{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0a8ea31279bc8ddb", "name": "Possibly dead Python function: isatty", "shortDescription": {"text": "Possibly dead Python function: isatty"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f235e626450a5293", "name": "Possibly dead Python function: reload", "shortDescription": {"text": "Possibly dead Python function: reload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a73c18ac624acc20", "name": "Possibly dead Python function: update_channel_metadata", "shortDescription": {"text": "Possibly dead Python function: update_channel_metadata"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28514a758b121a6c", "name": "Possibly dead Python function: update_user_metadata", "shortDescription": {"text": "Possibly dead Python function: update_user_metadata"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-169bfd8ff5f61f11", "name": "Possibly dead Python function: set_token_counter", "shortDescription": {"text": "Possibly dead Python function: set_token_counter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1051959da573c4d5", "name": "Possibly dead Python function: read_url", "shortDescription": {"text": "Possibly dead Python function: read_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2dcbfa65663459fd", "name": "Possibly dead Python function: crawl_website", "shortDescription": {"text": "Possibly dead Python function: crawl_website"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57d4d7dd238df7cb", "name": "Possibly dead Python function: replacer", "shortDescription": {"text": "Possibly dead Python function: replacer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f0f9976570faa6d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68a2b8f5c8cd6b53", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ce8614dd03f409", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "5 tests / 24 src (ratio 0.21)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 154 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b7b40ef4dfd51b42", "name": "Legacy-named symbol `_split_message_legacy` in dango/utils/discord_helpers.py:409", "shortDescription": {"text": "Legacy-named symbol `_split_message_legacy` in dango/utils/discord_helpers.py:409"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c61e011c22e0dbb", "name": "Commented-code block (5 lines) in dango/steps/call_agent.py:29", "shortDescription": {"text": "Commented-code block (5 lines) in dango/steps/call_agent.py:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad1f2c0971b89ce0", "name": "10 env vars used in code but missing from .env.example", "shortDescription": {"text": "10 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `COMPOSE_PROJECT_NAME`, `DATA_DIR`, `DEEP_BASE_URL`, `DOCKER_SOCKET`, `ENABLE_CUSTOM_APIS`, `ENABLE_SQL_DATABASES`, `FAST_BASE_URL`, `GEMINI_TEMPERATURE` + 2 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9dad557909b86499", "name": "Near-duplicate function bodies in 10 places", "shortDescription": {"text": "Near-duplicate function bodies in 10 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndango/commands/admin_commands.py:addchannel, dango/commands/admin_commands.py:removechannel, dango/commands/admin_commands.py:listchannels, dango/commands/admin_commands.py:adduser\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-204081485d8af22c", "name": "FastAPI POST `setup_complete` without auth dependency \u2014 web/main.py:136", "shortDescription": {"text": "FastAPI POST `setup_complete` without auth dependency \u2014 web/main.py:136"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2646265c126c387a", "name": "FastAPI POST `clear_logs` without auth dependency \u2014 web/main.py:220", "shortDescription": {"text": "FastAPI POST `clear_logs` without auth dependency \u2014 web/main.py:220"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1d3846a5d779e8b", "name": "FastAPI POST `bot_start` without auth dependency \u2014 web/main.py:290", "shortDescription": {"text": "FastAPI POST `bot_start` without auth dependency \u2014 web/main.py:290"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ec6a78e00679497", "name": "FastAPI POST `bot_stop` without auth dependency \u2014 web/main.py:299", "shortDescription": {"text": "FastAPI POST `bot_stop` without auth dependency \u2014 web/main.py:299"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-17687e3357082ff0", "name": "FastAPI POST `bot_restart` without auth dependency \u2014 web/main.py:308", "shortDescription": {"text": "FastAPI POST `bot_restart` without auth dependency \u2014 web/main.py:308"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-db226bfa130b9aeb", "name": "FastAPI POST `shutdown_all` without auth dependency \u2014 web/main.py:317", "shortDescription": {"text": "FastAPI POST `shutdown_all` without auth dependency \u2014 web/main.py:317"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5542c01a5a05b47a", "name": "FastAPI POST `validate_discord` without auth dependency \u2014 web/main.py:339", "shortDescription": {"text": "FastAPI POST `validate_discord` without auth dependency \u2014 web/main.py:339"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-494a05216553420c", "name": "FastAPI POST `validate_google` without auth dependency \u2014 web/main.py:358", "shortDescription": {"text": "FastAPI POST `validate_google` without auth dependency \u2014 web/main.py:358"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e3f032f4c03e0b42", "name": "FastAPI POST `save_prompt` without auth dependency \u2014 web/main.py:384", "shortDescription": {"text": "FastAPI POST `save_prompt` without auth dependency \u2014 web/main.py:384"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23d1c3e62bc8f0de", "name": "FastAPI POST `save_discord` without auth dependency \u2014 web/main.py:392", "shortDescription": {"text": "FastAPI POST `save_discord` without auth dependency \u2014 web/main.py:392"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d5c0ec447690652a", "name": "FastAPI POST `save_fast_model` without auth dependency \u2014 web/main.py:401", "shortDescription": {"text": "FastAPI POST `save_fast_model` without auth dependency \u2014 web/main.py:401"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ecb6fc2c5f034a76", "name": "FastAPI POST `save_deep_model` without auth dependency \u2014 web/main.py:416", "shortDescription": {"text": "FastAPI POST `save_deep_model` without auth dependency \u2014 web/main.py:416"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82faca89b040f9f0", "name": "FastAPI POST `save_features` without auth dependency \u2014 web/main.py:431", "shortDescription": {"text": "FastAPI POST `save_features` without auth dependency \u2014 web/main.py:431"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7726e44cfc4687e", "name": "FastAPI POST `save_google_settings` without auth dependency \u2014 web/main.py:454", "shortDescription": {"text": "FastAPI POST `save_google_settings` without auth dependency \u2014 web/main.py:454"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-61bf8b161647df85", "name": "FastAPI POST `save_advanced` without auth dependency \u2014 web/main.py:492", "shortDescription": {"text": "FastAPI POST `save_advanced` without auth dependency \u2014 web/main.py:492"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d315455f7e43689c", "name": "FastAPI POST `save_workspace` without auth dependency \u2014 web/main.py:506", "shortDescription": {"text": "FastAPI POST `save_workspace` without auth dependency \u2014 web/main.py:506"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-76d66ed8d890f4a3", "name": "FastAPI POST `save_runtime_settings` without auth dependency \u2014 web/main.py:518", "shortDescription": {"text": "FastAPI POST `save_runtime_settings` without auth dependency \u2014 web/main.py:518"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2da52e93237fe725", "name": "FastAPI POST `add_runtime_channel` without auth dependency \u2014 web/main.py:535", "shortDescription": {"text": "FastAPI POST `add_runtime_channel` without auth dependency \u2014 web/main.py:535"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f98bebc850f880a0", "name": "FastAPI POST `delete_runtime_channel` without auth dependency \u2014 web/main.py:548", "shortDescription": {"text": "FastAPI POST `delete_runtime_channel` without auth dependency \u2014 web/main.py:548"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25cdb6df599c9b0a", "name": "FastAPI POST `add_runtime_user` without auth dependency \u2014 web/main.py:557", "shortDescription": {"text": "FastAPI POST `add_runtime_user` without auth dependency \u2014 web/main.py:557"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bcdc40c4a6cc8e86", "name": "FastAPI POST `delete_runtime_user` without auth dependency \u2014 web/main.py:570", "shortDescription": {"text": "FastAPI POST `delete_runtime_user` without auth dependency \u2014 web/main.py:570"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8a1a2d5d8ea7494", "name": "FastAPI POST `save_workspace_prompt` without auth dependency \u2014 web/main.py:579", "shortDescription": {"text": "FastAPI POST `save_workspace_prompt` without auth dependency \u2014 web/main.py:579"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47f957a2a28833b5", "name": "FastAPI POST `save_apis_enable` without auth dependency \u2014 web/main.py:634", "shortDescription": {"text": "FastAPI POST `save_apis_enable` without auth dependency \u2014 web/main.py:634"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ac3c3730e9fe992", "name": "FastAPI POST `add_custom_api` without auth dependency \u2014 web/main.py:642", "shortDescription": {"text": "FastAPI POST `add_custom_api` without auth dependency \u2014 web/main.py:642"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d786f732294a3d87", "name": "FastAPI POST `delete_custom_api` without auth dependency \u2014 web/main.py:661", "shortDescription": {"text": "FastAPI POST `delete_custom_api` without auth dependency \u2014 web/main.py:661"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68bd7e905d1732ea", "name": "FastAPI POST `save_dbs_enable` without auth dependency \u2014 web/main.py:672", "shortDescription": {"text": "FastAPI POST `save_dbs_enable` without auth dependency \u2014 web/main.py:672"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e4e1a87a1db6bb7", "name": "FastAPI POST `add_sql_database` without auth dependency \u2014 web/main.py:680", "shortDescription": {"text": "FastAPI POST `add_sql_database` without auth dependency \u2014 web/main.py:680"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7b5aa2ea416ca36", "name": "FastAPI POST `delete_sql_database` without auth dependency \u2014 web/main.py:697", "shortDescription": {"text": "FastAPI POST `delete_sql_database` without auth dependency \u2014 web/main.py:697"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`web/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d86afd7dd2beb431", "name": "Unused endpoint: GET /setup", "shortDescription": {"text": "Unused endpoint: GET /setup"}, "fullDescription": {"text": "`web/main.py` declares `GET /setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c61fd7b42fa61534", "name": "Unused endpoint: POST /setup/complete", "shortDescription": {"text": "Unused endpoint: POST /setup/complete"}, "fullDescription": {"text": "`web/main.py` declares `POST /setup/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d504b80adc9409ec", "name": "Unused endpoint: GET /dashboard", "shortDescription": {"text": "Unused endpoint: GET /dashboard"}, "fullDescription": {"text": "`web/main.py` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac2f552bf9d967ce", "name": "Unused endpoint: GET /overview", "shortDescription": {"text": "Unused endpoint: GET /overview"}, "fullDescription": {"text": "`web/main.py` declares `GET /overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a054bdd71e0061ea", "name": "Unused endpoint: GET /prompt", "shortDescription": {"text": "Unused endpoint: GET /prompt"}, "fullDescription": {"text": "`web/main.py` declares `GET /prompt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`web/main.py` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f73639ffd7a9369", "name": "Unused endpoint: GET /discord", "shortDescription": {"text": "Unused endpoint: GET /discord"}, "fullDescription": {"text": "`web/main.py` declares `GET /discord` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-582b00fca2796501", "name": "Unused endpoint: GET /tools", "shortDescription": {"text": "Unused endpoint: GET /tools"}, "fullDescription": {"text": "`web/main.py` declares `GET /tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdee4181e59a2ecd", "name": "Unused endpoint: POST /api/logs/clear", "shortDescription": {"text": "Unused endpoint: POST /api/logs/clear"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/logs/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3bf72f059406b13", "name": "Unused endpoint: GET /api/logs", "shortDescription": {"text": "Unused endpoint: GET /api/logs"}, "fullDescription": {"text": "`web/main.py` declares `GET /api/logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24475177da6a77be", "name": "Unused endpoint: GET /api/bot/status", "shortDescription": {"text": "Unused endpoint: GET /api/bot/status"}, "fullDescription": {"text": "`web/main.py` declares `GET /api/bot/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a68877793f94788", "name": "Unused endpoint: POST /api/bot/start", "shortDescription": {"text": "Unused endpoint: POST /api/bot/start"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/bot/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c23567db72506bae", "name": "Unused endpoint: POST /api/bot/stop", "shortDescription": {"text": "Unused endpoint: POST /api/bot/stop"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/bot/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb97d5083076ac10", "name": "Unused endpoint: POST /api/bot/restart", "shortDescription": {"text": "Unused endpoint: POST /api/bot/restart"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/bot/restart` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31f3786c75ac7934", "name": "Unused endpoint: POST /api/shutdown", "shortDescription": {"text": "Unused endpoint: POST /api/shutdown"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/shutdown` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-629bcfb19d757908", "name": "Unused endpoint: POST /api/validate/discord", "shortDescription": {"text": "Unused endpoint: POST /api/validate/discord"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/validate/discord` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf5c57bab2616428", "name": "Unused endpoint: POST /api/validate/google", "shortDescription": {"text": "Unused endpoint: POST /api/validate/google"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/validate/google` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa437c39b68e3e8d", "name": "Unused endpoint: POST /api/config/prompt", "shortDescription": {"text": "Unused endpoint: POST /api/config/prompt"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/prompt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34805006f8ffa1ea", "name": "Unused endpoint: POST /api/config/discord", "shortDescription": {"text": "Unused endpoint: POST /api/config/discord"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/discord` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85aa79e5e227e52b", "name": "Unused endpoint: POST /api/config/models/fast", "shortDescription": {"text": "Unused endpoint: POST /api/config/models/fast"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/models/fast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf7b4b734ff60af7", "name": "Unused endpoint: POST /api/config/models/deep", "shortDescription": {"text": "Unused endpoint: POST /api/config/models/deep"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/models/deep` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aea9314bf2d70872", "name": "Unused endpoint: POST /api/config/features", "shortDescription": {"text": "Unused endpoint: POST /api/config/features"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/features` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3abf250867823ff", "name": "Unused endpoint: POST /api/config/google", "shortDescription": {"text": "Unused endpoint: POST /api/config/google"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/google` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baebc582cc3fd99", "name": "Unused endpoint: POST /api/config/advanced", "shortDescription": {"text": "Unused endpoint: POST /api/config/advanced"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/advanced` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fc83ae62070ad3a", "name": "Unused endpoint: POST /api/config/workspace", "shortDescription": {"text": "Unused endpoint: POST /api/config/workspace"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/workspace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce8bdb87c0aa4591", "name": "Unused endpoint: POST /api/runtime/settings", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/settings"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/runtime/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-995215d94ee658e9", "name": "Unused endpoint: POST /api/runtime/channels/add", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/channels/add"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/runtime/channels/add` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fbe33541a31e3b8", "name": "Unused endpoint: POST /api/runtime/channels/{channel_id}/delete", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/channels/{channel_id}/delete"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/runtime/channels/{channel_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6a39c332673ff59", "name": "Unused endpoint: POST /api/runtime/users/add", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/users/add"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/runtime/users/add` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e086a7cd3255fd2d", "name": "Unused endpoint: POST /api/runtime/users/{user_id}/delete", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/users/{user_id}/delete"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/runtime/users/{user_id}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2da5b3a66545f121", "name": "Unused endpoint: POST /api/workspace-prompt", "shortDescription": {"text": "Unused endpoint: POST /api/workspace-prompt"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/workspace-prompt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ab21e8e60b51666", "name": "Unused endpoint: POST /api/config/tools/apis/enable", "shortDescription": {"text": "Unused endpoint: POST /api/config/tools/apis/enable"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/tools/apis/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbf597ef1ba0cca5", "name": "Unused endpoint: POST /api/config/tools/api", "shortDescription": {"text": "Unused endpoint: POST /api/config/tools/api"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/tools/api` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a17048f70c60e804", "name": "Unused endpoint: POST /api/config/tools/api/{index}/delete", "shortDescription": {"text": "Unused endpoint: POST /api/config/tools/api/{index}/delete"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/tools/api/{index}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e28ae64c68bb9a07", "name": "Unused endpoint: POST /api/config/tools/dbs/enable", "shortDescription": {"text": "Unused endpoint: POST /api/config/tools/dbs/enable"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/tools/dbs/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a617df636500b748", "name": "Unused endpoint: POST /api/config/tools/db", "shortDescription": {"text": "Unused endpoint: POST /api/config/tools/db"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/tools/db` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb3510d4c25070f4", "name": "Unused endpoint: POST /api/config/tools/db/{index}/delete", "shortDescription": {"text": "Unused endpoint: POST /api/config/tools/db/{index}/delete"}, "fullDescription": {"text": "`web/main.py` declares `POST /api/config/tools/db/{index}/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23632"}, "properties": {"repository": "zhiro-labs/dango", "repoUrl": "https://github.com/zhiro-labs/dango", "branch": "main"}, "results": [{"ruleId": "scanner-0a8ea31279bc8ddb", "level": "note", "message": {"text": "Possibly dead Python function: isatty"}, "properties": {"repobilityId": "080768c01df260e9", "scanner": "scanner-primary", "fingerprint": "0a8ea31279bc8ddb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:32"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f235e626450a5293", "level": "note", "message": {"text": "Possibly dead Python function: reload"}, "properties": {"repobilityId": "4d61f73bd081b724", "scanner": "scanner-primary", "fingerprint": "f235e626450a5293", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/utils/runtime_config.py:225"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a73c18ac624acc20", "level": "note", "message": {"text": "Possibly dead Python function: update_channel_metadata"}, "properties": {"repobilityId": "ee26a27ef7f856cf", "scanner": "scanner-primary", "fingerprint": "a73c18ac624acc20", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/utils/runtime_config.py:230"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28514a758b121a6c", "level": "note", "message": {"text": "Possibly dead Python function: update_user_metadata"}, "properties": {"repobilityId": "53bffe1172c01e71", "scanner": "scanner-primary", "fingerprint": "28514a758b121a6c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/utils/runtime_config.py:239"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-169bfd8ff5f61f11", "level": "note", "message": {"text": "Possibly dead Python function: set_token_counter"}, "properties": {"repobilityId": "346723955bbb388b", "scanner": "scanner-primary", "fingerprint": "169bfd8ff5f61f11", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/utils/complexity_router.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1051959da573c4d5", "level": "note", "message": {"text": "Possibly dead Python function: read_url"}, "properties": {"repobilityId": "2f6c134cb9305a76", "scanner": "scanner-primary", "fingerprint": "1051959da573c4d5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/steps/call_agent.py:383"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2dcbfa65663459fd", "level": "note", "message": {"text": "Possibly dead Python function: crawl_website"}, "properties": {"repobilityId": "dd013670366ff8f0", "scanner": "scanner-primary", "fingerprint": "2dcbfa65663459fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/steps/call_agent.py:394"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57d4d7dd238df7cb", "level": "note", "message": {"text": "Possibly dead Python function: replacer"}, "properties": {"repobilityId": "4c6d041d83cc4187", "scanner": "scanner-primary", "fingerprint": "57d4d7dd238df7cb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dango/steps/fetch_history.py:288"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "1de0ecd007803dbd", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "19a3e05b43a287b5", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "49f477cbbe083433", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f7d5d8fad9ae56d", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-68a2b8f5c8cd6b53", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0036b33690fe05ae", "scanner": "scanner-primary", "fingerprint": "68a2b8f5c8cd6b53", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4289fb2fbaf82766", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-14ce8614dd03f409", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81c5c697653f94e8", "scanner": "scanner-primary", "fingerprint": "14ce8614dd03f409", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f17d5c491720b0ce", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5c9c6e2bb05912fe", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3b568a7fce58003a", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b7b40ef4dfd51b42", "level": "note", "message": {"text": "Legacy-named symbol `_split_message_legacy` in dango/utils/discord_helpers.py:409"}, "properties": {"repobilityId": "8e8f21a01d1a7bd8", "scanner": "scanner-primary", "fingerprint": "b7b40ef4dfd51b42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7c61e011c22e0dbb", "level": "none", "message": {"text": "Commented-code block (5 lines) in dango/steps/call_agent.py:29"}, "properties": {"repobilityId": "6c8708d598b89b36", "scanner": "scanner-primary", "fingerprint": "7c61e011c22e0dbb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad1f2c0971b89ce0", "level": "note", "message": {"text": "10 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "3bfdc60c61f1870e", "scanner": "scanner-primary", "fingerprint": "ad1f2c0971b89ce0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-9dad557909b86499", "level": "note", "message": {"text": "Near-duplicate function bodies in 10 places"}, "properties": {"repobilityId": "a25459b1fc7b7766", "scanner": "scanner-primary", "fingerprint": "9dad557909b86499", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-204081485d8af22c", "level": "error", "message": {"text": "FastAPI POST `setup_complete` without auth dependency \u2014 web/main.py:136"}, "properties": {"repobilityId": "1a2d90f5d4be0aae", "scanner": "scanner-primary", "fingerprint": "204081485d8af22c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-2646265c126c387a", "level": "error", "message": {"text": "FastAPI POST `clear_logs` without auth dependency \u2014 web/main.py:220"}, "properties": {"repobilityId": "1186d04f98087270", "scanner": "scanner-primary", "fingerprint": "2646265c126c387a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-d1d3846a5d779e8b", "level": "error", "message": {"text": "FastAPI POST `bot_start` without auth dependency \u2014 web/main.py:290"}, "properties": {"repobilityId": "bd99e6d39c166aca", "scanner": "scanner-primary", "fingerprint": "d1d3846a5d779e8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-1ec6a78e00679497", "level": "error", "message": {"text": "FastAPI POST `bot_stop` without auth dependency \u2014 web/main.py:299"}, "properties": {"repobilityId": "c66fc2a186496e24", "scanner": "scanner-primary", "fingerprint": "1ec6a78e00679497", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-17687e3357082ff0", "level": "error", "message": {"text": "FastAPI POST `bot_restart` without auth dependency \u2014 web/main.py:308"}, "properties": {"repobilityId": "67ff63cae5379495", "scanner": "scanner-primary", "fingerprint": "17687e3357082ff0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 308}}}]}, {"ruleId": "scanner-db226bfa130b9aeb", "level": "error", "message": {"text": "FastAPI POST `shutdown_all` without auth dependency \u2014 web/main.py:317"}, "properties": {"repobilityId": "3dc1608124d0c4c0", "scanner": "scanner-primary", "fingerprint": "db226bfa130b9aeb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 317}}}]}, {"ruleId": "scanner-5542c01a5a05b47a", "level": "error", "message": {"text": "FastAPI POST `validate_discord` without auth dependency \u2014 web/main.py:339"}, "properties": {"repobilityId": "213fb6117e08c8df", "scanner": "scanner-primary", "fingerprint": "5542c01a5a05b47a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 339}}}]}, {"ruleId": "scanner-494a05216553420c", "level": "error", "message": {"text": "FastAPI POST `validate_google` without auth dependency \u2014 web/main.py:358"}, "properties": {"repobilityId": "702dbfab47ec0fcc", "scanner": "scanner-primary", "fingerprint": "494a05216553420c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 358}}}]}, {"ruleId": "scanner-e3f032f4c03e0b42", "level": "error", "message": {"text": "FastAPI POST `save_prompt` without auth dependency \u2014 web/main.py:384"}, "properties": {"repobilityId": "96d3e697af4ede19", "scanner": "scanner-primary", "fingerprint": "e3f032f4c03e0b42", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-23d1c3e62bc8f0de", "level": "error", "message": {"text": "FastAPI POST `save_discord` without auth dependency \u2014 web/main.py:392"}, "properties": {"repobilityId": "898ff5f646199bf3", "scanner": "scanner-primary", "fingerprint": "23d1c3e62bc8f0de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 392}}}]}, {"ruleId": "scanner-d5c0ec447690652a", "level": "error", "message": {"text": "FastAPI POST `save_fast_model` without auth dependency \u2014 web/main.py:401"}, "properties": {"repobilityId": "b8e20d4087ce27e4", "scanner": "scanner-primary", "fingerprint": "d5c0ec447690652a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 401}}}]}, {"ruleId": "scanner-ecb6fc2c5f034a76", "level": "error", "message": {"text": "FastAPI POST `save_deep_model` without auth dependency \u2014 web/main.py:416"}, "properties": {"repobilityId": "55fb3e5ec702ead0", "scanner": "scanner-primary", "fingerprint": "ecb6fc2c5f034a76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 416}}}]}, {"ruleId": "scanner-82faca89b040f9f0", "level": "error", "message": {"text": "FastAPI POST `save_features` without auth dependency \u2014 web/main.py:431"}, "properties": {"repobilityId": "06f54806add7530f", "scanner": "scanner-primary", "fingerprint": "82faca89b040f9f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 431}}}]}, {"ruleId": "scanner-f7726e44cfc4687e", "level": "error", "message": {"text": "FastAPI POST `save_google_settings` without auth dependency \u2014 web/main.py:454"}, "properties": {"repobilityId": "072063354941420e", "scanner": "scanner-primary", "fingerprint": "f7726e44cfc4687e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-61bf8b161647df85", "level": "error", "message": {"text": "FastAPI POST `save_advanced` without auth dependency \u2014 web/main.py:492"}, "properties": {"repobilityId": "47e6c5e88a411c28", "scanner": "scanner-primary", "fingerprint": "61bf8b161647df85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 492}}}]}, {"ruleId": "scanner-d315455f7e43689c", "level": "error", "message": {"text": "FastAPI POST `save_workspace` without auth dependency \u2014 web/main.py:506"}, "properties": {"repobilityId": "e3b39b0c1d2d17a1", "scanner": "scanner-primary", "fingerprint": "d315455f7e43689c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 506}}}]}, {"ruleId": "scanner-76d66ed8d890f4a3", "level": "error", "message": {"text": "FastAPI POST `save_runtime_settings` without auth dependency \u2014 web/main.py:518"}, "properties": {"repobilityId": "3a11704928685b9a", "scanner": "scanner-primary", "fingerprint": "76d66ed8d890f4a3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 518}}}]}, {"ruleId": "scanner-2da52e93237fe725", "level": "error", "message": {"text": "FastAPI POST `add_runtime_channel` without auth dependency \u2014 web/main.py:535"}, "properties": {"repobilityId": "68bb248f011e89fa", "scanner": "scanner-primary", "fingerprint": "2da52e93237fe725", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 535}}}]}, {"ruleId": "scanner-f98bebc850f880a0", "level": "error", "message": {"text": "FastAPI POST `delete_runtime_channel` without auth dependency \u2014 web/main.py:548"}, "properties": {"repobilityId": "dfd9a5c69204c2a4", "scanner": "scanner-primary", "fingerprint": "f98bebc850f880a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-25cdb6df599c9b0a", "level": "error", "message": {"text": "FastAPI POST `add_runtime_user` without auth dependency \u2014 web/main.py:557"}, "properties": {"repobilityId": "98ca557d019967d4", "scanner": "scanner-primary", "fingerprint": "25cdb6df599c9b0a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 557}}}]}, {"ruleId": "scanner-bcdc40c4a6cc8e86", "level": "error", "message": {"text": "FastAPI POST `delete_runtime_user` without auth dependency \u2014 web/main.py:570"}, "properties": {"repobilityId": "b8e2c6cd4067e9f8", "scanner": "scanner-primary", "fingerprint": "bcdc40c4a6cc8e86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 570}}}]}, {"ruleId": "scanner-d8a1a2d5d8ea7494", "level": "error", "message": {"text": "FastAPI POST `save_workspace_prompt` without auth dependency \u2014 web/main.py:579"}, "properties": {"repobilityId": "45aa2d6381ce6095", "scanner": "scanner-primary", "fingerprint": "d8a1a2d5d8ea7494", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 579}}}]}, {"ruleId": "scanner-47f957a2a28833b5", "level": "error", "message": {"text": "FastAPI POST `save_apis_enable` without auth dependency \u2014 web/main.py:634"}, "properties": {"repobilityId": "90a5b478678dec6c", "scanner": "scanner-primary", "fingerprint": "47f957a2a28833b5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 634}}}]}, {"ruleId": "scanner-9ac3c3730e9fe992", "level": "error", "message": {"text": "FastAPI POST `add_custom_api` without auth dependency \u2014 web/main.py:642"}, "properties": {"repobilityId": "c0b5fa874a90b5c0", "scanner": "scanner-primary", "fingerprint": "9ac3c3730e9fe992", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 642}}}]}, {"ruleId": "scanner-d786f732294a3d87", "level": "error", "message": {"text": "FastAPI POST `delete_custom_api` without auth dependency \u2014 web/main.py:661"}, "properties": {"repobilityId": "5223830b6a01b437", "scanner": "scanner-primary", "fingerprint": "d786f732294a3d87", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 661}}}]}, {"ruleId": "scanner-68bd7e905d1732ea", "level": "error", "message": {"text": "FastAPI POST `save_dbs_enable` without auth dependency \u2014 web/main.py:672"}, "properties": {"repobilityId": "64cc7e234b5f603b", "scanner": "scanner-primary", "fingerprint": "68bd7e905d1732ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 672}}}]}, {"ruleId": "scanner-3e4e1a87a1db6bb7", "level": "error", "message": {"text": "FastAPI POST `add_sql_database` without auth dependency \u2014 web/main.py:680"}, "properties": {"repobilityId": "9635347e05dbd141", "scanner": "scanner-primary", "fingerprint": "3e4e1a87a1db6bb7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 680}}}]}, {"ruleId": "scanner-d7b5aa2ea416ca36", "level": "error", "message": {"text": "FastAPI POST `delete_sql_database` without auth dependency \u2014 web/main.py:697"}, "properties": {"repobilityId": "648fdad4461e7c6e", "scanner": "scanner-primary", "fingerprint": "d7b5aa2ea416ca36", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/main.py"}, "region": {"startLine": 697}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "75beb32fa076c0aa", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d86afd7dd2beb431", "level": "note", "message": {"text": "Unused endpoint: GET /setup"}, "properties": {"repobilityId": "a9e7b0ede6d4fa5e", "scanner": "scanner-primary", "fingerprint": "d86afd7dd2beb431", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c61fd7b42fa61534", "level": "note", "message": {"text": "Unused endpoint: POST /setup/complete"}, "properties": {"repobilityId": "50fa5ba58ec53f3a", "scanner": "scanner-primary", "fingerprint": "c61fd7b42fa61534", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d504b80adc9409ec", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard"}, "properties": {"repobilityId": "47454e24c6723ef6", "scanner": "scanner-primary", "fingerprint": "d504b80adc9409ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac2f552bf9d967ce", "level": "note", "message": {"text": "Unused endpoint: GET /overview"}, "properties": {"repobilityId": "f5ead2fb9162c128", "scanner": "scanner-primary", "fingerprint": "ac2f552bf9d967ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a054bdd71e0061ea", "level": "note", "message": {"text": "Unused endpoint: GET /prompt"}, "properties": {"repobilityId": "580a525c62f9efee", "scanner": "scanner-primary", "fingerprint": "a054bdd71e0061ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "9ac834db5648998d", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f73639ffd7a9369", "level": "note", "message": {"text": "Unused endpoint: GET /discord"}, "properties": {"repobilityId": "3c2f173406705c9c", "scanner": "scanner-primary", "fingerprint": "1f73639ffd7a9369", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-582b00fca2796501", "level": "note", "message": {"text": "Unused endpoint: GET /tools"}, "properties": {"repobilityId": "b488053e651524cb", "scanner": "scanner-primary", "fingerprint": "582b00fca2796501", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cdee4181e59a2ecd", "level": "note", "message": {"text": "Unused endpoint: POST /api/logs/clear"}, "properties": {"repobilityId": "a561beaec3e74a51", "scanner": "scanner-primary", "fingerprint": "cdee4181e59a2ecd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f3bf72f059406b13", "level": "note", "message": {"text": "Unused endpoint: GET /api/logs"}, "properties": {"repobilityId": "20603328f87ffbba", "scanner": "scanner-primary", "fingerprint": "f3bf72f059406b13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-24475177da6a77be", "level": "note", "message": {"text": "Unused endpoint: GET /api/bot/status"}, "properties": {"repobilityId": "39002e5cdde7810a", "scanner": "scanner-primary", "fingerprint": "24475177da6a77be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a68877793f94788", "level": "note", "message": {"text": "Unused endpoint: POST /api/bot/start"}, "properties": {"repobilityId": "ce013f101b4182bb", "scanner": "scanner-primary", "fingerprint": "7a68877793f94788", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c23567db72506bae", "level": "note", "message": {"text": "Unused endpoint: POST /api/bot/stop"}, "properties": {"repobilityId": "8211268df9369f26", "scanner": "scanner-primary", "fingerprint": "c23567db72506bae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb97d5083076ac10", "level": "note", "message": {"text": "Unused endpoint: POST /api/bot/restart"}, "properties": {"repobilityId": "462104c5499c83dc", "scanner": "scanner-primary", "fingerprint": "cb97d5083076ac10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-31f3786c75ac7934", "level": "note", "message": {"text": "Unused endpoint: POST /api/shutdown"}, "properties": {"repobilityId": "a7e030858b435579", "scanner": "scanner-primary", "fingerprint": "31f3786c75ac7934", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-629bcfb19d757908", "level": "note", "message": {"text": "Unused endpoint: POST /api/validate/discord"}, "properties": {"repobilityId": "e926da18e7971c5d", "scanner": "scanner-primary", "fingerprint": "629bcfb19d757908", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf5c57bab2616428", "level": "note", "message": {"text": "Unused endpoint: POST /api/validate/google"}, "properties": {"repobilityId": "84668bbb613625bd", "scanner": "scanner-primary", "fingerprint": "cf5c57bab2616428", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa437c39b68e3e8d", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/prompt"}, "properties": {"repobilityId": "2789616fed2b3e00", "scanner": "scanner-primary", "fingerprint": "fa437c39b68e3e8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34805006f8ffa1ea", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/discord"}, "properties": {"repobilityId": "436cfd20b8edfc15", "scanner": "scanner-primary", "fingerprint": "34805006f8ffa1ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85aa79e5e227e52b", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/models/fast"}, "properties": {"repobilityId": "1a79d04f376703df", "scanner": "scanner-primary", "fingerprint": "85aa79e5e227e52b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf7b4b734ff60af7", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/models/deep"}, "properties": {"repobilityId": "30cf0bc9c260a443", "scanner": "scanner-primary", "fingerprint": "bf7b4b734ff60af7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aea9314bf2d70872", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/features"}, "properties": {"repobilityId": "f7c566c6739660b6", "scanner": "scanner-primary", "fingerprint": "aea9314bf2d70872", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e3abf250867823ff", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/google"}, "properties": {"repobilityId": "9e5c55d45c6850c6", "scanner": "scanner-primary", "fingerprint": "e3abf250867823ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baebc582cc3fd99", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/advanced"}, "properties": {"repobilityId": "91e0daab5b892cdf", "scanner": "scanner-primary", "fingerprint": "5baebc582cc3fd99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3fc83ae62070ad3a", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/workspace"}, "properties": {"repobilityId": "151362973fcc19b5", "scanner": "scanner-primary", "fingerprint": "3fc83ae62070ad3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce8bdb87c0aa4591", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/settings"}, "properties": {"repobilityId": "5f4e4fc7a4233379", "scanner": "scanner-primary", "fingerprint": "ce8bdb87c0aa4591", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-995215d94ee658e9", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/channels/add"}, "properties": {"repobilityId": "002e594cd46a89c6", "scanner": "scanner-primary", "fingerprint": "995215d94ee658e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9fbe33541a31e3b8", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/channels/{channel_id}/delete"}, "properties": {"repobilityId": "bb31c6a44fd85d3f", "scanner": "scanner-primary", "fingerprint": "9fbe33541a31e3b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6a39c332673ff59", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/users/add"}, "properties": {"repobilityId": "0405a6fd1ff1e4b0", "scanner": "scanner-primary", "fingerprint": "b6a39c332673ff59", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e086a7cd3255fd2d", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/users/{user_id}/delete"}, "properties": {"repobilityId": "66b288d941bbcc89", "scanner": "scanner-primary", "fingerprint": "e086a7cd3255fd2d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2da5b3a66545f121", "level": "note", "message": {"text": "Unused endpoint: POST /api/workspace-prompt"}, "properties": {"repobilityId": "c9730e24f46047a8", "scanner": "scanner-primary", "fingerprint": "2da5b3a66545f121", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4ab21e8e60b51666", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/tools/apis/enable"}, "properties": {"repobilityId": "d091b99bc1ae1160", "scanner": "scanner-primary", "fingerprint": "4ab21e8e60b51666", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cbf597ef1ba0cca5", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/tools/api"}, "properties": {"repobilityId": "73e3d7106ae90445", "scanner": "scanner-primary", "fingerprint": "cbf597ef1ba0cca5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a17048f70c60e804", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/tools/api/{index}/delete"}, "properties": {"repobilityId": "9a5cd20d5b0b8c6c", "scanner": "scanner-primary", "fingerprint": "a17048f70c60e804", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e28ae64c68bb9a07", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/tools/dbs/enable"}, "properties": {"repobilityId": "bdd8cab2fbae2d3e", "scanner": "scanner-primary", "fingerprint": "e28ae64c68bb9a07", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a617df636500b748", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/tools/db"}, "properties": {"repobilityId": "820a96a9acfa1418", "scanner": "scanner-primary", "fingerprint": "a617df636500b748", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb3510d4c25070f4", "level": "note", "message": {"text": "Unused endpoint: POST /api/config/tools/db/{index}/delete"}, "properties": {"repobilityId": "22509d9ae110826a", "scanner": "scanner-primary", "fingerprint": "eb3510d4c25070f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}