner": "scanner-primary", "fingerprint": "0d454e8ee2369c88", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1715}}}]}, {"ruleId": "scanner-31550e3213f8cdfe", "level": "error", "message": {"text": "FastAPI POST `checks_upload` without auth dependency \u2014 main.py:1739"}, "properties": {"repobilityId": "1fdd16173ce8babe", "scanner": "scanner-primary", "fingerprint": "31550e3213f8cdfe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1739}}}]}, {"ruleId": "scanner-fae468bebc8750f1", "level": "error", "message": {"text": "FastAPI POST `admin_task_status` without auth dependency \u2014 main.py:1804"}, "properties": {"repobilityId": "87428bb51d6093f6", "scanner": "scanner-primary", "fingerprint": "fae468bebc8750f1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1804}}}]}, {"ruleId": "scanner-6e56a1818a88f44a", "level": "error", "message": {"text": "FastAPI POST `admin_removals_ingest` without auth dependency \u2014 main.py:1842"}, "properties": {"repobilityId": "cc2eb3a9a48c74c7", "scanner": "scanner-primary", "fingerprint": "6e56a1818a88f44a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1842}}}]}, {"ruleId": "scanner-3b9a70c03dd887cd", "level": "error", "message": {"text": "FastAPI POST `admin_removals_backfill` without auth dependency \u2014 main.py:1850"}, "properties": {"repobilityId": "fef296f76fc82df7", "scanner": "scanner-primary", "fingerprint": "3b9a70c03dd887cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1850}}}]}, {"ruleId": "scanner-8a15703180b5f71f", "level": "error", "message": {"text": "FastAPI POST `admin_sales_ingest` without auth dependency \u2014 main.py:1867"}, "properties": {"repobilityId": "2841c6ca724e9e7b", "scanner": "scanner-primary", "fingerprint": "8a15703180b5f71f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1867}}}]}, {"ruleId": "scanner-b6156bef433959c4", "level": "error", "message": {"text": "FastAPI POST `admin_sold_reconcile` without auth dependency \u2014 main.py:1876"}, "properties": {"repobilityId": "89a27193e8dc9533", "scanner": "scanner-primary", "fingerprint": "b6156bef433959c4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1876}}}]}, {"ruleId": "scanner-1b5ff8321387e1c5", "level": "error", "message": {"text": "FastAPI POST `admin_sales_backfill` without auth dependency \u2014 main.py:1899"}, "properties": {"repobilityId": "1cdd9901c399f36e", "scanner": "scanner-primary", "fingerprint": "1b5ff8321387e1c5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1899}}}]}, {"ruleId": "scanner-ed34a3d327115f67", "level": "error", "message": {"text": "FastAPI POST `admin_order_add` without auth dependency \u2014 main.py:1935"}, "properties": {"repobilityId": "49cad7528c241bd3", "scanner": "scanner-primary", "fingerprint": "ed34a3d327115f67", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1935}}}]}, {"ruleId": "scanner-ab722229be3ad3e1", "level": "error", "message": {"text": "FastAPI POST `admin_order_replace` without auth dependency \u2014 main.py:1941"}, "properties": {"repobilityId": "3e13cc8ea45212fb", "scanner": "scanner-primary", "fingerprint": "ab722229be3ad3e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1941}}}]}, {"ruleId": "scanner-ba0091524b6d62ae", "level": "error", "message": {"text": "FastAPI DELETE `admin_order_delete` without auth dependency \u2014 main.py:1948"}, "properties": {"repobilityId": "e2a64f91552931f4", "scanner": "scanner-primary", "fingerprint": "ba0091524b6d62ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1948}}}]}, {"ruleId": "scanner-34ed14804cfb99fe", "level": "error", "message": {"text": "FastAPI POST `admin_order_clear` without auth dependency \u2014 main.py:1954"}, "properties": {"repobilityId": "67295dd71e508ffd", "scanner": "scanner-primary", "fingerprint": "34ed14804cfb99fe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 1954}}}]}, {"ruleId": "scanner-95352fc336231cbb", "level": "error", "message": {"text": "FastAPI POST `wa_send` without auth dependency \u2014 main.py:2018"}, "properties": {"repobilityId": "5c79ec13f3a3e754", "scanner": "scanner-primary", "fingerprint": "95352fc336231cbb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2018}}}]}, {"ruleId": "scanner-89a43a9400febe7d", "level": "error", "message": {"text": "FastAPI POST `wa_send_template` without auth dependency \u2014 main.py:2030"}, "properties": {"repobilityId": "799692a9970f3261", "scanner": "scanner-primary", "fingerprint": "89a43a9400febe7d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2030}}}]}, {"ruleId": "scanner-5ab4b15cf61baeb3", "level": "error", "message": {"text": "FastAPI POST `wa_archive_old` without auth dependency \u2014 main.py:2052"}, "properties": {"repobilityId": "9b35171b9dfc80f4", "scanner": "scanner-primary", "fingerprint": "5ab4b15cf61baeb3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2052}}}]}, {"ruleId": "scanner-a6f67f924a7e0ac5", "level": "error", "message": {"text": "FastAPI POST `wa_archive` without auth dependency \u2014 main.py:2070"}, "properties": {"repobilityId": "ee71771f18dbc3b4", "scanner": "scanner-primary", "fingerprint": "a6f67f924a7e0ac5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2070}}}]}, {"ruleId": "scanner-cc2358248a040424", "level": "error", "message": {"text": "FastAPI POST `wa_human` without auth dependency \u2014 main.py:2077"}, "properties": {"repobilityId": "9d43817e98d9dfc8", "scanner": "scanner-primary", "fingerprint": "cc2358248a040424", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2077}}}]}, {"ruleId": "scanner-5d8e25668f3f3093", "level": "error", "message": {"text": "FastAPI POST `wa_tag` without auth dependency \u2014 main.py:2128"}, "properties": {"repobilityId": "2948484719479ace", "scanner": "scanner-primary", "fingerprint": "5d8e25668f3f3093", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2128}}}]}, {"ruleId": "scanner-9e129614fd19353d", "level": "error", "message": {"text": "FastAPI POST `wa_note_add` without auth dependency \u2014 main.py:2135"}, "properties": {"repobilityId": "e7e544cd53429c10", "scanner": "scanner-primary", "fingerprint": "9e129614fd19353d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2135}}}]}, {"ruleId": "scanner-2627dbdcf933ce4e", "level": "error", "message": {"text": "FastAPI DELETE `wa_note_del` without auth dependency \u2014 main.py:2142"}, "properties": {"repobilityId": "b47061007e2ba0b9", "scanner": "scanner-primary", "fingerprint": "2627dbdcf933ce4e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2142}}}]}, {"ruleId": "scanner-103a64b14fb0a109", "level": "error", "message": {"text": "FastAPI POST `wa_star` without auth dependency \u2014 main.py:2148"}, "properties": {"repobilityId": "2950d3d225d04932", "scanner": "scanner-primary", "fingerprint": "103a64b14fb0a109", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2148}}}]}, {"ruleId": "scanner-63a3fb6f1e344006", "level": "error", "message": {"text": "FastAPI POST `wa_send_file` without auth dependency \u2014 main.py:2156"}, "properties": {"repobilityId": "75786e1d4fd0627b", "scanner": "scanner-primary", "fingerprint": "63a3fb6f1e344006", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2156}}}]}, {"ruleId": "scanner-14db095c158a78af", "level": "error", "message": {"text": "FastAPI POST `wa_send_wa_template` without auth dependency \u2014 main.py:2203"}, "properties": {"repobilityId": "b88724c0b8fc2c82", "scanner": "scanner-primary", "fingerprint": "14db095c158a78af", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2203}}}]}, {"ruleId": "scanner-03c2bf62938fae25", "level": "error", "message": {"text": "FastAPI POST `wa_canned_add` without auth dependency \u2014 main.py:2210"}, "properties": {"repobilityId": "17f7842ff7aaeb26", "scanner": "scanner-primary", "fingerprint": "03c2bf62938fae25", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2210}}}]}, {"ruleId": "scanner-0a9a0956a71406ae", "level": "error", "message": {"text": "FastAPI DELETE `wa_canned_del` without auth dependency \u2014 main.py:2217"}, "properties": {"repobilityId": "5200b24d70e673ec", "scanner": "scanner-primary", "fingerprint": "0a9a0956a71406ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2217}}}]}, {"ruleId": "scanner-70b6352423b958b0", "level": "error", "message": {"text": "FastAPI POST `uri_ask` without auth dependency \u2014 main.py:2243"}, "properties": {"repobilityId": "7f6ac2600591f036", "scanner": "scanner-primary", "fingerprint": "70b6352423b958b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2243}}}]}, {"ruleId": "scanner-3fc04e237bb11d41", "level": "error", "message": {"text": "FastAPI POST `bridge_answer` without auth dependency \u2014 main.py:2295"}, "properties": {"repobilityId": "ce850045459a74c1", "scanner": "scanner-primary", "fingerprint": "3fc04e237bb11d41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2295}}}]}, {"ruleId": "scanner-1f902e5a280da29c", "level": "error", "message": {"text": "FastAPI POST `bridge_note` without auth dependency \u2014 main.py:2335"}, "properties": {"repobilityId": "213128ad723dffff", "scanner": "scanner-primary", "fingerprint": "1f902e5a280da29c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2335}}}]}, {"ruleId": "scanner-6f74a05d44566716", "level": "error", "message": {"text": "FastAPI POST `payplus_ipn` without auth dependency \u2014 main.py:2502"}, "properties": {"repobilityId": "df1d60dfb00ebd08", "scanner": "scanner-primary", "fingerprint": "6f74a05d44566716", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2502}}}]}, {"ruleId": "scanner-9cc0d33c2ca57b00", "level": "error", "message": {"text": "FastAPI POST `admin_order_return` without auth dependency \u2014 main.py:2879"}, "properties": {"repobilityId": "fd5e44b3436320fd", "scanner": "scanner-primary", "fingerprint": "9cc0d33c2ca57b00", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2879}}}]}, {"ruleId": "scanner-421cbfcc44acdd13", "level": "error", "message": {"text": "FastAPI POST `admin_order_auto_transfer` without auth dependency \u2014 main.py:2920"}, "properties": {"repobilityId": "b500001c9eb43f95", "scanner": "scanner-primary", "fingerprint": "421cbfcc44acdd13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2920}}}]}, {"ruleId": "scanner-032d09f8edfbf062", "level": "error", "message": {"text": "FastAPI POST `admin_order_status` without auth dependency \u2014 main.py:2961"}, "properties": {"repobilityId": "fca50454e04358ce", "scanner": "scanner-primary", "fingerprint": "032d09f8edfbf062", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2961}}}]}, {"ruleId": "scanner-a6394e9f9747a66f", "level": "error", "message": {"text": "FastAPI POST `admin_order_status_schedule` without auth dependency \u2014 main.py:2998"}, "properties": {"repobilityId": "ef9b57c166155d2a", "scanner": "scanner-primary", "fingerprint": "a6394e9f9747a66f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 2998}}}]}, {"ruleId": "scanner-ed5f344ba68b0824", "level": "error", "message": {"text": "FastAPI DELETE `admin_scheduled_status_cancel` without auth dependency \u2014 main.py:3039"}, "properties": {"repobilityId": "ad1f7a0547c0115f", "scanner": "scanner-primary", "fingerprint": "ed5f344ba68b0824", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3039}}}]}, {"ruleId": "scanner-1b703631ec382831", "level": "error", "message": {"text": "FastAPI POST `admin_invoice_send` without auth dependency \u2014 main.py:3242"}, "properties": {"repobilityId": "2fda5802b773e863", "scanner": "scanner-primary", "fingerprint": "1b703631ec382831", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3242}}}]}, {"ruleId": "scanner-eb88100f8d3c9b77", "level": "error", "message": {"text": "FastAPI POST `admin_invoices_capture` without auth dependency \u2014 main.py:3262"}, "properties": {"repobilityId": "a2f7e4ad563bd785", "scanner": "scanner-primary", "fingerprint": "eb88100f8d3c9b77", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3262}}}]}, {"ruleId": "scanner-4ff23d4009b78b9d", "level": "error", "message": {"text": "FastAPI DELETE `admin_order_trash` without auth dependency \u2014 main.py:3292"}, "properties": {"repobilityId": "7a62650978e3694f", "scanner": "scanner-primary", "fingerprint": "4ff23d4009b78b9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3292}}}]}, {"ruleId": "scanner-b9193ea2000b5b85", "level": "error", "message": {"text": "FastAPI POST `admin_order_cargo` without auth dependency \u2014 main.py:3347"}, "properties": {"repobilityId": "33a490e4807d6743", "scanner": "scanner-primary", "fingerprint": "b9193ea2000b5b85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3347}}}]}, {"ruleId": "scanner-e4e5898da9d04131", "level": "error", "message": {"text": "FastAPI POST `admin_order_note` without auth dependency \u2014 main.py:3401"}, "properties": {"repobilityId": "e0492cf9cb50d30b", "scanner": "scanner-primary", "fingerprint": "e4e5898da9d04131", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3401}}}]}, {"ruleId": "scanner-3dfdf739ac0566d4", "level": "error", "message": {"text": "FastAPI POST `admin_order_customer` without auth dependency \u2014 main.py:3425"}, "properties": {"repobilityId": "b0f7c1906cda0114", "scanner": "scanner-primary", "fingerprint": "3dfdf739ac0566d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3425}}}]}, {"ruleId": "scanner-4048e27db1a141c9", "level": "error", "message": {"text": "FastAPI POST `pay_standalone` without auth dependency \u2014 main.py:3457"}, "properties": {"repobilityId": "3d3ff3a2a1b78ca4", "scanner": "scanner-primary", "fingerprint": "4048e27db1a141c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3457}}}]}, {"ruleId": "scanner-3f9c2d168110ca12", "level": "error", "message": {"text": "FastAPI POST `wa_order_create` without auth dependency \u2014 main.py:3679"}, "properties": {"repobilityId": "bc850fd9787fb26e", "scanner": "scanner-primary", "fingerprint": "3f9c2d168110ca12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3679}}}]}, {"ruleId": "scanner-cb2c3cc32ca950e1", "level": "error", "message": {"text": "FastAPI POST `wa_send_guaranteed` without auth dependency \u2014 main.py:3785"}, "properties": {"repobilityId": "77a3f7226425c7b1", "scanner": "scanner-primary", "fingerprint": "cb2c3cc32ca950e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3785}}}]}, {"ruleId": "scanner-b3a30024b71b600f", "level": "error", "message": {"text": "FastAPI POST `wa_schedule` without auth dependency \u2014 main.py:3862"}, "properties": {"repobilityId": "ced98111a4078ab3", "scanner": "scanner-primary", "fingerprint": "b3a30024b71b600f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3862}}}]}, {"ruleId": "scanner-83587dcc48670aea", "level": "error", "message": {"text": "FastAPI DELETE `wa_scheduled_cancel` without auth dependency \u2014 main.py:3886"}, "properties": {"repobilityId": "5df6bb0682d4cc64", "scanner": "scanner-primary", "fingerprint": "83587dcc48670aea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3886}}}]}, {"ruleId": "scanner-cf8a8e43884a4841", "level": "error", "message": {"text": "FastAPI POST `wa_order_charge` without auth dependency \u2014 main.py:3957"}, "properties": {"repobilityId": "bd20dca53b7b9d73", "scanner": "scanner-primary", "fingerprint": "cf8a8e43884a4841", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 3957}}}]}, {"ruleId": "scanner-231d5d6388ba63c4", "level": "error", "message": {"text": "FastAPI POST `wa_push_subscribe` without auth dependency \u2014 main.py:4026"}, "properties": {"repobilityId": "ed4cb56abd31f877", "scanner": "scanner-primary", "fingerprint": "231d5d6388ba63c4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 4026}}}]}, {"ruleId": "scanner-3b75310929dd2af9", "level": "error", "message": {"text": "FastAPI POST `wa_push_test` without auth dependency \u2014 main.py:4033"}, "properties": {"repobilityId": "aa7a888e7a277ec1", "scanner": "scanner-primary", "fingerprint": "3b75310929dd2af9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 4033}}}]}, {"ruleId": "scanner-97cd3b13854db0e9", "level": "note", "message": {"text": "Unused endpoint: GET /api/wa/webhook"}, "properties": {"repobilityId": "3c09f6945edbc24b", "scanner": "scanner-primary", "fingerprint": "97cd3b13854db0e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d68a015f281582d", "level": "note", "message": {"text": "Unused endpoint: POST /api/wa/webhook"}, "properties": {"repobilityId": "f213d31213ab75fd", "scanner": "scanner-primary", "fingerprint": "0d68a015f281582d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e955768430f7b38", "level": "note", "message": {"text": "Unused endpoint: GET /api/wa/media"}, "properties": {"repobilityId": "67c4d7ddff09ce68", "scanner": "scanner-primary", "fingerprint": "3e955768430f7b38", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52f5c84fef4b38e5", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/wa/store-stats"}, "properties": {"repobilityId": "6c212cb1342902a0", "scanner": "scanner-primary", "fingerprint": "52f5c84fef4b38e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52747ef5f5111812", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/wa/backfill"}, "properties": {"repobilityId": "2cc87c9890e079d8", "scanner": "scanner-primary", "fingerprint": "52747ef5f5111812", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a951f52fc7f3755a", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/wa/backfill/stop"}, "properties": {"repobilityId": "2355833068cf06f6", "scanner": "scanner-primary", "fingerprint": "a951f52fc7f3755a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c24f131f3aeb6152", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/wa/conversations-native"}, "properties": {"repobilityId": "3e14f2b72fd47fc7", "scanner": "scanner-primary", "fingerprint": "c24f131f3aeb6152", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9bdc4c50ed40fbad", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/wa/thread-native/{phone}"}, "properties": {"repobilityId": "0e6e18bf1cf7533c", "scanner": "scanner-primary", "fingerprint": "9bdc4c50ed40fbad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7aa4b2518cbbbfa2", "level": "note", "message": {"text": "Unused endpoint: GET /api/config"}, "properties": {"repobilityId": "8a44937ecac021bf", "scanner": "scanner-primary", "fingerprint": "7aa4b2518cbbbfa2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc1b63be5d263466", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/login"}, "properties": {"repobilityId": "5f0f221e5f5f9425", "scanner": "scanner-primary", "fingerprint": "bc1b63be5d263466", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-36f0ff5fafcfaa4b", "level": "note", "message": {"text": "Unused endpoint: GET /api/branches"}, "properties": {"repobilityId": "7bf55a7d1d98d200", "scanner": "scanner-primary", "fingerprint": "36f0ff5fafcfaa4b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f54802578f2f0d2c", "level": "note", "message": {"text": "Unused endpoint: GET /api/transfers"}, "properties": {"repobilityId": "e939f7f573e1ab19", "scanner": "scanner-primary", "fingerprint": "f54802578f2f0d2c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af6403f524f43b6d", "level": "note", "message": {"text": "Unused endpoint: GET /api/transfers/{op_id}"}, "properties": {"repobilityId": "7bd94c77ee7c1483", "scanner": "scanner-primary", "fingerprint": "af6403f524f43b6d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-47f6c74748ea2eec", "level": "note", "message": {"text": "Unused endpoint: POST /api/transfers/{op_id}/close"}, "properties": {"repobilityId": "205fd8ae9ec51669", "scanner": "scanner-primary", "fingerprint": "47f6c74748ea2eec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c60f4d5b3ed2d108", "level": "note", "message": {"text": "Unused endpoint: POST /api/scan"}, "properties": {"repobilityId": "88778b79350f4041", "scanner": "scanner-primary", "fingerprint": "c60f4d5b3ed2d108", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b37265900e79a8a", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats"}, "properties": {"repobilityId": "08436ac894f509fb", "scanner": "scanner-primary", "fingerprint": "3b37265900e79a8a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-270b11d60b0ae8b8", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/broadcast"}, "properties": {"repobilityId": "12e4ef0d84a12c19", "scanner": "scanner-primary", "fingerprint": "270b11d60b0ae8b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f52e44b9e8d45ee", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/broadcasts"}, "properties": {"repobilityId": "1d0f4c98c6feb603", "scanner": "scanner-primary", "fingerprint": "4f52e44b9e8d45ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf27b4971f052e7e", "level": "note", "message": {"text": "Unused endpoint: GET /api/broadcast"}, "properties": {"repobilityId": "f1c1cbeb25170d18", "scanner": "scanner-primary", "fingerprint": "bf27b4971f052e7e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a8d455c4c2af509f", "level": "note", "message": {"text": "Unused endpoint: POST /api/broadcast/dismiss"}, "properties": {"repobilityId": "a4a2ca2a175f07be", "scanner": "scanner-primary", "fingerprint": "a8d455c4c2af509f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e150ecfd4e11c48c", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/overview"}, "properties": {"repobilityId": "6a68cef8206edc54", "scanner": "scanner-primary", "fingerprint": "e150ecfd4e11c48c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b6da9daa0ccb924", "level": "note", "message": {"text": "Unused endpoint: POST /api/poll"}, "properties": {"repobilityId": "dc1c7406fa47984e", "scanner": "scanner-primary", "fingerprint": "1b6da9daa0ccb924", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-78b0da9fa0759844", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/serial-sync"}, "properties": {"repobilityId": "24cf62ae7633523b", "scanner": "scanner-primary", "fingerprint": "78b0da9fa0759844", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7afa1dc476370c79", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/serial-index"}, "properties": {"repobilityId": "62a27b62b617cbab", "scanner": "scanner-primary", "fingerprint": "7afa1dc476370c79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4d1553c09f2642b9", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/rebalance"}, "properties": {"repobilityId": "b7d03ff7d2e46598", "scanner": "scanner-primary", "fingerprint": "4d1553c09f2642b9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c951995d6171461c", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/plan"}, "properties": {"repobilityId": "70fdf9520d53fb92", "scanner": "scanner-primary", "fingerprint": "c951995d6171461c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6977fecab4f46d4e", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/plan"}, "properties": {"repobilityId": "6130d37663d341a2", "scanner": "scanner-primary", "fingerprint": "6977fecab4f46d4e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e09adc0cd6e0cb9", "level": "note", "message": {"text": "Unused endpoint: GET /plan-action"}, "properties": {"repobilityId": "1804a4d601e2b06e", "scanner": "scanner-primary", "fingerprint": "1e09adc0cd6e0cb9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f2b9bee3b28d5489", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/plan/replace"}, "properties": {"repobilityId": "1ad0af00418c09c5", "scanner": "scanner-primary", "fingerprint": "f2b9bee3b28d5489", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cac22669243af22f", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/admin/plan/{pid}"}, "properties": {"repobilityId": "de9fa12b0322b300", "scanner": "scanner-primary", "fingerprint": "cac22669243af22f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34ca78883ddea7d5", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/plan/clear"}, "properties": {"repobilityId": "45d34376743f7aba", "scanner": "scanner-primary", "fingerprint": "34ca78883ddea7d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-915ac390d7d0381a", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/rebalance-scan"}, "properties": {"repobilityId": "d561f62ecadf5720", "scanner": "scanner-primary", "fingerprint": "915ac390d7d0381a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68c7a4473f1039de", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/numeric-receivers"}, "properties": {"repobilityId": "911764c7c6780254", "scanner": "scanner-primary", "fingerprint": "68c7a4473f1039de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-682f461d32e5ac66", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/relabel-receiver"}, "properties": {"repobilityId": "0bac0f549726ec37", "scanner": "scanner-primary", "fingerprint": "682f461d32e5ac66", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-23198aae6d0a88ed", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/misroute/{mid}/resolve"}, "properties": {"repobilityId": "d7e33fdae52ca876", "scanner": "scanner-primary", "fingerprint": "23198aae6d0a88ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89ee0682fb20c904", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/recommendations"}, "properties": {"repobilityId": "5d31b0888fe21485", "scanner": "scanner-primary", "fingerprint": "89ee0682fb20c904", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d457c47fbc20ab76", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/catalog-refresh"}, "properties": {"repobilityId": "3439ae63b7d3421f", "scanner": "scanner-primary", "fingerprint": "d457c47fbc20ab76", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05bcecda44bea41c", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/live-search/catalog"}, "properties": {"repobilityId": "8aae2f955be3e731", "scanner": "scanner-primary", "fingerprint": "05bcecda44bea41c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63896b1169772972", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/live-search/serial"}, "properties": {"repobilityId": "3ccd3da7c5efb2ca", "scanner": "scanner-primary", "fingerprint": "63896b1169772972", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63fa8d79731c38b0", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/live-stock/{pid}"}, "properties": {"repobilityId": "87031b58f4540138", "scanner": "scanner-primary", "fingerprint": "63fa8d79731c38b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-507a49c333c4ec35", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/wc-link/{sku}"}, "properties": {"repobilityId": "4ed834fb95e9d2f2", "scanner": "scanner-primary", "fingerprint": "507a49c333c4ec35", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a8f1ebef3e50ecd4", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/wc-search"}, "properties": {"repobilityId": "0936b4792d1710b3", "scanner": "scanner-primary", "fingerprint": "a8f1ebef3e50ecd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4549771dbf80202d", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/wc-connect"}, "properties": {"repobilityId": "99873f0435de146c", "scanner": "scanner-primary", "fingerprint": "4549771dbf80202d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb48fd2ec3346e05", "level": "note", "message": {"text": "Unused endpoint: POST /api/device/register"}, "properties": {"repobilityId": "dcfa3adf101f7743", "scanner": "scanner-primary", "fingerprint": "cb48fd2ec3346e05", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6fecc8618cca0bcc", "level": "note", "message": {"text": "Unused endpoint: GET /api/device/status"}, "properties": {"repobilityId": "ab6e281398a4f989", "scanner": "scanner-primary", "fingerprint": "6fecc8618cca0bcc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b4d931e4e6ca732", "level": "note", "message": {"text": "Unused endpoint: POST /api/device/branch-change"}, "properties": {"repobilityId": "e45243dfe88f9060", "scanner": "scanner-primary", "fingerprint": "2b4d931e4e6ca732", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ec5c48e88587d17", "level": "note", "message": {"text": "Unused endpoint: GET /api/device/branch-status"}, "properties": {"repobilityId": "346652555aeeef22", "scanner": "scanner-primary", "fingerprint": "7ec5c48e88587d17", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dd9f5e49b91628cb", "level": "note", "message": {"text": "Unused endpoint: GET /branch-action"}, "properties": {"repobilityId": "dedc6a2c6e4cc8c0", "scanner": "scanner-primary", "fingerprint": "dd9f5e49b91628cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-54202e5eedf322a1", "level": "note", "message": {"text": "Unused endpoint: GET /device-action"}, "properties": {"repobilityId": "5d92f55805e4e50b", "scanner": "scanner-primary", "fingerprint": "54202e5eedf322a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cda379c8cd718742", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/devices"}, "properties": {"repobilityId": "ae2e3b043dd34448", "scanner": "scanner-primary", "fingerprint": "cda379c8cd718742", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}