{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f6bf5ed9108bd6dc", "name": "Possibly dead Python function: upsert_image", "shortDescription": {"text": "Possibly dead Python function: upsert_image"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c1ce4638287cf0a", "name": "Possibly dead Python function: embed_text_query", "shortDescription": {"text": "Possibly dead Python function: embed_text_query"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b9383b197fea34b", "name": "Possibly dead Python function: create_group", "shortDescription": {"text": "Possibly dead Python function: create_group"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecbc43ada0f1abdf", "name": "Possibly dead Python function: join_group", "shortDescription": {"text": "Possibly dead Python function: join_group"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c213a7fa6c48c2d3", "name": "Possibly dead Python function: list_active_for_user", "shortDescription": {"text": "Possibly dead Python function: list_active_for_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c14684d71b9c5808", "name": "Possibly dead Python function: top_k_image", "shortDescription": {"text": "Possibly dead Python function: top_k_image"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd3da88072b2b942", "name": "Possibly dead Python function: record_feedback", "shortDescription": {"text": "Possibly dead Python function: record_feedback"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65406dd4bd1a6081", "name": "Possibly dead Python function: reset_preferences", "shortDescription": {"text": "Possibly dead Python function: reset_preferences"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f886545d6082206c", "name": "Possibly dead Python function: list_preferences", "shortDescription": {"text": "Possibly dead Python function: list_preferences"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8989e6d7faf71ee0", "name": "Possibly dead Python function: record_watch", "shortDescription": {"text": "Possibly dead Python function: record_watch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10037b21120ea781", "name": "Possibly dead Python function: compute_due_alerts", "shortDescription": {"text": "Possibly dead Python function: compute_due_alerts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ddea1c94522873a", "name": "Possibly dead Python function: list_user_watches", "shortDescription": {"text": "Possibly dead Python function: list_user_watches"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55fe384eeaeec3d1", "name": "Possibly dead Python function: remove_watch", "shortDescription": {"text": "Possibly dead Python function: remove_watch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31049ff0b5a82fd2", "name": "Possibly dead Python function: verify_apple", "shortDescription": {"text": "Possibly dead Python function: verify_apple"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c36641b3dbea82f7", "name": "Possibly dead Python function: start_phone", "shortDescription": {"text": "Possibly dead Python function: start_phone"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8184abdb509e235", "name": "Possibly dead Python function: verify_phone", "shortDescription": {"text": "Possibly dead Python function: verify_phone"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60e596132b137053", "name": "Possibly dead Python function: migrate", "shortDescription": {"text": "Possibly dead Python function: migrate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93279bfdfb611eae", "name": "Possibly dead Python function: mock_wechat", "shortDescription": {"text": "Possibly dead Python function: mock_wechat"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b69f45b2dcff8d24", "name": "Dockerfile runs as root: server/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: server/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bf354d1f9316212", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a21f4524816151e0", "name": "Insecure pattern 'cors_wildcard' in server/app/main.py:85", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in server/app/main.py:85"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-152a6f225f240a17", "name": "Insecure pattern 'eval_used' in .github/workflows/rag-eval.yml:51", "shortDescription": {"text": "Insecure pattern 'eval_used' in .github/workflows/rag-eval.yml:51"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9fa6138910e31417", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a34757888fa54a4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-381998e114c4195c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3663b768cf0ae362", "name": "Very large file: server/app/routes/chat.py (1301 lines)", "shortDescription": {"text": "Very large file: server/app/routes/chat.py (1301 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "15 tests / 68 src (ratio 0.22)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 128 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc31e8abfa11b38d", "name": "Commented-code block (5 lines) in rag/retrieve/rerank.py:42", "shortDescription": {"text": "Commented-code block (5 lines) in rag/retrieve/rerank.py:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-84eae015a4932714", "name": "Commented-code block (5 lines) in rag/retrieve/query.py:24", "shortDescription": {"text": "Commented-code block (5 lines) in rag/retrieve/query.py:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-060e051e1dadaf03", "name": "Commented-code block (6 lines) in rag/retrieve/constraints.py:37", "shortDescription": {"text": "Commented-code block (6 lines) in rag/retrieve/constraints.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f6676333296da639", "name": "Commented-code block (5 lines) in rag/retrieve/brand_origin.py:197", "shortDescription": {"text": "Commented-code block (5 lines) in rag/retrieve/brand_origin.py:197"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-614ecc1d468f4eca", "name": "Commented-code block (5 lines) in server/tests/test_constraint_state.py:72", "shortDescription": {"text": "Commented-code block (5 lines) in server/tests/test_constraint_state.py:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa5454c984f8f73f", "name": "Commented-code block (6 lines) in server/app/routes/products.py:40", "shortDescription": {"text": "Commented-code block (6 lines) in server/app/routes/products.py:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64037552eac7889b", "name": "Commented-code block (5 lines) in server/app/routes/chat.py:69", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/routes/chat.py:69"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f909cfe3c95e8626", "name": "Commented-code block (5 lines) in server/app/services/constraint_state.py:86", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/services/constraint_state.py:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d528cae7d384ea43", "name": "Commented-code block (5 lines) in server/app/services/rag_client.py:35", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/services/rag_client.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e4974e8b61a03230", "name": "Commented-code block (5 lines) in server/app/services/repurchase_db.py:34", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/services/repurchase_db.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b6816797183a2b8", "name": "Commented-code block (5 lines) in server/app/services/llm_provider.py:105", "shortDescription": {"text": "Commented-code block (5 lines) in server/app/services/llm_provider.py:105"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39f8ebfe57a6f60f", "name": "35 env vars used in code but missing from .env.example", "shortDescription": {"text": "35 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANTHROPIC_API_KEY`, `BACKEND_URL`, `CLOUD_USER_API_BASE`, `EMBED_MODEL`, `FX_PROVIDER_LABEL`, `LIONPICK_ADMIN_TOKEN`, `LIONPICK_JWT_SECRET`, `LIONPICK_JWT_TTL_SEC` + 27 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver/app/services/user_store.py:verify_apple, server/app/services/user_store.py:verify_apple, server/app/services/user_store.py:verify_apple\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver/app/services/llm_provider.py:stream_chat, server/app/services/llm_provider.py:stream_chat, server/app/services/llm_provider.py:stream_chat, server/app/services/llm_provider.py:stream_chat\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8761a7e68fdef76", "name": "FastAPI POST `apple_endpoint` without auth dependency \u2014 server/app/routes/auth.py:135", "shortDescription": {"text": "FastAPI POST `apple_endpoint` without auth dependency \u2014 server/app/routes/auth.py:135"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31c7af6435e951d6", "name": "FastAPI POST `wechat_endpoint` without auth dependency \u2014 server/app/routes/auth.py:145", "shortDescription": {"text": "FastAPI POST `wechat_endpoint` without auth dependency \u2014 server/app/routes/auth.py:145"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74cfc480810c121c", "name": "FastAPI POST `phone_start_endpoint` without auth dependency \u2014 server/app/routes/auth.py:156", "shortDescription": {"text": "FastAPI POST `phone_start_endpoint` without auth dependency \u2014 server/app/routes/auth.py:156"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28e01f69176e6e30", "name": "FastAPI POST `phone_verify_endpoint` without auth dependency \u2014 server/app/routes/auth.py:164", "shortDescription": {"text": "FastAPI POST `phone_verify_endpoint` without auth dependency \u2014 server/app/routes/auth.py:164"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed02d8f22ca5b522", "name": "FastAPI POST `password_register_endpoint` without auth dependency \u2014 server/app/routes/auth.py:176", "shortDescription": {"text": "FastAPI POST `password_register_endpoint` without auth dependency \u2014 server/app/routes/auth.py:176"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b8289f037f7ca597", "name": "FastAPI POST `password_login_endpoint` without auth dependency \u2014 server/app/routes/auth.py:189", "shortDescription": {"text": "FastAPI POST `password_login_endpoint` without auth dependency \u2014 server/app/routes/auth.py:189"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c4fae72ab2dd7b7c", "name": "FastAPI POST `migrate_endpoint` without auth dependency \u2014 server/app/routes/auth.py:208", "shortDescription": {"text": "FastAPI POST `migrate_endpoint` without auth dependency \u2014 server/app/routes/auth.py:208"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fee86d0c64119b09", "name": "FastAPI POST `verify_token_endpoint` without auth dependency \u2014 server/app/routes/auth.py:214", "shortDescription": {"text": "FastAPI POST `verify_token_endpoint` without auth dependency \u2014 server/app/routes/auth.py:214"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d4490c684bce88bb", "name": "FastAPI POST `password_change_endpoint` without auth dependency \u2014 server/app/routes/auth.py:230", "shortDescription": {"text": "FastAPI POST `password_change_endpoint` without auth dependency \u2014 server/app/routes/auth.py:230"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7166039326d8f4dd", "name": "FastAPI POST `password_reset_start_endpoint` without auth dependency \u2014 server/app/routes/auth.py:243", "shortDescription": {"text": "FastAPI POST `password_reset_start_endpoint` without auth dependency \u2014 server/app/routes/auth.py:243"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bda1bb7469e75f48", "name": "FastAPI POST `password_reset_verify_endpoint` without auth dependency \u2014 server/app/routes/auth.py:254", "shortDescription": {"text": "FastAPI POST `password_reset_verify_endpoint` without auth dependency \u2014 server/app/routes/auth.py:254"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a3e215b77d436693", "name": "FastAPI POST `delete_account_endpoint` without auth dependency \u2014 server/app/routes/auth.py:267", "shortDescription": {"text": "FastAPI POST `delete_account_endpoint` without auth dependency \u2014 server/app/routes/auth.py:267"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d753e2e5fbd373e4", "name": "FastAPI POST `admin_delete_endpoint` without auth dependency \u2014 server/app/routes/auth.py:317", "shortDescription": {"text": "FastAPI POST `admin_delete_endpoint` without auth dependency \u2014 server/app/routes/auth.py:317"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2bed9ac2778211e0", "name": "FastAPI POST `create_endpoint` without auth dependency \u2014 server/app/routes/group_buy.py:54", "shortDescription": {"text": "FastAPI POST `create_endpoint` without auth dependency \u2014 server/app/routes/group_buy.py:54"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b0706403edb1034", "name": "FastAPI POST `join_endpoint` without auth dependency \u2014 server/app/routes/group_buy.py:67", "shortDescription": {"text": "FastAPI POST `join_endpoint` without auth dependency \u2014 server/app/routes/group_buy.py:67"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a36d79536b453c21", "name": "FastAPI POST `watch_endpoint` without auth dependency \u2014 server/app/routes/price_watch.py:50", "shortDescription": {"text": "FastAPI POST `watch_endpoint` without auth dependency \u2014 server/app/routes/price_watch.py:50"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2814b036d25c01b9", "name": "FastAPI DELETE `remove_watch_endpoint` without auth dependency \u2014 server/app/routes/price_watch.py:90", "shortDescription": {"text": "FastAPI DELETE `remove_watch_endpoint` without auth dependency \u2014 server/app/routes/price_watch.py:90"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-977528b3c766f623", "name": "FastAPI POST `record_repurchase` without auth dependency \u2014 server/app/routes/repurchase.py:50", "shortDescription": {"text": "FastAPI POST `record_repurchase` without auth dependency \u2014 server/app/routes/repurchase.py:50"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-573593ca89668a40", "name": "FastAPI POST `chat_stream` without auth dependency \u2014 server/app/routes/chat.py:834", "shortDescription": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 server/app/routes/chat.py:834"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6224829e7f451b65", "name": "FastAPI POST `feedback_endpoint` without auth dependency \u2014 server/app/routes/preferences.py:38", "shortDescription": {"text": "FastAPI POST `feedback_endpoint` without auth dependency \u2014 server/app/routes/preferences.py:38"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2924b0f41e34de7c", "name": "FastAPI DELETE `delete_endpoint` without auth dependency \u2014 server/app/routes/preferences.py:62", "shortDescription": {"text": "FastAPI DELETE `delete_endpoint` without auth dependency \u2014 server/app/routes/preferences.py:62"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a492c576121f48a9", "name": "FastAPI POST `reset` without auth dependency \u2014 server/app/routes/cache_stats.py:45", "shortDescription": {"text": "FastAPI POST `reset` without auth dependency \u2014 server/app/routes/cache_stats.py:45"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-24a24e5aad57ea2f", "name": "FastAPI POST `chat_stream` without auth dependency \u2014 tools/mock_backend.py:58", "shortDescription": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 tools/mock_backend.py:58"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d611732ce2d9cdfe", "name": "Unused endpoint: GET /{product_id}", "shortDescription": {"text": "Unused endpoint: GET /{product_id}"}, "fullDescription": {"text": "`server/app/routes/products.py` declares `GET /{product_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c236625afb6a8cb", "name": "Unused endpoint: GET /ready", "shortDescription": {"text": "Unused endpoint: GET /ready"}, "fullDescription": {"text": "`server/app/routes/health.py` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9591ad5f2fef55f", "name": "Unused endpoint: POST /apple", "shortDescription": {"text": "Unused endpoint: POST /apple"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /apple` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b080ccae5af8ba0a", "name": "Unused endpoint: POST /wechat", "shortDescription": {"text": "Unused endpoint: POST /wechat"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /wechat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f6a1c174faa713a", "name": "Unused endpoint: POST /phone/start", "shortDescription": {"text": "Unused endpoint: POST /phone/start"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /phone/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1320fb5591cb8921", "name": "Unused endpoint: POST /phone/verify", "shortDescription": {"text": "Unused endpoint: POST /phone/verify"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /phone/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-579f80c7ddbeae04", "name": "Unused endpoint: POST /password/login", "shortDescription": {"text": "Unused endpoint: POST /password/login"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /password/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c43662dce498972", "name": "Unused endpoint: POST /migrate", "shortDescription": {"text": "Unused endpoint: POST /migrate"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /migrate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aee9168e964a3822", "name": "Unused endpoint: POST /verify", "shortDescription": {"text": "Unused endpoint: POST /verify"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c392467ad66119ce", "name": "Unused endpoint: POST /password/change", "shortDescription": {"text": "Unused endpoint: POST /password/change"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /password/change` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cebeaa1996ff49b3", "name": "Unused endpoint: POST /password/reset/start", "shortDescription": {"text": "Unused endpoint: POST /password/reset/start"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /password/reset/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3850eac957383492", "name": "Unused endpoint: POST /password/reset/verify", "shortDescription": {"text": "Unused endpoint: POST /password/reset/verify"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /password/reset/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ad17de6517d58f2", "name": "Unused endpoint: POST /delete", "shortDescription": {"text": "Unused endpoint: POST /delete"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0aba7f1883cb96f2", "name": "Unused endpoint: GET /admin/users", "shortDescription": {"text": "Unused endpoint: GET /admin/users"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `GET /admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fe7272bbfcac1f7", "name": "Unused endpoint: POST /admin/delete", "shortDescription": {"text": "Unused endpoint: POST /admin/delete"}, "fullDescription": {"text": "`server/app/routes/auth.py` declares `POST /admin/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-599114e2a4d7d26d", "name": "Unused endpoint: POST /create", "shortDescription": {"text": "Unused endpoint: POST /create"}, "fullDescription": {"text": "`server/app/routes/group_buy.py` declares `POST /create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c0efe304560ea8b", "name": "Unused endpoint: POST /{group_id}/join", "shortDescription": {"text": "Unused endpoint: POST /{group_id}/join"}, "fullDescription": {"text": "`server/app/routes/group_buy.py` declares `POST /{group_id}/join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72eb8a13269a8eb3", "name": "Unused endpoint: GET /active", "shortDescription": {"text": "Unused endpoint: GET /active"}, "fullDescription": {"text": "`server/app/routes/group_buy.py` declares `GET /active` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0b124d349527347", "name": "Unused endpoint: GET /{group_id}", "shortDescription": {"text": "Unused endpoint: GET /{group_id}"}, "fullDescription": {"text": "`server/app/routes/group_buy.py` declares `GET /{group_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af5a4b603a54a2ab", "name": "Unused endpoint: POST /watch", "shortDescription": {"text": "Unused endpoint: POST /watch"}, "fullDescription": {"text": "`server/app/routes/price_watch.py` declares `POST /watch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67db81ff589a2912", "name": "Unused endpoint: GET /alerts", "shortDescription": {"text": "Unused endpoint: GET /alerts"}, "fullDescription": {"text": "`server/app/routes/price_watch.py` declares `GET /alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3586573460c05fb2", "name": "Unused endpoint: DELETE /watch/{product_id}", "shortDescription": {"text": "Unused endpoint: DELETE /watch/{product_id}"}, "fullDescription": {"text": "`server/app/routes/price_watch.py` declares `DELETE /watch/{product_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-306f1865394e49cc", "name": "Unused endpoint: GET /rate", "shortDescription": {"text": "Unused endpoint: GET /rate"}, "fullDescription": {"text": "`server/app/routes/currency.py` declares `GET /rate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5659d98a2deb346b", "name": "Unused endpoint: POST /purchase", "shortDescription": {"text": "Unused endpoint: POST /purchase"}, "fullDescription": {"text": "`server/app/routes/repurchase.py` declares `POST /purchase` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1164a22ef94d3196", "name": "Unused endpoint: GET /reminders", "shortDescription": {"text": "Unused endpoint: GET /reminders"}, "fullDescription": {"text": "`server/app/routes/repurchase.py` declares `GET /reminders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f4ee569e1562771", "name": "Unused endpoint: POST /stream", "shortDescription": {"text": "Unused endpoint: POST /stream"}, "fullDescription": {"text": "`server/app/routes/chat.py` declares `POST /stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f95d7ec49f00406", "name": "Unused endpoint: POST /feedback", "shortDescription": {"text": "Unused endpoint: POST /feedback"}, "fullDescription": {"text": "`server/app/routes/preferences.py` declares `POST /feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`server/app/routes/preferences.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b30f4c0994a30b4", "name": "Unused endpoint: DELETE /", "shortDescription": {"text": "Unused endpoint: DELETE /"}, "fullDescription": {"text": "`server/app/routes/preferences.py` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd8dc4599ec52a08", "name": "Unused endpoint: GET /stats", "shortDescription": {"text": "Unused endpoint: GET /stats"}, "fullDescription": {"text": "`server/app/routes/cache_stats.py` declares `GET /stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7a776760f85a3e7", "name": "Unused endpoint: POST /reset", "shortDescription": {"text": "Unused endpoint: POST /reset"}, "fullDescription": {"text": "`server/app/routes/cache_stats.py` declares `POST /reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b30ef55a849c5f77", "name": "Unused endpoint: POST /chat/stream", "shortDescription": {"text": "Unused endpoint: POST /chat/stream"}, "fullDescription": {"text": "`tools/mock_backend.py` declares `POST /chat/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-470acd7665628615", "name": "Unused endpoint: GET /products/{product_id}", "shortDescription": {"text": "Unused endpoint: GET /products/{product_id}"}, "fullDescription": {"text": "`tools/mock_backend.py` declares `GET /products/{product_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23434"}, "properties": {"repository": "YushengLiSam/AAALion", "repoUrl": "https://github.com/YushengLiSam/AAALion", "branch": "main"}, "results": [{"ruleId": "scanner-f6bf5ed9108bd6dc", "level": "note", "message": {"text": "Possibly dead Python function: upsert_image"}, "properties": {"repobilityId": "2ad198c32f3abd2a", "scanner": "scanner-primary", "fingerprint": "f6bf5ed9108bd6dc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag/store.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c1ce4638287cf0a", "level": "note", "message": {"text": "Possibly dead Python function: embed_text_query"}, "properties": {"repobilityId": "788fd012fbf36eb0", "scanner": "scanner-primary", "fingerprint": "9c1ce4638287cf0a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag/ingest/embed_image.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b9383b197fea34b", "level": "note", "message": {"text": "Possibly dead Python function: create_group"}, "properties": {"repobilityId": "8ee3a2b500868477", "scanner": "scanner-primary", "fingerprint": "7b9383b197fea34b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/group_buy_db.py:132"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecbc43ada0f1abdf", "level": "note", "message": {"text": "Possibly dead Python function: join_group"}, "properties": {"repobilityId": "1a02a5ef778ec73e", "scanner": "scanner-primary", "fingerprint": "ecbc43ada0f1abdf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/group_buy_db.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c213a7fa6c48c2d3", "level": "note", "message": {"text": "Possibly dead Python function: list_active_for_user"}, "properties": {"repobilityId": "0ce1976a863789f0", "scanner": "scanner-primary", "fingerprint": "c213a7fa6c48c2d3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/group_buy_db.py:271"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c14684d71b9c5808", "level": "note", "message": {"text": "Possibly dead Python function: top_k_image"}, "properties": {"repobilityId": "321dcc2a9032ccd9", "scanner": "scanner-primary", "fingerprint": "c14684d71b9c5808", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/rag_client.py:896"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd3da88072b2b942", "level": "note", "message": {"text": "Possibly dead Python function: record_feedback"}, "properties": {"repobilityId": "a15331fe58779ffb", "scanner": "scanner-primary", "fingerprint": "dd3da88072b2b942", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/preferences_db.py:156"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65406dd4bd1a6081", "level": "note", "message": {"text": "Possibly dead Python function: reset_preferences"}, "properties": {"repobilityId": "808ae7f32a717a90", "scanner": "scanner-primary", "fingerprint": "65406dd4bd1a6081", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/preferences_db.py:199"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f886545d6082206c", "level": "note", "message": {"text": "Possibly dead Python function: list_preferences"}, "properties": {"repobilityId": "22a59773f8c61c5e", "scanner": "scanner-primary", "fingerprint": "f886545d6082206c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/preferences_db.py:229"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8989e6d7faf71ee0", "level": "note", "message": {"text": "Possibly dead Python function: record_watch"}, "properties": {"repobilityId": "efc61f80de06979f", "scanner": "scanner-primary", "fingerprint": "8989e6d7faf71ee0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/price_watch_db.py:161"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-10037b21120ea781", "level": "note", "message": {"text": "Possibly dead Python function: compute_due_alerts"}, "properties": {"repobilityId": "7c29ce8a591bee3d", "scanner": "scanner-primary", "fingerprint": "10037b21120ea781", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/price_watch_db.py:202"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ddea1c94522873a", "level": "note", "message": {"text": "Possibly dead Python function: list_user_watches"}, "properties": {"repobilityId": "56de223b0368b9e8", "scanner": "scanner-primary", "fingerprint": "8ddea1c94522873a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/price_watch_db.py:278"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55fe384eeaeec3d1", "level": "note", "message": {"text": "Possibly dead Python function: remove_watch"}, "properties": {"repobilityId": "98d45f0b91093d05", "scanner": "scanner-primary", "fingerprint": "55fe384eeaeec3d1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/price_watch_db.py:296"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31049ff0b5a82fd2", "level": "note", "message": {"text": "Possibly dead Python function: verify_apple"}, "properties": {"repobilityId": "178898ab9a885f40", "scanner": "scanner-primary", "fingerprint": "31049ff0b5a82fd2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/user_store.py:490"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c36641b3dbea82f7", "level": "note", "message": {"text": "Possibly dead Python function: start_phone"}, "properties": {"repobilityId": "977b552b0193af3e", "scanner": "scanner-primary", "fingerprint": "c36641b3dbea82f7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/user_store.py:493"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8184abdb509e235", "level": "note", "message": {"text": "Possibly dead Python function: verify_phone"}, "properties": {"repobilityId": "a12f5d9a66ceb4cc", "scanner": "scanner-primary", "fingerprint": "a8184abdb509e235", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/user_store.py:496"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60e596132b137053", "level": "note", "message": {"text": "Possibly dead Python function: migrate"}, "properties": {"repobilityId": "c6e13b69ade8d809", "scanner": "scanner-primary", "fingerprint": "60e596132b137053", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/user_store.py:511"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93279bfdfb611eae", "level": "note", "message": {"text": "Possibly dead Python function: mock_wechat"}, "properties": {"repobilityId": "44215a1f77fe5a4a", "scanner": "scanner-primary", "fingerprint": "93279bfdfb611eae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/services/user_store.py:514"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b69f45b2dcff8d24", "level": "warning", "message": {"text": "Dockerfile runs as root: server/Dockerfile"}, "properties": {"repobilityId": "4600ca3b571a3f30", "scanner": "scanner-primary", "fingerprint": "b69f45b2dcff8d24", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-6bf354d1f9316212", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "445bc19de6e98ce0", "scanner": "scanner-primary", "fingerprint": "6bf354d1f9316212", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-a21f4524816151e0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in server/app/main.py:85"}, "properties": {"repobilityId": "d3fa50225e620935", "scanner": "scanner-primary", "fingerprint": "a21f4524816151e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/main.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-152a6f225f240a17", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in .github/workflows/rag-eval.yml:51"}, "properties": {"repobilityId": "b7819b1a63f853ab", "scanner": "scanner-primary", "fingerprint": "152a6f225f240a17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rag-eval.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-9fa6138910e31417", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d145fb797ec99273", "scanner": "scanner-primary", "fingerprint": "9fa6138910e31417", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-ipa.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-8a34757888fa54a4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54f8ad03ee88b550", "scanner": "scanner-primary", "fingerprint": "8a34757888fa54a4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ios-simulator.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-381998e114c4195c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "351843258c42bea7", "scanner": "scanner-primary", "fingerprint": "381998e114c4195c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rag-eval.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-3663b768cf0ae362", "level": "note", "message": {"text": "Very large file: server/app/routes/chat.py (1301 lines)"}, "properties": {"repobilityId": "63b2ee416aeb8b2f", "scanner": "scanner-primary", "fingerprint": "3663b768cf0ae362", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "483a2e4aa2444e20", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "58e43915194aacf0", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c8867f40ca6c4b0c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8a3ff1c1efdcf145", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bc31e8abfa11b38d", "level": "none", "message": {"text": "Commented-code block (5 lines) in rag/retrieve/rerank.py:42"}, "properties": {"repobilityId": "82fcdd917e28acab", "scanner": "scanner-primary", "fingerprint": "bc31e8abfa11b38d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-84eae015a4932714", "level": "none", "message": {"text": "Commented-code block (5 lines) in rag/retrieve/query.py:24"}, "properties": {"repobilityId": "9ffe9f8a6647bcfd", "scanner": "scanner-primary", "fingerprint": "84eae015a4932714", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-060e051e1dadaf03", "level": "none", "message": {"text": "Commented-code block (6 lines) in rag/retrieve/constraints.py:37"}, "properties": {"repobilityId": "435314f1cf2557ee", "scanner": "scanner-primary", "fingerprint": "060e051e1dadaf03", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f6676333296da639", "level": "none", "message": {"text": "Commented-code block (5 lines) in rag/retrieve/brand_origin.py:197"}, "properties": {"repobilityId": "45e9a7adb3425db3", "scanner": "scanner-primary", "fingerprint": "f6676333296da639", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-614ecc1d468f4eca", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/tests/test_constraint_state.py:72"}, "properties": {"repobilityId": "fc027e27c017893a", "scanner": "scanner-primary", "fingerprint": "614ecc1d468f4eca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa5454c984f8f73f", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/app/routes/products.py:40"}, "properties": {"repobilityId": "937ca964b738b99d", "scanner": "scanner-primary", "fingerprint": "aa5454c984f8f73f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64037552eac7889b", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/routes/chat.py:69"}, "properties": {"repobilityId": "1175b9586edc66af", "scanner": "scanner-primary", "fingerprint": "64037552eac7889b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f909cfe3c95e8626", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/services/constraint_state.py:86"}, "properties": {"repobilityId": "c4443a2e021f81ca", "scanner": "scanner-primary", "fingerprint": "f909cfe3c95e8626", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d528cae7d384ea43", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/services/rag_client.py:35"}, "properties": {"repobilityId": "fec025bb6ede1d3a", "scanner": "scanner-primary", "fingerprint": "d528cae7d384ea43", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e4974e8b61a03230", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/services/repurchase_db.py:34"}, "properties": {"repobilityId": "45d7f255396f2e5a", "scanner": "scanner-primary", "fingerprint": "e4974e8b61a03230", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b6816797183a2b8", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app/services/llm_provider.py:105"}, "properties": {"repobilityId": "cc5cc35a90c4fb17", "scanner": "scanner-primary", "fingerprint": "7b6816797183a2b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39f8ebfe57a6f60f", "level": "note", "message": {"text": "35 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d6a41686c51dc14b", "scanner": "scanner-primary", "fingerprint": "39f8ebfe57a6f60f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "fbe6809248dbec79", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "701f0e1528259192", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ae2c2b1efc5a1498", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8d6a916c35b063de", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "046e745fee5e496c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d39d77b68ca83a3e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "6092c64bd12ef28e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1b612a6247ea5d72", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "878b10984014f2cf", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1b053918e3776a1e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c863a45d534a58d2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b7637cacebb618e8", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "9a81a3bbb68052d5", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "87eddb95aa6c1969", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-d8761a7e68fdef76", "level": "error", "message": {"text": "FastAPI POST `apple_endpoint` without auth dependency \u2014 server/app/routes/auth.py:135"}, "properties": {"repobilityId": "bf69d73001c503fb", "scanner": "scanner-primary", "fingerprint": "d8761a7e68fdef76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-31c7af6435e951d6", "level": "error", "message": {"text": "FastAPI POST `wechat_endpoint` without auth dependency \u2014 server/app/routes/auth.py:145"}, "properties": {"repobilityId": "51b6d0f1712db2ca", "scanner": "scanner-primary", "fingerprint": "31c7af6435e951d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-74cfc480810c121c", "level": "error", "message": {"text": "FastAPI POST `phone_start_endpoint` without auth dependency \u2014 server/app/routes/auth.py:156"}, "properties": {"repobilityId": "2bf44a0c3ab80941", "scanner": "scanner-primary", "fingerprint": "74cfc480810c121c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-28e01f69176e6e30", "level": "error", "message": {"text": "FastAPI POST `phone_verify_endpoint` without auth dependency \u2014 server/app/routes/auth.py:164"}, "properties": {"repobilityId": "2524ef722ae8a4d0", "scanner": "scanner-primary", "fingerprint": "28e01f69176e6e30", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-ed02d8f22ca5b522", "level": "error", "message": {"text": "FastAPI POST `password_register_endpoint` without auth dependency \u2014 server/app/routes/auth.py:176"}, "properties": {"repobilityId": "e85403fc4394c6f5", "scanner": "scanner-primary", "fingerprint": "ed02d8f22ca5b522", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-b8289f037f7ca597", "level": "error", "message": {"text": "FastAPI POST `password_login_endpoint` without auth dependency \u2014 server/app/routes/auth.py:189"}, "properties": {"repobilityId": "1f4577ee1f779aa0", "scanner": "scanner-primary", "fingerprint": "b8289f037f7ca597", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-c4fae72ab2dd7b7c", "level": "error", "message": {"text": "FastAPI POST `migrate_endpoint` without auth dependency \u2014 server/app/routes/auth.py:208"}, "properties": {"repobilityId": "ac53612772138a06", "scanner": "scanner-primary", "fingerprint": "c4fae72ab2dd7b7c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-fee86d0c64119b09", "level": "error", "message": {"text": "FastAPI POST `verify_token_endpoint` without auth dependency \u2014 server/app/routes/auth.py:214"}, "properties": {"repobilityId": "b6f1b0c37e23cf80", "scanner": "scanner-primary", "fingerprint": "fee86d0c64119b09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-d4490c684bce88bb", "level": "error", "message": {"text": "FastAPI POST `password_change_endpoint` without auth dependency \u2014 server/app/routes/auth.py:230"}, "properties": {"repobilityId": "3d962ae3a224254f", "scanner": "scanner-primary", "fingerprint": "d4490c684bce88bb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-7166039326d8f4dd", "level": "error", "message": {"text": "FastAPI POST `password_reset_start_endpoint` without auth dependency \u2014 server/app/routes/auth.py:243"}, "properties": {"repobilityId": "b86f252cc9cf5a00", "scanner": "scanner-primary", "fingerprint": "7166039326d8f4dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-bda1bb7469e75f48", "level": "error", "message": {"text": "FastAPI POST `password_reset_verify_endpoint` without auth dependency \u2014 server/app/routes/auth.py:254"}, "properties": {"repobilityId": "dee83732e39cba3c", "scanner": "scanner-primary", "fingerprint": "bda1bb7469e75f48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-a3e215b77d436693", "level": "error", "message": {"text": "FastAPI POST `delete_account_endpoint` without auth dependency \u2014 server/app/routes/auth.py:267"}, "properties": {"repobilityId": "ac067de65a4ed1a5", "scanner": "scanner-primary", "fingerprint": "a3e215b77d436693", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-d753e2e5fbd373e4", "level": "error", "message": {"text": "FastAPI POST `admin_delete_endpoint` without auth dependency \u2014 server/app/routes/auth.py:317"}, "properties": {"repobilityId": "ff7943028ff899e0", "scanner": "scanner-primary", "fingerprint": "d753e2e5fbd373e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/auth.py"}, "region": {"startLine": 317}}}]}, {"ruleId": "scanner-2bed9ac2778211e0", "level": "error", "message": {"text": "FastAPI POST `create_endpoint` without auth dependency \u2014 server/app/routes/group_buy.py:54"}, "properties": {"repobilityId": "9dbf4f76b6d7da45", "scanner": "scanner-primary", "fingerprint": "2bed9ac2778211e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/group_buy.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-3b0706403edb1034", "level": "error", "message": {"text": "FastAPI POST `join_endpoint` without auth dependency \u2014 server/app/routes/group_buy.py:67"}, "properties": {"repobilityId": "6b5232e76fd9a36a", "scanner": "scanner-primary", "fingerprint": "3b0706403edb1034", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/group_buy.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-a36d79536b453c21", "level": "error", "message": {"text": "FastAPI POST `watch_endpoint` without auth dependency \u2014 server/app/routes/price_watch.py:50"}, "properties": {"repobilityId": "a4f6275cc4512e7f", "scanner": "scanner-primary", "fingerprint": "a36d79536b453c21", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/price_watch.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-2814b036d25c01b9", "level": "error", "message": {"text": "FastAPI DELETE `remove_watch_endpoint` without auth dependency \u2014 server/app/routes/price_watch.py:90"}, "properties": {"repobilityId": "bd92fda2ff398cb7", "scanner": "scanner-primary", "fingerprint": "2814b036d25c01b9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/price_watch.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-977528b3c766f623", "level": "error", "message": {"text": "FastAPI POST `record_repurchase` without auth dependency \u2014 server/app/routes/repurchase.py:50"}, "properties": {"repobilityId": "4270811a0b986cdc", "scanner": "scanner-primary", "fingerprint": "977528b3c766f623", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/repurchase.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-573593ca89668a40", "level": "error", "message": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 server/app/routes/chat.py:834"}, "properties": {"repobilityId": "679f4b7ded59f004", "scanner": "scanner-primary", "fingerprint": "573593ca89668a40", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/chat.py"}, "region": {"startLine": 834}}}]}, {"ruleId": "scanner-6224829e7f451b65", "level": "error", "message": {"text": "FastAPI POST `feedback_endpoint` without auth dependency \u2014 server/app/routes/preferences.py:38"}, "properties": {"repobilityId": "8b498ff4d0bc2720", "scanner": "scanner-primary", "fingerprint": "6224829e7f451b65", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/preferences.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-2924b0f41e34de7c", "level": "error", "message": {"text": "FastAPI DELETE `delete_endpoint` without auth dependency \u2014 server/app/routes/preferences.py:62"}, "properties": {"repobilityId": "7939982af23a30cd", "scanner": "scanner-primary", "fingerprint": "2924b0f41e34de7c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/preferences.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-a492c576121f48a9", "level": "error", "message": {"text": "FastAPI POST `reset` without auth dependency \u2014 server/app/routes/cache_stats.py:45"}, "properties": {"repobilityId": "11fee6b6321d8858", "scanner": "scanner-primary", "fingerprint": "a492c576121f48a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/app/routes/cache_stats.py"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-24a24e5aad57ea2f", "level": "error", "message": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 tools/mock_backend.py:58"}, "properties": {"repobilityId": "9ac430de4915ad32", "scanner": "scanner-primary", "fingerprint": "24a24e5aad57ea2f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/mock_backend.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-d611732ce2d9cdfe", "level": "note", "message": {"text": "Unused endpoint: GET /{product_id}"}, "properties": {"repobilityId": "8383fb1f758955eb", "scanner": "scanner-primary", "fingerprint": "d611732ce2d9cdfe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c236625afb6a8cb", "level": "note", "message": {"text": "Unused endpoint: GET /ready"}, "properties": {"repobilityId": "98cc898762fb6525", "scanner": "scanner-primary", "fingerprint": "8c236625afb6a8cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9591ad5f2fef55f", "level": "note", "message": {"text": "Unused endpoint: POST /apple"}, "properties": {"repobilityId": "03a653ac8f9d677c", "scanner": "scanner-primary", "fingerprint": "e9591ad5f2fef55f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b080ccae5af8ba0a", "level": "note", "message": {"text": "Unused endpoint: POST /wechat"}, "properties": {"repobilityId": "2a11ebefc23ac908", "scanner": "scanner-primary", "fingerprint": "b080ccae5af8ba0a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f6a1c174faa713a", "level": "note", "message": {"text": "Unused endpoint: POST /phone/start"}, "properties": {"repobilityId": "8ff1dcade36cd360", "scanner": "scanner-primary", "fingerprint": "4f6a1c174faa713a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1320fb5591cb8921", "level": "note", "message": {"text": "Unused endpoint: POST /phone/verify"}, "properties": {"repobilityId": "4ffaaff00e5b6969", "scanner": "scanner-primary", "fingerprint": "1320fb5591cb8921", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "4a73b79d9befdad7", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-579f80c7ddbeae04", "level": "note", "message": {"text": "Unused endpoint: POST /password/login"}, "properties": {"repobilityId": "a528c0c1600da356", "scanner": "scanner-primary", "fingerprint": "579f80c7ddbeae04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "4b4a343408a8d8f0", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c43662dce498972", "level": "note", "message": {"text": "Unused endpoint: POST /migrate"}, "properties": {"repobilityId": "9cea0deed71142c2", "scanner": "scanner-primary", "fingerprint": "5c43662dce498972", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aee9168e964a3822", "level": "note", "message": {"text": "Unused endpoint: POST /verify"}, "properties": {"repobilityId": "76aeb8c94279c113", "scanner": "scanner-primary", "fingerprint": "aee9168e964a3822", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c392467ad66119ce", "level": "note", "message": {"text": "Unused endpoint: POST /password/change"}, "properties": {"repobilityId": "ec63453e0caa137a", "scanner": "scanner-primary", "fingerprint": "c392467ad66119ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cebeaa1996ff49b3", "level": "note", "message": {"text": "Unused endpoint: POST /password/reset/start"}, "properties": {"repobilityId": "5c987b1c09390904", "scanner": "scanner-primary", "fingerprint": "cebeaa1996ff49b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3850eac957383492", "level": "note", "message": {"text": "Unused endpoint: POST /password/reset/verify"}, "properties": {"repobilityId": "fb146fb85cd0fbf0", "scanner": "scanner-primary", "fingerprint": "3850eac957383492", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ad17de6517d58f2", "level": "note", "message": {"text": "Unused endpoint: POST /delete"}, "properties": {"repobilityId": "10f1a6350dec46c4", "scanner": "scanner-primary", "fingerprint": "5ad17de6517d58f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0aba7f1883cb96f2", "level": "note", "message": {"text": "Unused endpoint: GET /admin/users"}, "properties": {"repobilityId": "350a28d50a290c2a", "scanner": "scanner-primary", "fingerprint": "0aba7f1883cb96f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9fe7272bbfcac1f7", "level": "note", "message": {"text": "Unused endpoint: POST /admin/delete"}, "properties": {"repobilityId": "09776da9c8211ac2", "scanner": "scanner-primary", "fingerprint": "9fe7272bbfcac1f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-599114e2a4d7d26d", "level": "note", "message": {"text": "Unused endpoint: POST /create"}, "properties": {"repobilityId": "79482d2eded9ebd7", "scanner": "scanner-primary", "fingerprint": "599114e2a4d7d26d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c0efe304560ea8b", "level": "note", "message": {"text": "Unused endpoint: POST /{group_id}/join"}, "properties": {"repobilityId": "63e1b0f12424009b", "scanner": "scanner-primary", "fingerprint": "4c0efe304560ea8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72eb8a13269a8eb3", "level": "note", "message": {"text": "Unused endpoint: GET /active"}, "properties": {"repobilityId": "6fa73200df366e1a", "scanner": "scanner-primary", "fingerprint": "72eb8a13269a8eb3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a0b124d349527347", "level": "note", "message": {"text": "Unused endpoint: GET /{group_id}"}, "properties": {"repobilityId": "ba94ff78ef6b0bc0", "scanner": "scanner-primary", "fingerprint": "a0b124d349527347", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af5a4b603a54a2ab", "level": "note", "message": {"text": "Unused endpoint: POST /watch"}, "properties": {"repobilityId": "28e7a98597dc83fe", "scanner": "scanner-primary", "fingerprint": "af5a4b603a54a2ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67db81ff589a2912", "level": "note", "message": {"text": "Unused endpoint: GET /alerts"}, "properties": {"repobilityId": "326aa1147e3ccebc", "scanner": "scanner-primary", "fingerprint": "67db81ff589a2912", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3586573460c05fb2", "level": "note", "message": {"text": "Unused endpoint: DELETE /watch/{product_id}"}, "properties": {"repobilityId": "957d6f6251bdd789", "scanner": "scanner-primary", "fingerprint": "3586573460c05fb2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-306f1865394e49cc", "level": "note", "message": {"text": "Unused endpoint: GET /rate"}, "properties": {"repobilityId": "68785ae9ed2f0ddf", "scanner": "scanner-primary", "fingerprint": "306f1865394e49cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5659d98a2deb346b", "level": "note", "message": {"text": "Unused endpoint: POST /purchase"}, "properties": {"repobilityId": "8bd135f104bf6753", "scanner": "scanner-primary", "fingerprint": "5659d98a2deb346b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1164a22ef94d3196", "level": "note", "message": {"text": "Unused endpoint: GET /reminders"}, "properties": {"repobilityId": "b3903c4f98ea80aa", "scanner": "scanner-primary", "fingerprint": "1164a22ef94d3196", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f4ee569e1562771", "level": "note", "message": {"text": "Unused endpoint: POST /stream"}, "properties": {"repobilityId": "2cd16e5ea456f082", "scanner": "scanner-primary", "fingerprint": "5f4ee569e1562771", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f95d7ec49f00406", "level": "note", "message": {"text": "Unused endpoint: POST /feedback"}, "properties": {"repobilityId": "7d66b1da2c48d989", "scanner": "scanner-primary", "fingerprint": "8f95d7ec49f00406", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9c10f38d32b94c9f", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b30f4c0994a30b4", "level": "note", "message": {"text": "Unused endpoint: DELETE /"}, "properties": {"repobilityId": "58e0c27ba7792bf0", "scanner": "scanner-primary", "fingerprint": "3b30f4c0994a30b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd8dc4599ec52a08", "level": "note", "message": {"text": "Unused endpoint: GET /stats"}, "properties": {"repobilityId": "b4418fc22ae95f87", "scanner": "scanner-primary", "fingerprint": "cd8dc4599ec52a08", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a7a776760f85a3e7", "level": "note", "message": {"text": "Unused endpoint: POST /reset"}, "properties": {"repobilityId": "f4254858fff5a063", "scanner": "scanner-primary", "fingerprint": "a7a776760f85a3e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b30ef55a849c5f77", "level": "note", "message": {"text": "Unused endpoint: POST /chat/stream"}, "properties": {"repobilityId": "9a3dad41d3093296", "scanner": "scanner-primary", "fingerprint": "b30ef55a849c5f77", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-470acd7665628615", "level": "note", "message": {"text": "Unused endpoint: GET /products/{product_id}"}, "properties": {"repobilityId": "3ceec3aa51ef45ab", "scanner": "scanner-primary", "fingerprint": "470acd7665628615", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}