Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

wilsonA2000/NUEVOS-PROYECTOS

https://github.com/wilsonA2000/NUEVOS-PROYECTOS · scanned 2026-06-16 00:59 UTC (2 months, 1 week ago)

385 raw signals (0 security + 385 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 278 actionable findings from 1 signal source. 107 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
55.2
/100
Security checks
55
0 findings
System graph
55
100.0% cov · 278 findings
Critical
5
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 5 High 30 Medium 91 Low 131 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 278 Crowd 0 Layer: Software 8 Frontend 24 Hardware 4 Security 49 Cicd 2 Quality 120 Api 71
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 55.2/100 with 100.0% coverage. It contains 9287 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 385 findings — concentrated in quality (203), api (71), security (52). Risk profile is high: 8 critical, 30 high, 164 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 251 of 278 actionable findings. 385 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Secrets conf 1.00 3 occurrences Possible secret in frontend/playwright/helpers/mock-api.ts
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
lines 60, 61, 62
frontend/playwright/helpers/mock-api.ts:60, 61, 62 (3 hits)
critical System graph security Secrets conf 1.00 Possible secret in scripts/debug/diagnose_auth_issue.py
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
scripts/debug/diagnose_auth_issue.py:115
high System graph api Wiring conf 1.00 Dangling fetch: DELETE /api/v1/contracts/${contractId}/additional-clauses/${clause.id}/ (frontend/src/components/contracts/ContractClausesEditor.tsx:141)
`frontend/src/components/contracts/ContractClausesEditor.tsx:141` calls `DELETE /api/v1/contracts/${contractId}/additional-clauses/${clause.id}/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/contracts/<p>/addit…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/contracts/${contractId}/additional-clauses/ (frontend/src/components/contracts/ContractClausesEditor.tsx:89)
`frontend/src/components/contracts/ContractClausesEditor.tsx:89` calls `GET /api/v1/contracts/${contractId}/additional-clauses/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/contracts/<p>/additional-clauses` If…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://localhost:8000/api/properties/ (frontend/scripts/testing/quick_test.js:18)
`frontend/scripts/testing/quick_test.js:18` calls `GET http://localhost:8000/api/properties/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:8000/api/properties` If this points at an external API, pr…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://localhost:8000/api/properties/ (frontend/scripts/testing/quick_test.js:65)
`frontend/scripts/testing/quick_test.js:65` calls `GET http://localhost:8000/api/properties/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:8000/api/properties` If this points at an external API, pr…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.ipify.org?format=json (frontend/src/components/contracts/BiometricContractSigning.tsx:309)
`frontend/src/components/contracts/BiometricContractSigning.tsx:309` calls `GET https://api.ipify.org?format=json` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.ipify.org` If this points at an external A…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.mapbox.com/geocoding/v5/mapbox.places/${encodeURIComponent(addressInput)}.json (frontend/src/components/properties/PropertyForm.tsx:512)
`frontend/src/components/properties/PropertyForm.tsx:512` calls `GET https://api.mapbox.com/geocoding/v5/mapbox.places/${encodeURIComponent(addressInput)}.json` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/https:/…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.mapbox.com/geocoding/v5/mapbox.places/${encodeURIComponent(query)}.json (frontend/src/components/properties/PropertyForm.tsx:775)
`frontend/src/components/properties/PropertyForm.tsx:775` calls `GET https://api.mapbox.com/geocoding/v5/mapbox.places/${encodeURIComponent(query)}.json` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/https:/api.map…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.mapbox.com/geocoding/v5/mapbox.places/${lng},${lat}.json (frontend/src/components/properties/PropertyForm.tsx:686)
`frontend/src/components/properties/PropertyForm.tsx:686` calls `GET https://api.mapbox.com/geocoding/v5/mapbox.places/${lng},${lat}.json` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/https:/api.mapbox.com/geocodi…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: GET https://nominatim.openstreetmap.org/search (frontend/src/components/properties/PropertyForm.tsx:458)
`frontend/src/components/properties/PropertyForm.tsx:458` calls `GET https://nominatim.openstreetmap.org/search` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/https:/nominatim.openstreetmap.org/search` If this poin…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: HEAD /api/v1/users/auth/login/ (frontend/src/services/loggingService.ts:619)
`frontend/src/services/loggingService.ts:619` calls `HEAD /api/v1/users/auth/login/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/users/auth/login` If this points at an external API, prefix it with `https://` s…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: PATCH /api/v1/requests/api/documents/process/${processId}/checklist/ (frontend/src/components/contracts/LandlordDocumentReview.tsx:122)
`frontend/src/components/contracts/LandlordDocumentReview.tsx:122` calls `PATCH /api/v1/requests/api/documents/process/${processId}/checklist/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/requests/api/document…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/contracts/workflow-action/ (frontend/src/components/contracts/LandlordContractForm.tsx:1033)
`frontend/src/components/contracts/LandlordContractForm.tsx:1033` calls `POST /api/v1/contracts/workflow-action/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/contracts/workflow-action` If this points at an ext…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/core/log-error/ (frontend/src/components/contracts/ContractsErrorBoundary.tsx:92)
`frontend/src/components/contracts/ContractsErrorBoundary.tsx:92` calls `POST /api/v1/core/log-error/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/core/log-error` If this points at an external API, prefix it w…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/core/log-error/ (frontend/src/components/payments/PaymentsErrorBoundary.tsx:90)
`frontend/src/components/payments/PaymentsErrorBoundary.tsx:90` calls `POST /api/v1/core/log-error/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/core/log-error` If this points at an external API, prefix it wit…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/core/log-error/ (frontend/src/components/ratings/RatingsErrorBoundary.tsx:90)
`frontend/src/components/ratings/RatingsErrorBoundary.tsx:90` calls `POST /api/v1/core/log-error/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/core/log-error` If this points at an external API, prefix it with …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/push/subscribe/ (frontend/src/hooks/useServiceWorker.ts:267)
`frontend/src/hooks/useServiceWorker.ts:267` calls `POST /api/v1/push/subscribe/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/push/subscribe` If this points at an external API, prefix it with `https://` so the…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/push/unsubscribe/ (frontend/src/hooks/useServiceWorker.ts:291)
`frontend/src/hooks/useServiceWorker.ts:291` calls `POST /api/v1/push/unsubscribe/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/push/unsubscribe` If this points at an external API, prefix it with `https://` so…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/users/${candidateId}/evaluation/ (frontend/src/components/requests/CandidateEvaluationView.tsx:234)
`frontend/src/components/requests/CandidateEvaluationView.tsx:234` calls `POST /api/v1/users/${candidateId}/evaluation/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/users/<p>/evaluation` If this points at an e…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/users/auth/resend-confirmation/ (frontend/src/pages/auth/EmailVerification.tsx:31)
`frontend/src/pages/auth/EmailVerification.tsx:31` calls `POST /api/v1/users/auth/resend-confirmation/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/users/auth/resend-confirmation` If this points at an external…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/users/auth/validate-interview-code/ (frontend/src/pages/auth/RegisterWithCode.tsx:173)
`frontend/src/pages/auth/RegisterWithCode.tsx:173` calls `POST /api/v1/users/auth/validate-interview-code/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/users/auth/validate-interview-code` If this points at an …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://localhost:8000/api/properties/ (frontend/scripts/testing/quick_test.js:51)
`frontend/scripts/testing/quick_test.js:51` calls `POST http://localhost:8000/api/properties/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:8000/api/properties` If this points at an external API, p…
Dangling fetchFetch
high System graph security auth conf 1.00 DRF view `CachedStatsViewSet` declares no `permission_classes` — core/optimizations.py:389
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
core/optimizations.py:389 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `InterviewCodeVerificationView` declares no `permission_classes` — users/api_views.py:821
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
users/api_views.py:821 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `OptimizedContractViewSet` declares no `permission_classes` — core/optimizations.py:304
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
core/optimizations.py:304 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `OptimizedPropertyViewSet` declares no `permission_classes` — core/optimizations.py:244
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
core/optimizations.py:244 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `OptimizedPropertyViewSet` declares no `permission_classes` — properties/optimized_views.py:57
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
properties/optimized_views.py:57 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `OptimizedTransactionViewSet` declares no `permission_classes` — core/optimizations.py:333
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
core/optimizations.py:333 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `PropertyViewSet` declares no `permission_classes` — properties/api_views.py:60
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
properties/api_views.py:60 securityAuth drf no permission classes
high System graph security auth conf 1.00 DRF view `StartBiometricAuthenticationAPIView` declares no `permission_classes` — contracts/api_views.py:1517
DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings.
contracts/api_views.py:1517 securityAuth drf no permission classes
high System graph security security conf 1.00 Insecure pattern 'eval_used' in properties/serializers.py:355
Found a known-risky pattern (eval_used). Review and replace if possible.
properties/serializers.py:355 Eval used
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/components/ErrorBoundary.tsx:134
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/scripts/testing/quick_test.js:65
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/contracts/ContractClausesEditor.tsx:186
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/contracts/EnhancedTenantDocumentUpload.tsx:698
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/contracts/LandlordDocumentReview.tsx:190
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/requests/CandidateEvaluationView.tsx:202
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/hooks/useServiceWorker.ts:267
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/utils/contractPdfUtils.ts:20
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security auth conf 1.00 Django CBV `CustomTokenObtainPairView` lacks `LoginRequiredMixin` — users/api_views.py:1369
Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding.
users/api_views.py:1369 Auth django unauth view
medium System graph security auth conf 1.00 Django CBV `PayPalWebhookView` lacks `LoginRequiredMixin` — payments/views.py:370
Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding.
payments/views.py:370 Auth django unauth view
medium System graph security auth conf 1.00 Django CBV `StripeWebhookView` lacks `LoginRequiredMixin` — payments/views.py:363
Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding.
payments/views.py:363 Auth django unauth view
medium System graph security auth conf 1.00 Django CBV `UserProfileView` lacks `LoginRequiredMixin` — users/api_views.py:88
Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding.
users/api_views.py:88 Auth django unauth view
medium System graph security auth conf 1.00 Django view `api_admin_actions_on_user` may be unauthenticated — users/user_views.py:308
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
users/user_views.py:308 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `api_mark_notification_read` may be unauthenticated — users/user_views.py:349
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
users/user_views.py:349 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `api_user_activity_summary` may be unauthenticated — users/user_views.py:252
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
users/user_views.py:252 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `api_user_notifications` may be unauthenticated — users/user_views.py:265
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
users/user_views.py:265 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `confirm_key_delivery` may be unauthenticated — contracts/api_views.py:4080
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
contracts/api_views.py:4080 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `create_interview_code` may be unauthenticated — users/api_views.py:1219
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
users/api_views.py:1219 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `delete_tenant_document` may be unauthenticated — requests/document_api_views.py:584
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
requests/document_api_views.py:584 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `document_access_history` may be unauthenticated — requests/document_api_views.py:919
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
requests/document_api_views.py:919 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `document_stats_for_landlord` may be unauthenticated — requests/document_api_views.py:619
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
requests/document_api_views.py:619 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_client_ip` may be unauthenticated — core/api_views.py:41
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:41 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `health_check` may be unauthenticated — core/api_views.py:689
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:689 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `maintenance_clear_cache` may be unauthenticated — core/api_views.py:1259
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:1259 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `maintenance_clear_logs` may be unauthenticated — core/api_views.py:1242
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:1242 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `maintenance_clear_sessions` may be unauthenticated — core/api_views.py:1276
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:1276 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `maintenance_health_check` may be unauthenticated — core/api_views.py:1173
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:1173 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `maintenance_optimize_db` may be unauthenticated — core/api_views.py:1296
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
core/api_views.py:1296 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `send_biometric_reminder` may be unauthenticated — contracts/api_views.py:3984
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
contracts/api_views.py:3984 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `start_contract_execution` may be unauthenticated — contracts/api_views.py:4139
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
contracts/api_views.py:4139 securityAuth django unauth view
medium System graph hardware Security conf 1.00 Dockerfile runs as root: frontend/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph quality Integrity conf 1.00 Frontend route `/app/admin/*` has no Link/navigate to it — frontend/src/components/auth/AdminProtectedRoute.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
Orphan pageWiring
medium System graph quality Integrity conf 1.00 7 occurrences Frontend route `/codeudor-auth/:token` has no Link/navigate to it — frontend/src/routes/index.lazy.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
7 occurrences
repo-level (7 hits)
Orphan pageWiring
medium System graph quality Integrity conf 1.00 32 occurrences Frontend route `/confirm-email/:key` has no Link/navigate to it — frontend/src/routes/index.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
32 occurrences
repo-level (32 hits)
Orphan pageWiring
medium System graph quality Integrity conf 1.00 6 occurrences Frontend route `/matched-candidates` has no Link/navigate to it — frontend/src/routes/contracts.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
6 occurrences
repo-level (6 hits)
Orphan pageWiring
medium System graph quality Integrity conf 1.00 3 occurrences Frontend route `/new` has no Link/navigate to it — frontend/src/routes/properties.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
3 occurrences
repo-level (3 hits)
Orphan pageWiring
medium System graph quality Integrity conf 1.00 2 occurrences Frontend route `/thread/:threadId` has no Link/navigate to it — frontend/src/routes/messages.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
2 occurrences
repo-level (2 hits)
Orphan pageWiring
medium System graph quality Integrity conf 1.00 16 occurrences Frontend route `/unified` has no Link/navigate to it — frontend/src/routes/contractsDashboard.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
16 occurrences
repo-level (16 hits)
Orphan pageWiring
medium System graph quality Integrity conf 1.00 13 occurrences Frontend route `contracts` has no Link/navigate to it — frontend/src/routes/admin.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
13 occurrences
repo-level (13 hits)
Orphan pageWiring
medium System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
pre-commit/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 2 locations
.github/workflows/ci-cd.yml:138
.github/workflows/deploy.yml:50
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/components/ErrorBoundary.tsx:134
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
frontend/src/components/ErrorBoundary.tsx:134 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in frontend/public/clear-cache.html:123
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
frontend/public/clear-cache.html:123 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in frontend/src/services/authService.ts:141
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
frontend/src/services/authService.ts:141 Local storage auth token
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in scripts/debug/diagnose_auth_issue.py:90
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
scripts/debug/diagnose_auth_issue.py:90 Local storage auth token
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in frontend/playwright/global-setup-e2e.ts:11
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/playwright/global-setup-e2e.ts:11 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in frontend/playwright/helpers/multi-user-logger.ts:17
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/playwright/helpers/multi-user-logger.ts:17 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in frontend/scripts/cache/cleanup-console-logs.js:5
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/cache/cleanup-console-logs.js:5 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in frontend/scripts/fixes/complete-contract-fix.js:11
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/fixes/complete-contract-fix.js:11 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in frontend/scripts/fixes/fix-rollup.js:5
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/fixes/fix-rollup.js:5 Node child process
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for act in …` triggers a query per row — verification/api_views.py:911
The loop iterates a Django queryset and accesses `act.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 quer…
verification/api_views.py:911 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for act in …` triggers a query per row — verification/services/hash_chain.py:151
The loop iterates a Django queryset and accesses `act.lawyer_signed_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1…
verification/services/hash_chain.py:151 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for c in …` triggers a query per row — core/api_views.py:607
The loop iterates a Django queryset and accesses `c.landlord.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries ins…
core/api_views.py:607 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for clause in …` triggers a query per row — contracts/api_views.py:1118
The loop iterates a Django queryset and accesses `clause.created_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 …
contracts/api_views.py:1118 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — contracts/admin_approval_api.py:55
The loop iterates a Django queryset and accesses `contract.landlord.get_full_name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in …
contracts/admin_approval_api.py:55 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — contracts/management/commands/process_contract_notifications.py:145
The loop iterates a Django queryset and accesses `contract.primary_party.get_full_name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everythin…
contracts/management/commands/process_contract_notifications.py:145 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — contracts/tasks.py:67
The loop iterates a Django queryset and accesses `contract.admin_review_deadline.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load every…
contracts/tasks.py:67 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — dashboard/views.py:596
The loop iterates a Django queryset and accesses `contract.property.title` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 quer…
dashboard/views.py:596 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — dashboard/views.py:784
The loop iterates a Django queryset and accesses `contract.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2…
dashboard/views.py:784 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — dashboard/views.py:826
The loop iterates a Django queryset and accesses `contract.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2…
dashboard/views.py:826 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — ratings/analytics.py:644
The loop iterates a Django queryset and accesses `contract.property.title` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 quer…
ratings/analytics.py:644 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — scripts/debug/check_workflow_status.py:52
The loop iterates a Django queryset and accesses `contract.landlord.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 quer…
scripts/debug/check_workflow_status.py:52 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for contract in …` triggers a query per row — scripts/debug/debug_contract_404.py:65
The loop iterates a Django queryset and accesses `contract.tenant.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 querie…
scripts/debug/debug_contract_404.py:65 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for doc in …` triggers a query per row — requests/document_api_views.py:386
The loop iterates a Django queryset and accesses `doc.document_type.startswith` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2…
requests/document_api_views.py:386 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for doc in …` triggers a query per row — requests/document_api_views.py:646
The loop iterates a Django queryset and accesses `doc.property_request.property` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-…
requests/document_api_views.py:646 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for match in …` triggers a query per row — matching/services.py:492
The loop iterates a Django queryset and accesses `match.property.title` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries…
matching/services.py:492 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for message in …` triggers a query per row — messaging/advanced_api_views.py:564
The loop iterates a Django queryset and accesses `message.reply_to.sent_at` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 que…
messaging/advanced_api_views.py:564 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for message in …` triggers a query per row — messaging/consumers.py:318
The loop iterates a Django queryset and accesses `message.thread.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries in…
messaging/consumers.py:318 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for message in …` triggers a query per row — messaging/notifications.py:117
The loop iterates a Django queryset and accesses `message.thread.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries in…
messaging/notifications.py:117 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for mr in …` triggers a query per row — scripts/debug/check_workflow_status.py:36
The loop iterates a Django queryset and accesses `mr.tenant.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries inst…
scripts/debug/check_workflow_status.py:36 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for mr in …` triggers a query per row — scripts/debug/debug_contract_approval.py:51
The loop iterates a Django queryset and accesses `mr.property.landlord` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries…
scripts/debug/debug_contract_approval.py:51 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for payment in …` triggers a query per row — dashboard/views.py:570
The loop iterates a Django queryset and accesses `payment.property.landlord` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 qu…
dashboard/views.py:570 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for payment in …` triggers a query per row — payments/reminder_service.py:453
The loop iterates a Django queryset and accesses `payment.due_date.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 qu…
payments/reminder_service.py:453 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for profile in …` triggers a query per row — ratings/management/commands/update_rating_profiles.py:129
The loop iterates a Django queryset and accesses `profile.user.get_full_name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 q…
ratings/management/commands/update_rating_profiles.py:129 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for prop in …` triggers a query per row — scripts/fixes/clean_matching_processes.py:94
The loop iterates a Django queryset and accesses `prop.landlord.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries …
scripts/fixes/clean_matching_processes.py:94 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for property in …` triggers a query per row — matching/api_views.py:669
The loop iterates a Django queryset and accesses `property.landlord.get_full_name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in …
matching/api_views.py:669 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for question in …` triggers a query per row — messaging/advanced_messaging.py:423
The loop iterates a Django queryset and accesses `question.sender.get_full_name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-…
messaging/advanced_messaging.py:423 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for request_obj in …` triggers a query per row — verification/management/commands/auto_assign_agents.py:78
The loop iterates a Django queryset and accesses `request_obj.user.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queri…
verification/management/commands/auto_assign_agents.py:78 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for schedule in …` triggers a query per row — payments/api_views.py:1591
The loop iterates a Django queryset and accesses `schedule.contract.property` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 q…
payments/api_views.py:1591 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for schedule in …` triggers a query per row — payments/auto_charge_service.py:46
The loop iterates a Django queryset and accesses `schedule.last_payment_date.month` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in…
payments/auto_charge_service.py:46 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for sr in …` triggers a query per row — dashboard/views.py:861
The loop iterates a Django queryset and accesses `sr.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queri…
dashboard/views.py:861 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for transaction in …` triggers a query per row — dashboard/views.py:765
The loop iterates a Django queryset and accesses `transaction.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in …
dashboard/views.py:765 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for transaction in …` triggers a query per row — dashboard/views.py:809
The loop iterates a Django queryset and accesses `transaction.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in …
dashboard/views.py:809 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for transaction in …` triggers a query per row — dashboard/views.py:882
The loop iterates a Django queryset and accesses `transaction.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in …
dashboard/views.py:882 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for transaction in …` triggers a query per row — dashboard/views.py:903
The loop iterates a Django queryset and accesses `transaction.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in …
dashboard/views.py:903 N plus onePerformance
medium System graph quality Integrity conf 1.00 Likely N+1 query: `for video in …` triggers a query per row — scripts/debug/debug_video_issue.py:116
The loop iterates a Django queryset and accesses `video.video.url` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries inst…
scripts/debug/debug_video_issue.py:116 N plus onePerformance
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/utilities/verify_optimizations.py:21
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 197 placeholder/mock markers across 80 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
low System graph quality Integrity conf 1.00 33 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `ANALYZE`, `BIOMETRIC_DOCUMENT_PROVIDER`, `BIOMETRIC_FACIAL_PROVIDER`, `BIOMETRIC_MIN_FACE_QUALITY`, `BIOMETRIC_MIN_FACE_SIMILARITY`, `BIOMETRIC_VOICE_PROVIDER`, `CI`, `DEBUG_TESTS` + 25 more. Add them (with a placeholder/comment) to .env.example s…
config drift
low System graph quality Maintenance conf 1.00 50 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 1217 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: nginx:alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
frontend/Dockerfile:13 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:18-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
frontend/Dockerfile:2 containersPinned dependencies
low System graph cicd CI/CD security conf 1.00 21 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
3 files, 21 locations
.github/workflows/ci-cd.yml:60, 63, 88, 91, 119, 122, 127, 146, +11 more (19 hits)
.github/workflows/deploy.yml:47
.github/workflows/lighthouse.yml:23
CI/CD securitySupply chainGithub actions
low System graph security security conf 1.00 Insecure pattern 'document_write' in frontend/src/components/ExportButton.tsx:214
Found a known-risky pattern (document_write). Review and replace if possible.
frontend/src/components/ExportButton.tsx:214 Document write
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 11 places
Functions with the same first-5-line body hash: users/permissions.py:has_permission, users/permissions.py:has_permission, users/permissions.py:has_permission, users/permissions.py:has_permission This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-cod…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 14 places
Functions with the same first-5-line body hash: users/api_views.py:get_serializer_class, users/api_views.py:get, users/api_views.py:get, users/api_views.py:get This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 17 places
Functions with the same first-5-line body hash: verification/tests.py:setUp, verification/tests.py:setUp, verification/tests.py:setUp, verification/tests.py:setUp This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or docum…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 19 places
Functions with the same first-5-line body hash: users/api_views.py:post, users/api_views.py:post, users/api_views.py:post, users/api_views.py:post This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're …
duplicatesduplication
low System graph quality Integrity conf 1.00 4 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: users/api_interview.py:get_serializer_class, users/api_interview.py:get_serializer_class This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
4 occurrences
repo-level (4 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 5 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: users/api_interview.py:post, users/api_interview.py:post, users/api_interview.py:post This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
5 occurrences
repo-level (5 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 5 occurrences Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: users/views.py:form_valid, users/views.py:form_valid, users/views.py:form_valid, users/views.py:form_valid This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why …
5 occurrences
repo-level (5 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 8 places
Functions with the same first-5-line body hash: users/permissions.py:has_object_permission, users/permissions.py:has_object_permission, users/permissions.py:has_object_permission, users/permissions.py:has_object_permission This is *the* AI-coder failure mode (4× more duplication in vibe-coded repo…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 9 places
Functions with the same first-5-line body hash: users/api_views.py:put, users/api_views.py:patch, users/api_views.py:put, users/api_views.py:patch This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're …
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `days_old` in messaging/notifications.py:553
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `heuristic_v1` in contracts/biometric_providers/local.py:183
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `id_copy` in frontend/src/types/landlordContract.ts:418
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `receipt_too_old` in frontend/playwright/tests/fase-c9-vhid-public-receipt.spec.ts:158
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `receipt_too_old` in frontend/src/components/verihome-id/PublicReceiptUploader.tsx:50
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `receipt_too_old` in frontend/src/services/publicReceiptApi.ts:14
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `receipt_too_old` in verification/api_views.py:1353
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `receipt_too_old` in verification/tests.py:1743
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_can_follow_up_true_old` in matching/tests.py:209
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `var_copy` in contracts/admin.py:720
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_expired_codes
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/utils.py:209
low System graph software Dead code conf 1.00 Possibly dead Python function: is_open_for_signup
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/adapters.py:49
low System graph software Dead code conf 1.00 Possibly dead Python function: lookups
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/admin_interview.py:19
low System graph software Dead code conf 1.00 Possibly dead Python function: queryset
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/admin_interview.py:28
low System graph software Dead code conf 1.00 Possibly dead Python function: rating_display
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/admin_interview.py:72
low System graph software Dead code conf 1.00 Possibly dead Python function: send_interview_code_email
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/utils.py:84
low System graph software Dead code conf 1.00 Possibly dead Python function: send_interview_notification_to_admin
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/utils.py:115
low System graph software Dead code conf 1.00 Possibly dead Python function: validate_interview_code
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
users/utils.py:149
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/cypress.config.ts:19
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/playwright/global-setup-e2e.ts:44
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/playwright/helpers/multi-user-logger.ts:126
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/playwright/tests/contract-workflow.spec.ts:84
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/playwright/tests/multi-user-contract-signing.spec.ts:290
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/cache/cleanup-console-logs.js:7
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/cache/clear-browser-cache.js:28
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/cache/force-cache-clear-complete.js:4
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/cache/force-cache-clear.js:4
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/cache/force-clear-cache.js:4
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/cache/nuclear-cache-clear.js:16
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/fixes/complete-contract-fix.js:31
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/fixes/fix-contract-errors.js:14
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/fixes/fix-rollup.js:7
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/fixes/force-reload-contracts.js:28
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/testing/quick_test.js:4
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/scripts/testing/verify-contract-fixes.js:27
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/src/test-utils/integrationSetup.ts:479
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/src/test-utils/integrationTestRunner.ts:134
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/src/test-utils/testSuiteRunner.ts:106
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/src/utils/performanceMonitor.ts:262
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — frontend/vite.config.ts:423
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — scripts/maintenance/force_refresh_all.js:2
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph api Wiring conf 1.00 Unused endpoint: ANY /activity/
`users/user_urls.py` declares `ANY /activity/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /activity/<int:activity_id>/
`users/user_urls.py` declares `ANY /activity/<int:activity_id>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /activity/history/
`users/user_urls.py` declares `ANY /activity/history/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /admin-actions/
`users/user_urls.py` declares `ANY /admin-actions/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /admin-actions/<int:action_id>/
`users/user_urls.py` declares `ANY /admin-actions/<int:action_id>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /api/activity-summary/
`users/user_urls.py` declares `ANY /api/activity-summary/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /api/admin-actions/
`users/user_urls.py` declares `ANY /api/admin-actions/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /api/notifications/
`users/user_urls.py` declares `ANY /api/notifications/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /api/notifications/<int:notification_id>/read/
`users/user_urls.py` declares `ANY /api/notifications/<int:notification_id>/read/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /impersonation-history/
`users/user_urls.py` declares `ANY /impersonation-history/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /interview/admin/
`users/urls_interview.py` declares `ANY /interview/admin/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /interview/codes
`users/urls_interview.py` declares `ANY /interview/codes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /interview/contact-requests
`users/urls_interview.py` declares `ANY /interview/contact-requests` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /interview/contact/
`users/urls_interview.py` declares `ANY /interview/contact/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /interview/register-with-code/
`users/urls_interview.py` declares `ANY /interview/register-with-code/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /interview/validate-interview-code/
`users/urls_interview.py` declares `ANY /interview/validate-interview-code/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /notifications/
`users/user_urls.py` declares `ANY /notifications/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /notifications/<int:notification_id>/read/
`users/user_urls.py` declares `ANY /notifications/<int:notification_id>/read/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /notifications/read-all/
`users/user_urls.py` declares `ANY /notifications/read-all/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/
`users/api_urls.py` declares `ANY /users/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/activity-logs/create/
`users/api_urls.py` declares `ANY /users/activity-logs/create/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/activity-logs/stats/
`users/api_urls.py` declares `ANY /users/activity-logs/stats/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/activity-logs/types/
`users/api_urls.py` declares `ANY /users/activity-logs/types/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/change-password/
`users/api_urls.py` declares `ANY /users/auth/change-password/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/confirm-email/<path:key>/
`users/api_urls.py` declares `ANY /users/auth/confirm-email/<path:key>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/forgot-password/
`users/api_urls.py` declares `ANY /users/auth/forgot-password/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/login/
`users/api_urls.py` declares `ANY /users/auth/login/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/logout/
`users/api_urls.py` declares `ANY /users/auth/logout/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/me/
`users/api_urls.py` declares `ANY /users/auth/me/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/refresh/
`users/api_urls.py` declares `ANY /users/auth/refresh/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/register-with-code/
`users/api_urls.py` declares `ANY /users/auth/register-with-code/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/register-with-interview/
`users/api_urls.py` declares `ANY /users/auth/register-with-interview/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/register/
`users/api_urls.py` declares `ANY /users/auth/register/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/resend-confirmation/
`users/api_urls.py` declares `ANY /users/auth/resend-confirmation/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/reset-password/
`users/api_urls.py` declares `ANY /users/auth/reset-password/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/auth/validate-interview-code/
`users/api_urls.py` declares `ANY /users/auth/validate-interview-code/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/contact/
`users/api_urls.py` declares `ANY /users/contact/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/interview/
`users/api_urls.py` declares `ANY /users/interview/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/search/
`users/api_urls.py` declares `ANY /users/search/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/verification/request/
`users/api_urls.py` declares `ANY /users/verification/request/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/verification/status/
`users/api_urls.py` declares `ANY /users/verification/status/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /users/verification/upload-documents/
`users/api_urls.py` declares `ANY /users/verification/upload-documents/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/configuracion/
`users/urls.py` declares `ANY /usuarios/configuracion/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/hoja-vida/
`users/urls.py` declares `ANY /usuarios/hoja-vida/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/hoja-vida/editar/
`users/urls.py` declares `ANY /usuarios/hoja-vida/editar/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/perfil/
`users/urls.py` declares `ANY /usuarios/perfil/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/perfil/editar/
`users/urls.py` declares `ANY /usuarios/perfil/editar/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/proveedores-servicios/
`users/urls.py` declares `ANY /usuarios/proveedores-servicios/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/registro/entrevista/
`users/urls.py` declares `ANY /usuarios/registro/entrevista/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /usuarios/registro/seleccionar/
`users/urls.py` declares `ANY /usuarios/registro/seleccionar/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: contracts/api_views.py (4209 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: contracts/biometric_service.py (1700 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: contracts/landlord_api_views.py (1883 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: contracts/landlord_contract_models.py (2160 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: contracts/pdf_generator.py (3719 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/ContractDraftEditor.tsx (1540 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/EnhancedTenantDocumentUpload.tsx (1781 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/LandlordContractForm.tsx (5162 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/MatchedCandidatesView.tsx (2092 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/TenantContractsDashboard.tsx (1903 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/TenantContractView.tsx (1481 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/contracts/TenantDataForm.tsx (1406 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/matching/MatchesDashboard.tsx (1590 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/properties/PropertyDetail.tsx (1919 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/properties/PropertyForm.tsx (2325 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/pages/auth/RegisterWithCode.tsx (1716 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/pages/dashboard/NewDashboard.tsx (1738 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: matching/api_views.py (1606 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: payments/api_views.py (2443 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: users/api_views.py (2252 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: verification/api_views.py (1395 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: verification/tests.py (1827 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/f4e0b852-31ae-40cf-a568-8b165112c013/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/f4e0b852-31ae-40cf-a568-8b165112c013/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.