{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-087a08586c9ba144", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/App.tsx:977", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/App.tsx:977"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e460c4d27ae92ae", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/RatesDialog.tsx:105", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/RatesDialog.tsx:105"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b3aba0a08be70d9", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/ImportDialog.tsx:472", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/ImportDialog.tsx:472"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e6b295bc9a9d494", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/SettingsPage.tsx:293", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/SettingsPage.tsx:293"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ddd366621873006", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/ThreadList.tsx:34", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/ThreadList.tsx:34"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2a012c045f651fa", "name": "Stray `console.log` in TS/JS \u2014 test/real-auth-manual.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test/real-auth-manual.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94c99ea67c2783d1", "name": "Stray `console.log` in TS/JS \u2014 packages/client/src/openkey.ts:87", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/src/openkey.ts:87"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d8006b49610a116", "name": "Stray `console.log` in TS/JS \u2014 packages/client/src/__tests__/tinycloud-wasm-init-fix.test.ts:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/src/__tests__/tinycloud-wasm-init-fix.test.ts:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d710f8c17b9e31c", "name": "Stray `console.log` in TS/JS \u2014 packages/server/scripts/generate-key.ts:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/scripts/generate-key.ts:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e4af8d829fb414", "name": "Stray `console.log` in TS/JS \u2014 backend/src/index.ts:151", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/src/index.ts:151"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63910c9a9f88cfe", "name": "Privileged port 256 in use", "shortDescription": {"text": "Privileged port 256 in use"}, "fullDescription": {"text": "Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c25aa3cf5d135e28", "name": "Dockerfile runs as root: infra/phala-ingress/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: infra/phala-ingress/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6efaad1edde147fc", "name": "Docker base image is tag-pinned but not digest-pinned: oven/bun:1.3.9", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: oven/bun:1.3.9"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c482023445423a4", "name": "Runtime dotenv file present in repo: frontend/.env.production", "shortDescription": {"text": "Runtime dotenv file present in repo: frontend/.env.production"}, "fullDescription": {"text": "`frontend/.env.production` looks like a runtime dotenv file. It contains secret-looking assignments for VITE_OPENKEY_HOST. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c5a2d927ca1067c4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d89807b5935482ae", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bc180d1d538d147", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/login-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-673fd08c667efadb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d64dc21e1e57aa0", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea475230b943f200", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e8a76eb13fd3249", "name": "Node manifest has dependencies but no lockfile: frontend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: frontend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d53f0b13302a0d8", "name": "Node manifest has dependencies but no lockfile: test/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: test/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1f0c52db7c97cef", "name": "Node manifest has dependencies but no lockfile: packages/client/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b739f2f2be1d714d", "name": "Node manifest has dependencies but no lockfile: packages/server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a092b5c39e242a1", "name": "Node manifest has dependencies but no lockfile: backend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: backend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 17 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0a04b4ae35187ec", "name": "Commented-code block (5 lines) in frontend/src/App.tsx:118", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/App.tsx:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fcffc9ee6670c378", "name": "Commented-code block (5 lines) in frontend/src/components/MemoryPanel.tsx:97", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/MemoryPanel.tsx:97"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd2fe812be6e124d", "name": "Commented-code block (11 lines) in frontend/src/chat/pendingHandoff.ts:3", "shortDescription": {"text": "Commented-code block (11 lines) in frontend/src/chat/pendingHandoff.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b0e145d3216cef0", "name": "Commented-code block (5 lines) in frontend/src/chat/Thread.tsx:55", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/chat/Thread.tsx:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06c6a5d4dcd97a98", "name": "Commented-code block (5 lines) in frontend/src/chat/ImportDialog.tsx:201", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/chat/ImportDialog.tsx:201"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-684018b3c9c4fbfc", "name": "Commented-code block (5 lines) in frontend/src/chat/runtime.tsx:107", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/chat/runtime.tsx:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-563f57c4e0a66451", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/chat/runtime.tsx:327", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/chat/runtime.tsx:327"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35628dce0edf0920", "name": "Commented-code block (5 lines) in frontend/src/chat/ModelVerificationBadge.tsx:125", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/chat/ModelVerificationBadge.tsx:125"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7538ef9fb2dee4b", "name": "Commented-code block (7 lines) in frontend/src/lib/threadStore.ts:14", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/lib/threadStore.ts:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-44eb57a1d0949786", "name": "Commented-code block (6 lines) in frontend/src/lib/vendorRedirects.test.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/lib/vendorRedirects.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a7c1222aabb6ada", "name": "Commented-code block (5 lines) in frontend/src/lib/useModelVerification.ts:117", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/useModelVerification.ts:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64968e73bf50d26a", "name": "Commented-code block (8 lines) in frontend/src/lib/historyPrefetch.ts:10", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/lib/historyPrefetch.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e720125d5fe8861", "name": "Commented-code block (5 lines) in frontend/src/lib/claudeImport.ts:256", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/claudeImport.ts:256"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03c3f79f5a89e965", "name": "Commented-code block (7 lines) in frontend/src/lib/completionStore.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/lib/completionStore.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97e5eb626e51ce3b", "name": "Commented-code block (5 lines) in frontend/src/lib/sanitizeModel.test.ts:58", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/sanitizeModel.test.ts:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa698d03143fb355", "name": "Commented-code block (6 lines) in frontend/src/lib/memory.ts:254", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/lib/memory.ts:254"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2dd54d94cbcef1f0", "name": "Commented-code block (7 lines) in frontend/src/lib/useVisualViewport.ts:6", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/lib/useVisualViewport.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e7d90889f838d0d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/chatApi.ts:168", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/chatApi.ts:168"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2693c0893c3c12c6", "name": "Commented-code block (5 lines) in frontend/src/lib/backendAttestation/rtmr3.ts:8", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/lib/backendAttestation/rtmr3.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8dcdb017b0ea195d", "name": "Commented-code block (12 lines) in frontend/src/lib/backendAttestation/verify.ts:7", "shortDescription": {"text": "Commented-code block (12 lines) in frontend/src/lib/backendAttestation/verify.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-988c13aae9739278", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/apply-vendor-redirects.mjs:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/apply-vendor-redirects.mjs:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40ca089108e57375", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/src/api.ts:39", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/src/api.ts:39"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96fbc81196603932", "name": "Commented-code block (5 lines) in backend/src/__tests__/billing-routes.test.ts:255", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/__tests__/billing-routes.test.ts:255"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d340182c1606d43", "name": "Commented-code block (5 lines) in backend/src/routes/chat.ts:36", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/routes/chat.ts:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1881cc1ccdec6745", "name": "Commented-code block (6 lines) in backend/src/billing/stripe.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in backend/src/billing/stripe.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d07583da6c922921", "name": "`fetch()` without try/.catch or AbortSignal \u2014 backend/src/billing/stripe.ts:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/src/billing/stripe.ts:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a0a9241919377e9", "name": "Commented-code block (10 lines) in backend/src/billing/tiers.ts:4", "shortDescription": {"text": "Commented-code block (10 lines) in backend/src/billing/tiers.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b8f7a4ff77d78c2", "name": "Commented-code block (5 lines) in backend/src/billing/usage.ts:4", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/billing/usage.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc0f9d8e41b33b0e", "name": "11 env vars used in code but missing from .env.example", "shortDescription": {"text": "11 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CREDIT_BUDGET_FREE`, `CREDIT_BUDGET_PLUS`, `CREDIT_BUDGET_PLUS_WEEKLY`, `CREDIT_BUDGET_PRO`, `CREDIT_BUDGET_PRO_WEEKLY`, `DSTACK_SOCKET`, `HTTPS_CERT_FILE`, `HTTPS_KEY_FILE` + 3 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-006fff95531691ca", "name": "Frontend route `/chat/*` has no Link/navigate to it \u2014 frontend/src/main.tsx", "shortDescription": {"text": "Frontend route `/chat/*` has no Link/navigate to it \u2014 frontend/src/main.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09625d9375a5190f", "name": "Dangling fetch: GET http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:20)", "shortDescription": {"text": "Dangling fetch: GET http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:20)"}, "fullDescription": {"text": "`packages/server/src/__tests__/csrf.test.ts:20` calls `GET http://localhost:${port}/test` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:/<p>/test`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d1dffb20eb000e6", "name": "Dangling fetch: HEAD http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:48)", "shortDescription": {"text": "Dangling fetch: HEAD http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:48)"}, "fullDescription": {"text": "`packages/server/src/__tests__/csrf.test.ts:48` calls `HEAD http://localhost:${port}/test` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:/<p>/test`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ff8bf4096553357", "name": "Dangling fetch: OPTIONS http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:60)", "shortDescription": {"text": "Dangling fetch: OPTIONS http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:60)"}, "fullDescription": {"text": "`packages/server/src/__tests__/csrf.test.ts:60` calls `OPTIONS http://localhost:${port}/test` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:/<p>/test`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a8025e873ecf292", "name": "Dangling fetch: GET http://localhost:${port}${path} (backend/src/__tests__/server-info.test.ts:12)", "shortDescription": {"text": "Dangling fetch: GET http://localhost:${port}${path} (backend/src/__tests__/server-info.test.ts:12)"}, "fullDescription": {"text": "`backend/src/__tests__/server-info.test.ts:12` calls `GET http://localhost:${port}${path}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff160b71c4d819c9", "name": "Dangling fetch: POST /GetQuote (backend/src/attestation/dstackClient.ts:31)", "shortDescription": {"text": "Dangling fetch: POST /GetQuote (backend/src/attestation/dstackClient.ts:31)"}, "fullDescription": {"text": "`backend/src/attestation/dstackClient.ts:31` calls `POST /GetQuote` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/getquote`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc29c085fd7a4558", "name": "Dangling fetch: GET /Info (backend/src/attestation/dstackClient.ts:48)", "shortDescription": {"text": "Dangling fetch: GET /Info (backend/src/attestation/dstackClient.ts:48)"}, "fullDescription": {"text": "`backend/src/attestation/dstackClient.ts:48` calls `GET /Info` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/info`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b30c69fa2fcf4e59", "name": "Unused endpoint: POST /api/billing/webhook", "shortDescription": {"text": "Unused endpoint: POST /api/billing/webhook"}, "fullDescription": {"text": "`backend/src/index.ts` declares `POST /api/billing/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76d4f920c75f1f89", "name": "Unused endpoint: USE /api/phala-verify", "shortDescription": {"text": "Unused endpoint: USE /api/phala-verify"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/phala-verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a604d4e6758dd39", "name": "Unused endpoint: USE /api/manifest", "shortDescription": {"text": "Unused endpoint: USE /api/manifest"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/manifest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c946674eece7396c", "name": "Unused endpoint: USE /api/server-info", "shortDescription": {"text": "Unused endpoint: USE /api/server-info"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/server-info` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb452fbfb454d20", "name": "Unused endpoint: USE /api/auth", "shortDescription": {"text": "Unused endpoint: USE /api/auth"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e118596182b97fe2", "name": "Unused endpoint: USE /api/delegations", "shortDescription": {"text": "Unused endpoint: USE /api/delegations"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/delegations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b92dc87a4256298", "name": "Unused endpoint: USE /api/chat", "shortDescription": {"text": "Unused endpoint: USE /api/chat"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d2d603599bcada4", "name": "Unused endpoint: USE /api/signature", "shortDescription": {"text": "Unused endpoint: USE /api/signature"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/signature` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c5adcc1eff6ddfc", "name": "Unused endpoint: USE /api/nras-proxy", "shortDescription": {"text": "Unused endpoint: USE /api/nras-proxy"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/nras-proxy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09ff24eea78e55d0", "name": "Unused endpoint: USE /api/attestation/self", "shortDescription": {"text": "Unused endpoint: USE /api/attestation/self"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/attestation/self` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-946dc627de4f272d", "name": "Unused endpoint: USE /api/billing", "shortDescription": {"text": "Unused endpoint: USE /api/billing"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/billing` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf049e5f9a2ed0eb", "name": "Unused endpoint: GET /api/openapi.json", "shortDescription": {"text": "Unused endpoint: GET /api/openapi.json"}, "fullDescription": {"text": "`backend/src/index.ts` declares `GET /api/openapi.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d83a39f66cb5706", "name": "Unused endpoint: USE /api/docs", "shortDescription": {"text": "Unused endpoint: USE /api/docs"}, "fullDescription": {"text": "`backend/src/index.ts` declares `USE /api/docs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd88668bef85d3ea", "name": "Unused endpoint: GET /nonce", "shortDescription": {"text": "Unused endpoint: GET /nonce"}, "fullDescription": {"text": "`backend/src/routes/auth.ts` declares `GET /nonce` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aee9168e964a3822", "name": "Unused endpoint: POST /verify", "shortDescription": {"text": "Unused endpoint: POST /verify"}, "fullDescription": {"text": "`backend/src/routes/auth.ts` declares `POST /verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`backend/src/routes/phala-verify.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6f48e60c30777ab", "name": "Unused endpoint: GET /config", "shortDescription": {"text": "Unused endpoint: GET /config"}, "fullDescription": {"text": "`backend/src/routes/billing.ts` declares `GET /config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08b1abb2d39d69bf", "name": "Unused endpoint: GET /rates", "shortDescription": {"text": "Unused endpoint: GET /rates"}, "fullDescription": {"text": "`backend/src/routes/billing.ts` declares `GET /rates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6385cd0e163a390f", "name": "Unused endpoint: POST /checkout", "shortDescription": {"text": "Unused endpoint: POST /checkout"}, "fullDescription": {"text": "`backend/src/routes/billing.ts` declares `POST /checkout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ec7e423e24778e4", "name": "Unused endpoint: POST /portal", "shortDescription": {"text": "Unused endpoint: POST /portal"}, "fullDescription": {"text": "`backend/src/routes/billing.ts` declares `POST /portal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/src/routes/server-info.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b30f4c0994a30b4", "name": "Unused endpoint: DELETE /", "shortDescription": {"text": "Unused endpoint: DELETE /"}, "fullDescription": {"text": "`backend/src/routes/delegations.ts` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c46c9949817d051a", "name": "Unused endpoint: GET /jwks", "shortDescription": {"text": "Unused endpoint: GET /jwks"}, "fullDescription": {"text": "`backend/src/routes/nras-proxy.ts` declares `GET /jwks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`backend/src/routes/chat.ts` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`backend/src/routes/signature.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21331"}, "properties": {"repository": "TinyCloudLabs/tinychat", "repoUrl": "https://github.com/TinyCloudLabs/tinychat", "branch": "main"}, "results": [{"ruleId": "scanner-087a08586c9ba144", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/App.tsx:977"}, "properties": {"repobilityId": "f44d8d7343acc231", "scanner": "scanner-primary", "fingerprint": "087a08586c9ba144", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2e460c4d27ae92ae", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/RatesDialog.tsx:105"}, "properties": {"repobilityId": "15156be14278b785", "scanner": "scanner-primary", "fingerprint": "2e460c4d27ae92ae", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8b3aba0a08be70d9", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/ImportDialog.tsx:472"}, "properties": {"repobilityId": "1c32c5ef98103931", "scanner": "scanner-primary", "fingerprint": "8b3aba0a08be70d9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1e6b295bc9a9d494", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/SettingsPage.tsx:293"}, "properties": {"repobilityId": "cc732ca2303c3334", "scanner": "scanner-primary", "fingerprint": "1e6b295bc9a9d494", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1ddd366621873006", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/chat/ThreadList.tsx:34"}, "properties": {"repobilityId": "834878851230ea4a", "scanner": "scanner-primary", "fingerprint": "1ddd366621873006", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f2a012c045f651fa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test/real-auth-manual.ts:22"}, "properties": {"repobilityId": "b2f215aef67c375b", "scanner": "scanner-primary", "fingerprint": "f2a012c045f651fa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-94c99ea67c2783d1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/src/openkey.ts:87"}, "properties": {"repobilityId": "0e520aa02f44a0c8", "scanner": "scanner-primary", "fingerprint": "94c99ea67c2783d1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3d8006b49610a116", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/client/src/__tests__/tinycloud-wasm-init-fix.test.ts:73"}, "properties": {"repobilityId": "99c5e2ac6d9f29da", "scanner": "scanner-primary", "fingerprint": "3d8006b49610a116", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5d710f8c17b9e31c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/scripts/generate-key.ts:23"}, "properties": {"repobilityId": "783a0ec237249171", "scanner": "scanner-primary", "fingerprint": "5d710f8c17b9e31c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c9e4af8d829fb414", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/src/index.ts:151"}, "properties": {"repobilityId": "db2171a39601fa41", "scanner": "scanner-primary", "fingerprint": "c9e4af8d829fb414", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d63910c9a9f88cfe", "level": "warning", "message": {"text": "Privileged port 256 in use"}, "properties": {"repobilityId": "0ec1f2d0c9e6da94", "scanner": "scanner-primary", "fingerprint": "d63910c9a9f88cfe", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/phala-ingress/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c25aa3cf5d135e28", "level": "warning", "message": {"text": "Dockerfile runs as root: infra/phala-ingress/Dockerfile"}, "properties": {"repobilityId": "9ea4f82df04d514d", "scanner": "scanner-primary", "fingerprint": "c25aa3cf5d135e28", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-6efaad1edde147fc", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: oven/bun:1.3.9"}, "properties": {"repobilityId": "bcb0fb0f4c9a8049", "scanner": "scanner-primary", "fingerprint": "6efaad1edde147fc", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-2c482023445423a4", "level": "error", "message": {"text": "Runtime dotenv file present in repo: frontend/.env.production"}, "properties": {"repobilityId": "f727d22a89e309c5", "scanner": "scanner-primary", "fingerprint": "2c482023445423a4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/.env.production"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5a2d927ca1067c4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "234563ee95a10057", "scanner": "scanner-primary", "fingerprint": "c5a2d927ca1067c4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-backend-phala.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-c5a2d927ca1067c4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c14121905d74b16", "scanner": "scanner-primary", "fingerprint": "c5a2d927ca1067c4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-backend-phala.yml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-c5a2d927ca1067c4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5d9b44dc6b9d2f7", "scanner": "scanner-primary", "fingerprint": "c5a2d927ca1067c4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-backend-phala.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-c5a2d927ca1067c4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5d9b44dc6b9d2f7", "scanner": "scanner-primary", "fingerprint": "c5a2d927ca1067c4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-backend-phala.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-d89807b5935482ae", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ad5ed3ebb620607c", "scanner": "scanner-primary", "fingerprint": "d89807b5935482ae", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-backend-phala.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bc180d1d538d147", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a2e090dc0fe43f0", "scanner": "scanner-primary", "fingerprint": "3bc180d1d538d147", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-images.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-3bc180d1d538d147", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bddd33f1f76558f2", "scanner": "scanner-primary", "fingerprint": "3bc180d1d538d147", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-images.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-3bc180d1d538d147", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fd57adb30b142171", "scanner": "scanner-primary", "fingerprint": "3bc180d1d538d147", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-images.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-3bc180d1d538d147", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fd57adb30b142171", "scanner": "scanner-primary", "fingerprint": "3bc180d1d538d147", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-images.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-673fd08c667efadb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "30ccbe03d3acd7cd", "scanner": "scanner-primary", "fingerprint": "673fd08c667efadb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-images.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d64dc21e1e57aa0", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "d3a48ba334ce7570", "scanner": "scanner-primary", "fingerprint": "7d64dc21e1e57aa0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea475230b943f200", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "0d130e59b28c0cb7", "scanner": "scanner-primary", "fingerprint": "ea475230b943f200", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "33e6260e0493631b", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-0e8a76eb13fd3249", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: frontend/package.json"}, "properties": {"repobilityId": "d8c65da5b68ee95b", "scanner": "scanner-primary", "fingerprint": "0e8a76eb13fd3249", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d53f0b13302a0d8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: test/package.json"}, "properties": {"repobilityId": "b52b5485e8072dfb", "scanner": "scanner-primary", "fingerprint": "5d53f0b13302a0d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "test/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1f0c52db7c97cef", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "properties": {"repobilityId": "708197ec3b624f59", "scanner": "scanner-primary", "fingerprint": "f1f0c52db7c97cef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b739f2f2be1d714d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "properties": {"repobilityId": "d7cb4fafc3b292b2", "scanner": "scanner-primary", "fingerprint": "b739f2f2be1d714d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a092b5c39e242a1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: backend/package.json"}, "properties": {"repobilityId": "fc853e57ce7048c4", "scanner": "scanner-primary", "fingerprint": "3a092b5c39e242a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "74caa92c50d90a97", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "625cb2bad8d6d580", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4cf7bd8cfc919056", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "31ddc89ae7e194c9", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "56c4e7fc80b7f774", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b0a04b4ae35187ec", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/App.tsx:118"}, "properties": {"repobilityId": "3d510114d3137eba", "scanner": "scanner-primary", "fingerprint": "b0a04b4ae35187ec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fcffc9ee6670c378", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/MemoryPanel.tsx:97"}, "properties": {"repobilityId": "204cef758825a4a0", "scanner": "scanner-primary", "fingerprint": "fcffc9ee6670c378", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd2fe812be6e124d", "level": "none", "message": {"text": "Commented-code block (11 lines) in frontend/src/chat/pendingHandoff.ts:3"}, "properties": {"repobilityId": "a57bd402cd914efb", "scanner": "scanner-primary", "fingerprint": "cd2fe812be6e124d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3b0e145d3216cef0", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/chat/Thread.tsx:55"}, "properties": {"repobilityId": "c7f14e26b10cb7dc", "scanner": "scanner-primary", "fingerprint": "3b0e145d3216cef0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06c6a5d4dcd97a98", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/chat/ImportDialog.tsx:201"}, "properties": {"repobilityId": "0c47f6f756beb2f0", "scanner": "scanner-primary", "fingerprint": "06c6a5d4dcd97a98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-684018b3c9c4fbfc", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/chat/runtime.tsx:107"}, "properties": {"repobilityId": "51104d6656f68d9b", "scanner": "scanner-primary", "fingerprint": "684018b3c9c4fbfc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-563f57c4e0a66451", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/chat/runtime.tsx:327"}, "properties": {"repobilityId": "f03c21344e74077b", "scanner": "scanner-primary", "fingerprint": "563f57c4e0a66451", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-35628dce0edf0920", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/chat/ModelVerificationBadge.tsx:125"}, "properties": {"repobilityId": "48d1c25c86caad2b", "scanner": "scanner-primary", "fingerprint": "35628dce0edf0920", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e7538ef9fb2dee4b", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/lib/threadStore.ts:14"}, "properties": {"repobilityId": "45fc10fd204a1b10", "scanner": "scanner-primary", "fingerprint": "e7538ef9fb2dee4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-44eb57a1d0949786", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/lib/vendorRedirects.test.ts:5"}, "properties": {"repobilityId": "438e211ad319aaac", "scanner": "scanner-primary", "fingerprint": "44eb57a1d0949786", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6a7c1222aabb6ada", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/useModelVerification.ts:117"}, "properties": {"repobilityId": "cb3b9fae7a091f41", "scanner": "scanner-primary", "fingerprint": "6a7c1222aabb6ada", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64968e73bf50d26a", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/lib/historyPrefetch.ts:10"}, "properties": {"repobilityId": "c84ede2a4571d199", "scanner": "scanner-primary", "fingerprint": "64968e73bf50d26a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e720125d5fe8861", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/claudeImport.ts:256"}, "properties": {"repobilityId": "33f29c1cccb01e31", "scanner": "scanner-primary", "fingerprint": "5e720125d5fe8861", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03c3f79f5a89e965", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/lib/completionStore.ts:3"}, "properties": {"repobilityId": "374308a93b92e5b4", "scanner": "scanner-primary", "fingerprint": "03c3f79f5a89e965", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-97e5eb626e51ce3b", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/sanitizeModel.test.ts:58"}, "properties": {"repobilityId": "42d21bccdc233f65", "scanner": "scanner-primary", "fingerprint": "97e5eb626e51ce3b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa698d03143fb355", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/lib/memory.ts:254"}, "properties": {"repobilityId": "a68282f704d24d19", "scanner": "scanner-primary", "fingerprint": "fa698d03143fb355", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2dd54d94cbcef1f0", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/lib/useVisualViewport.ts:6"}, "properties": {"repobilityId": "80993bd25c96ac1e", "scanner": "scanner-primary", "fingerprint": "2dd54d94cbcef1f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e7d90889f838d0d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/chatApi.ts:168"}, "properties": {"repobilityId": "24a62d02a2162413", "scanner": "scanner-primary", "fingerprint": "5e7d90889f838d0d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2693c0893c3c12c6", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/lib/backendAttestation/rtmr3.ts:8"}, "properties": {"repobilityId": "f4926041cb1b0bfa", "scanner": "scanner-primary", "fingerprint": "2693c0893c3c12c6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8dcdb017b0ea195d", "level": "none", "message": {"text": "Commented-code block (12 lines) in frontend/src/lib/backendAttestation/verify.ts:7"}, "properties": {"repobilityId": "7f36dce88b67b1d0", "scanner": "scanner-primary", "fingerprint": "8dcdb017b0ea195d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-988c13aae9739278", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/apply-vendor-redirects.mjs:49"}, "properties": {"repobilityId": "423f32d23f56ad04", "scanner": "scanner-primary", "fingerprint": "988c13aae9739278", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-40ca089108e57375", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/src/api.ts:39"}, "properties": {"repobilityId": "880aa18e8df8c473", "scanner": "scanner-primary", "fingerprint": "40ca089108e57375", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-96fbc81196603932", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/__tests__/billing-routes.test.ts:255"}, "properties": {"repobilityId": "7d9b8da113ca8a56", "scanner": "scanner-primary", "fingerprint": "96fbc81196603932", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1d340182c1606d43", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/routes/chat.ts:36"}, "properties": {"repobilityId": "488ff3f58d1c0e44", "scanner": "scanner-primary", "fingerprint": "1d340182c1606d43", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1881cc1ccdec6745", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/src/billing/stripe.ts:1"}, "properties": {"repobilityId": "350e25474b6728ae", "scanner": "scanner-primary", "fingerprint": "1881cc1ccdec6745", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d07583da6c922921", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/src/billing/stripe.ts:61"}, "properties": {"repobilityId": "6921c0182ebd8f03", "scanner": "scanner-primary", "fingerprint": "d07583da6c922921", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4a0a9241919377e9", "level": "none", "message": {"text": "Commented-code block (10 lines) in backend/src/billing/tiers.ts:4"}, "properties": {"repobilityId": "f50b4dbc995aeeb7", "scanner": "scanner-primary", "fingerprint": "4a0a9241919377e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3b8f7a4ff77d78c2", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/billing/usage.ts:4"}, "properties": {"repobilityId": "ced706cd68c01d60", "scanner": "scanner-primary", "fingerprint": "3b8f7a4ff77d78c2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc0f9d8e41b33b0e", "level": "note", "message": {"text": "11 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "c82cd8cd626c3599", "scanner": "scanner-primary", "fingerprint": "cc0f9d8e41b33b0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-006fff95531691ca", "level": "warning", "message": {"text": "Frontend route `/chat/*` has no Link/navigate to it \u2014 frontend/src/main.tsx"}, "properties": {"repobilityId": "d3bb9aab69718d70", "scanner": "scanner-primary", "fingerprint": "006fff95531691ca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-09625d9375a5190f", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:20)"}, "properties": {"repobilityId": "4ba9b3cbf04c2b6b", "scanner": "scanner-primary", "fingerprint": "09625d9375a5190f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-2d1dffb20eb000e6", "level": "error", "message": {"text": "Dangling fetch: HEAD http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:48)"}, "properties": {"repobilityId": "3a8121b0ca047b1d", "scanner": "scanner-primary", "fingerprint": "2d1dffb20eb000e6", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1ff8bf4096553357", "level": "error", "message": {"text": "Dangling fetch: OPTIONS http://localhost:${port}/test (packages/server/src/__tests__/csrf.test.ts:60)"}, "properties": {"repobilityId": "f6873bdad1def5f8", "scanner": "scanner-primary", "fingerprint": "1ff8bf4096553357", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0a8025e873ecf292", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:${port}${path} (backend/src/__tests__/server-info.test.ts:12)"}, "properties": {"repobilityId": "eea915518230cfac", "scanner": "scanner-primary", "fingerprint": "0a8025e873ecf292", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ff160b71c4d819c9", "level": "error", "message": {"text": "Dangling fetch: POST /GetQuote (backend/src/attestation/dstackClient.ts:31)"}, "properties": {"repobilityId": "971361c679a67c8d", "scanner": "scanner-primary", "fingerprint": "ff160b71c4d819c9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-fc29c085fd7a4558", "level": "error", "message": {"text": "Dangling fetch: GET /Info (backend/src/attestation/dstackClient.ts:48)"}, "properties": {"repobilityId": "8869d97dc2ca55e7", "scanner": "scanner-primary", "fingerprint": "fc29c085fd7a4558", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-b30c69fa2fcf4e59", "level": "note", "message": {"text": "Unused endpoint: POST /api/billing/webhook"}, "properties": {"repobilityId": "b04837b0c233cacb", "scanner": "scanner-primary", "fingerprint": "b30c69fa2fcf4e59", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76d4f920c75f1f89", "level": "note", "message": {"text": "Unused endpoint: USE /api/phala-verify"}, "properties": {"repobilityId": "5b8be844afa0cdb1", "scanner": "scanner-primary", "fingerprint": "76d4f920c75f1f89", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a604d4e6758dd39", "level": "note", "message": {"text": "Unused endpoint: USE /api/manifest"}, "properties": {"repobilityId": "ad530d9b5aa28bf9", "scanner": "scanner-primary", "fingerprint": "1a604d4e6758dd39", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c946674eece7396c", "level": "note", "message": {"text": "Unused endpoint: USE /api/server-info"}, "properties": {"repobilityId": "3878ec87bb7517d3", "scanner": "scanner-primary", "fingerprint": "c946674eece7396c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eb452fbfb454d20", "level": "note", "message": {"text": "Unused endpoint: USE /api/auth"}, "properties": {"repobilityId": "cccae14f00e10547", "scanner": "scanner-primary", "fingerprint": "6eb452fbfb454d20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e118596182b97fe2", "level": "note", "message": {"text": "Unused endpoint: USE /api/delegations"}, "properties": {"repobilityId": "d94ca11ffd5f22a2", "scanner": "scanner-primary", "fingerprint": "e118596182b97fe2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b92dc87a4256298", "level": "note", "message": {"text": "Unused endpoint: USE /api/chat"}, "properties": {"repobilityId": "e59976f56340b13f", "scanner": "scanner-primary", "fingerprint": "2b92dc87a4256298", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d2d603599bcada4", "level": "note", "message": {"text": "Unused endpoint: USE /api/signature"}, "properties": {"repobilityId": "764c9c4b2466f6f2", "scanner": "scanner-primary", "fingerprint": "8d2d603599bcada4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c5adcc1eff6ddfc", "level": "note", "message": {"text": "Unused endpoint: USE /api/nras-proxy"}, "properties": {"repobilityId": "745290338c669e83", "scanner": "scanner-primary", "fingerprint": "5c5adcc1eff6ddfc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-09ff24eea78e55d0", "level": "note", "message": {"text": "Unused endpoint: USE /api/attestation/self"}, "properties": {"repobilityId": "6007a12b2fdd572d", "scanner": "scanner-primary", "fingerprint": "09ff24eea78e55d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-946dc627de4f272d", "level": "note", "message": {"text": "Unused endpoint: USE /api/billing"}, "properties": {"repobilityId": "9b7142a3c226970c", "scanner": "scanner-primary", "fingerprint": "946dc627de4f272d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf049e5f9a2ed0eb", "level": "note", "message": {"text": "Unused endpoint: GET /api/openapi.json"}, "properties": {"repobilityId": "8fe86ed1cc1626ac", "scanner": "scanner-primary", "fingerprint": "cf049e5f9a2ed0eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d83a39f66cb5706", "level": "note", "message": {"text": "Unused endpoint: USE /api/docs"}, "properties": {"repobilityId": "42be8648cdb7c967", "scanner": "scanner-primary", "fingerprint": "5d83a39f66cb5706", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dd88668bef85d3ea", "level": "note", "message": {"text": "Unused endpoint: GET /nonce"}, "properties": {"repobilityId": "3d66e5d9eaa47aa7", "scanner": "scanner-primary", "fingerprint": "dd88668bef85d3ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aee9168e964a3822", "level": "note", "message": {"text": "Unused endpoint: POST /verify"}, "properties": {"repobilityId": "ee9107631837d7e6", "scanner": "scanner-primary", "fingerprint": "aee9168e964a3822", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "f409c1061659f122", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6f48e60c30777ab", "level": "note", "message": {"text": "Unused endpoint: GET /config"}, "properties": {"repobilityId": "bf070cc5488b52de", "scanner": "scanner-primary", "fingerprint": "a6f48e60c30777ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-08b1abb2d39d69bf", "level": "note", "message": {"text": "Unused endpoint: GET /rates"}, "properties": {"repobilityId": "ff02a459c2d98432", "scanner": "scanner-primary", "fingerprint": "08b1abb2d39d69bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6385cd0e163a390f", "level": "note", "message": {"text": "Unused endpoint: POST /checkout"}, "properties": {"repobilityId": "0317a795a44ec77e", "scanner": "scanner-primary", "fingerprint": "6385cd0e163a390f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1ec7e423e24778e4", "level": "note", "message": {"text": "Unused endpoint: POST /portal"}, "properties": {"repobilityId": "42eb274145503ef7", "scanner": "scanner-primary", "fingerprint": "1ec7e423e24778e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "edefcfe27f0af5f1", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b30f4c0994a30b4", "level": "note", "message": {"text": "Unused endpoint: DELETE /"}, "properties": {"repobilityId": "351f265ad5439cab", "scanner": "scanner-primary", "fingerprint": "3b30f4c0994a30b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c46c9949817d051a", "level": "note", "message": {"text": "Unused endpoint: GET /jwks"}, "properties": {"repobilityId": "58e76b9cafa28c59", "scanner": "scanner-primary", "fingerprint": "c46c9949817d051a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "3b06350842052449", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "5f30021b1c25a7f2", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}