{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a7bbcc9a671e82e3", "name": "Possibly dead Python function: count_unique_visitors", "shortDescription": {"text": "Possibly dead Python function: count_unique_visitors"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02bce8c5517bf23a", "name": "Possibly dead Python function: trim_all", "shortDescription": {"text": "Possibly dead Python function: trim_all"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95892c68ac7cba7a", "name": "Possibly dead Python function: build_teardown_email", "shortDescription": {"text": "Possibly dead Python function: build_teardown_email"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8dc2d1120f5e2bc", "name": "Possibly dead Python function: load_watchers", "shortDescription": {"text": "Possibly dead Python function: load_watchers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fa32304cf48c44c", "name": "Possibly dead Python function: save_watchers", "shortDescription": {"text": "Possibly dead Python function: save_watchers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f0c6252be971a44", "name": "Possibly dead Python function: heal_gunicorn", "shortDescription": {"text": "Possibly dead Python function: heal_gunicorn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c3aeed6ce6d3d10", "name": "Possibly dead Python function: heal_web_watcher", "shortDescription": {"text": "Possibly dead Python function: heal_web_watcher"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ff74db4fa662251", "name": "Possibly dead Python function: heal_apache", "shortDescription": {"text": "Possibly dead Python function: heal_apache"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c5717bead6e2b80", "name": "Possibly dead Python function: check_gunicorn", "shortDescription": {"text": "Possibly dead Python function: check_gunicorn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f71b65789e319e67", "name": "Possibly dead Python function: check_web_watcher", "shortDescription": {"text": "Possibly dead Python function: check_web_watcher"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f249f496e7d286a", "name": "Possibly dead Python function: check_apache", "shortDescription": {"text": "Possibly dead Python function: check_apache"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-651e1818b46e2add", "name": "Possibly dead Python function: check_disk", "shortDescription": {"text": "Possibly dead Python function: check_disk"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e95412e36270a7b", "name": "Possibly dead Python function: best_from_candidates", "shortDescription": {"text": "Possibly dead Python function: best_from_candidates"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db90b84bad0dace6", "name": "Possibly dead Python function: find_in_html", "shortDescription": {"text": "Possibly dead Python function: find_in_html"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81452b7f8efa0298", "name": "Possibly dead Python function: analyze_drop_announcement", "shortDescription": {"text": "Possibly dead Python function: analyze_drop_announcement"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-acef1e0a85fef699", "name": "Insecure pattern 'tls_verify_false' in backfill_alerter.py:140", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in backfill_alerter.py:140"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-835e867b31e3ee50", "name": "Insecure pattern 'chmod_777' in archive/preflight.py:647", "shortDescription": {"text": "Insecure pattern 'chmod_777' in archive/preflight.py:647"}, "fullDescription": {"text": "Found a known-risky pattern (chmod_777). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1fcb8b960c661682", "name": "Insecure pattern 'direct_innerhtml_assignment' in html/read-ahead.html:640", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/read-ahead.html:640"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35430f2787774b48", "name": "Insecure pattern 'local_storage_auth_token' in html/read-ahead.html:168", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in html/read-ahead.html:168"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21bbdf990a1c7e3e", "name": "Insecure pattern 'local_storage_auth_token' in html/annual.html:826", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in html/annual.html:826"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6338b4f68747591", "name": "Insecure pattern 'direct_innerhtml_assignment' in html/watcher_status.html:302", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/watcher_status.html:302"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86276004885e1b3c", "name": "Insecure pattern 'direct_innerhtml_assignment' in html/watchlist.html:538", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/watchlist.html:538"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d879328ede07866", "name": "Insecure pattern 'direct_innerhtml_assignment' in html/wall.html:79", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/wall.html:79"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e654496173895eee", "name": "Insecure pattern 'direct_innerhtml_assignment' in html/my-alerts.html:187", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/my-alerts.html:187"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0adb8590a03c3321", "name": "Insecure pattern 'direct_innerhtml_assignment' in html/mockups/global-watch-mockup.html:206", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/mockups/global-watch-mockup.html:206"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1a071e43a531ea4", "name": "Very large file: watcher_signup.py (1453 lines)", "shortDescription": {"text": "Very large file: watcher_signup.py (1453 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58341ecbb1def479", "name": "Very large file: tests/test_core.py (2991 lines)", "shortDescription": {"text": "Very large file: tests/test_core.py (2991 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 50 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c9b667390749f6d3", "name": "Commented-code block (6 lines) in lunar_hunter.py:57", "shortDescription": {"text": "Commented-code block (6 lines) in lunar_hunter.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bcc177d2f8d34a5b", "name": "Network/subprocess call without timeout or try/except \u2014 watchdog.py:67", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 watchdog.py:67"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7f3371300820d4f", "name": "Commented-code block (6 lines) in linkpick.py:37", "shortDescription": {"text": "Commented-code block (6 lines) in linkpick.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-13129d769146ca6b", "name": "Legacy-named symbol `test_prune_sent_removes_old` in tests/test_core.py:1079", "shortDescription": {"text": "Legacy-named symbol `test_prune_sent_removes_old` in tests/test_core.py:1079"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb0f9280a8941083", "name": "Commented-code block (7 lines) in agents/ai_interpreter.py:176", "shortDescription": {"text": "Commented-code block (7 lines) in agents/ai_interpreter.py:176"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-12a6bb013c385a93", "name": "Commented-code block (5 lines) in agents/product_extract.py:269", "shortDescription": {"text": "Commented-code block (5 lines) in agents/product_extract.py:269"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ngenerate_public_stats.py:main, generate_simon_status.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f51790517f5ff48d", "name": "Flask mutation route `watch` without `@login_required` \u2014 watcher_signup.py:360", "shortDescription": {"text": "Flask mutation route `watch` without `@login_required` \u2014 watcher_signup.py:360"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee8f786565a12f36", "name": "Flask mutation route `keyword_quality` without `@login_required` \u2014 watcher_signup.py:645", "shortDescription": {"text": "Flask mutation route `keyword_quality` without `@login_required` \u2014 watcher_signup.py:645"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a271dcf9e61d6c4c", "name": "Flask mutation route `resend_link` without `@login_required` \u2014 watcher_signup.py:671", "shortDescription": {"text": "Flask mutation route `resend_link` without `@login_required` \u2014 watcher_signup.py:671"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48bcf4c28aac8663", "name": "Flask mutation route `stop_watching` without `@login_required` \u2014 watcher_signup.py:728", "shortDescription": {"text": "Flask mutation route `stop_watching` without `@login_required` \u2014 watcher_signup.py:728"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3385b47ecdd40fb8", "name": "Flask mutation route `set_watch_maker` without `@login_required` \u2014 watcher_signup.py:745", "shortDescription": {"text": "Flask mutation route `set_watch_maker` without `@login_required` \u2014 watcher_signup.py:745"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1cb997d0999470b", "name": "Flask mutation route `verify_phone` without `@login_required` \u2014 watcher_signup.py:909", "shortDescription": {"text": "Flask mutation route `verify_phone` without `@login_required` \u2014 watcher_signup.py:909"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08fbc678c84c1795", "name": "Flask mutation route `track_pageview` without `@login_required` \u2014 watcher_signup.py:935", "shortDescription": {"text": "Flask mutation route `track_pageview` without `@login_required` \u2014 watcher_signup.py:935"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ad880641a1a83b4", "name": "Flask mutation route `watch_remove` without `@login_required` \u2014 watcher_signup.py:955", "shortDescription": {"text": "Flask mutation route `watch_remove` without `@login_required` \u2014 watcher_signup.py:955"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6cab99f2953eaec2", "name": "Flask mutation route `unsubscribe` without `@login_required` \u2014 watcher_signup.py:1032", "shortDescription": {"text": "Flask mutation route `unsubscribe` without `@login_required` \u2014 watcher_signup.py:1032"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c70601104ae57a99", "name": "Flask mutation route `check_url` without `@login_required` \u2014 watcher_signup.py:1150", "shortDescription": {"text": "Flask mutation route `check_url` without `@login_required` \u2014 watcher_signup.py:1150"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3dba106eaae82ace", "name": "Flask mutation route `nkd_submit` without `@login_required` \u2014 watcher_signup.py:1253", "shortDescription": {"text": "Flask mutation route `nkd_submit` without `@login_required` \u2014 watcher_signup.py:1253"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac675db087eaecf3", "name": "Flask mutation route `feedback` without `@login_required` \u2014 watcher_signup.py:1411", "shortDescription": {"text": "Flask mutation route `feedback` without `@login_required` \u2014 watcher_signup.py:1411"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5109d0098e444b13", "name": "Unused endpoint: ANY /api/watch", "shortDescription": {"text": "Unused endpoint: ANY /api/watch"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/watch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed378f96ed3e13cc", "name": "Unused endpoint: ANY /api/keyword-quality", "shortDescription": {"text": "Unused endpoint: ANY /api/keyword-quality"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/keyword-quality` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7cba4a079024ff2", "name": "Unused endpoint: ANY /api/makers", "shortDescription": {"text": "Unused endpoint: ANY /api/makers"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/makers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b42c94f1d413b57f", "name": "Unused endpoint: ANY /api/resend-link", "shortDescription": {"text": "Unused endpoint: ANY /api/resend-link"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/resend-link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fa24de488535c0d", "name": "Unused endpoint: ANY /api/my-watch/<watch_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/my-watch/<watch_id>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/my-watch/<watch_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d71d00927862a2ae", "name": "Unused endpoint: ANY /api/watch-maker/<watch_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/watch-maker/<watch_id>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/watch-maker/<watch_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-199a203d0a48b7ab", "name": "Unused endpoint: ANY /api/my-watch/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/my-watch/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/my-watch/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a97f527df37b16a7", "name": "Unused endpoint: ANY /api/my-alerts/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/my-alerts/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/my-alerts/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-999b7d061ba9a05d", "name": "Unused endpoint: ANY /api/verify/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/verify/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/verify/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d06e5d050c85491", "name": "Unused endpoint: ANY /api/verify-phone", "shortDescription": {"text": "Unused endpoint: ANY /api/verify-phone"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/verify-phone` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14f52e981382c950", "name": "Unused endpoint: ANY /api/watch-remove/<watch_id>/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/watch-remove/<watch_id>/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/watch-remove/<watch_id>/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1690840295011a86", "name": "Unused endpoint: ANY /api/ack/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/ack/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/ack/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32832ceaaa5ac2dc", "name": "Unused endpoint: ANY /api/unsubscribe/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/unsubscribe/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/unsubscribe/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec3442aa0b6ba39d", "name": "Unused endpoint: ANY /api/stats", "shortDescription": {"text": "Unused endpoint: ANY /api/stats"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0821d7bc3ee12715", "name": "Unused endpoint: ANY /api/check-url", "shortDescription": {"text": "Unused endpoint: ANY /api/check-url"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/check-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60cc32f4f70febcc", "name": "Unused endpoint: ANY /api/nkd/<token>", "shortDescription": {"text": "Unused endpoint: ANY /api/nkd/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/nkd/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8bde1b80f0c42af", "name": "Unused endpoint: ANY /api/nkd/wall", "shortDescription": {"text": "Unused endpoint: ANY /api/nkd/wall"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/nkd/wall` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cf24c469a8d39b8", "name": "Unused endpoint: ANY /api/feedback", "shortDescription": {"text": "Unused endpoint: ANY /api/feedback"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /api/feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e892aabe09a0096d", "name": "Unused endpoint: ANY /go_shankyou/<token>", "shortDescription": {"text": "Unused endpoint: ANY /go_shankyou/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /go_shankyou/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81bdfb2cee300334", "name": "Unused endpoint: ANY /sharp/<token>", "shortDescription": {"text": "Unused endpoint: ANY /sharp/<token>"}, "fullDescription": {"text": "`watcher_signup.py` declares `ANY /sharp/<token>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19685"}, "properties": {"repository": "simonhg321/drop-watcher", "repoUrl": "https://github.com/simonhg321/drop-watcher", "branch": "main"}, "results": [{"ruleId": "scanner-a7bbcc9a671e82e3", "level": "note", "message": {"text": "Possibly dead Python function: count_unique_visitors"}, "properties": {"repobilityId": "a9464a0fd44c09cc", "scanner": "scanner-primary", "fingerprint": "a7bbcc9a671e82e3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:999"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02bce8c5517bf23a", "level": "note", "message": {"text": "Possibly dead Python function: trim_all"}, "properties": {"repobilityId": "258359ca39f84a55", "scanner": "scanner-primary", "fingerprint": "02bce8c5517bf23a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db.py:1031"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95892c68ac7cba7a", "level": "note", "message": {"text": "Possibly dead Python function: build_teardown_email"}, "properties": {"repobilityId": "974adb42a9bbd552", "scanner": "scanner-primary", "fingerprint": "95892c68ac7cba7a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "per_user_alerter.py:198"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8dc2d1120f5e2bc", "level": "note", "message": {"text": "Possibly dead Python function: load_watchers"}, "properties": {"repobilityId": "5da7c39c9da5e37f", "scanner": "scanner-primary", "fingerprint": "b8dc2d1120f5e2bc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_io.py:18"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2fa32304cf48c44c", "level": "note", "message": {"text": "Possibly dead Python function: save_watchers"}, "properties": {"repobilityId": "f3ea3b113e7be01c", "scanner": "scanner-primary", "fingerprint": "2fa32304cf48c44c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_io.py:28"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f0c6252be971a44", "level": "note", "message": {"text": "Possibly dead Python function: heal_gunicorn"}, "properties": {"repobilityId": "1a8e5d6bc733f559", "scanner": "scanner-primary", "fingerprint": "5f0c6252be971a44", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c3aeed6ce6d3d10", "level": "note", "message": {"text": "Possibly dead Python function: heal_web_watcher"}, "properties": {"repobilityId": "f40fcf85ede1c220", "scanner": "scanner-primary", "fingerprint": "7c3aeed6ce6d3d10", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:73"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ff74db4fa662251", "level": "note", "message": {"text": "Possibly dead Python function: heal_apache"}, "properties": {"repobilityId": "7b2a6685440bb716", "scanner": "scanner-primary", "fingerprint": "0ff74db4fa662251", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c5717bead6e2b80", "level": "note", "message": {"text": "Possibly dead Python function: check_gunicorn"}, "properties": {"repobilityId": "ac75c4964da884ce", "scanner": "scanner-primary", "fingerprint": "2c5717bead6e2b80", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:87"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f71b65789e319e67", "level": "note", "message": {"text": "Possibly dead Python function: check_web_watcher"}, "properties": {"repobilityId": "0d1a2f97740bce7e", "scanner": "scanner-primary", "fingerprint": "f71b65789e319e67", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f249f496e7d286a", "level": "note", "message": {"text": "Possibly dead Python function: check_apache"}, "properties": {"repobilityId": "7871d5472c3314d8", "scanner": "scanner-primary", "fingerprint": "0f249f496e7d286a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-651e1818b46e2add", "level": "note", "message": {"text": "Possibly dead Python function: check_disk"}, "properties": {"repobilityId": "67aa3844e377d19d", "scanner": "scanner-primary", "fingerprint": "651e1818b46e2add", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watchdog.py:132"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e95412e36270a7b", "level": "note", "message": {"text": "Possibly dead Python function: best_from_candidates"}, "properties": {"repobilityId": "6b63553e3a3641bc", "scanner": "scanner-primary", "fingerprint": "4e95412e36270a7b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "linkpick.py:143"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db90b84bad0dace6", "level": "note", "message": {"text": "Possibly dead Python function: find_in_html"}, "properties": {"repobilityId": "f80d4bee98ff800b", "scanner": "scanner-primary", "fingerprint": "db90b84bad0dace6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "linkpick.py:312"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81452b7f8efa0298", "level": "note", "message": {"text": "Possibly dead Python function: analyze_drop_announcement"}, "properties": {"repobilityId": "2da587c32b05b42d", "scanner": "scanner-primary", "fingerprint": "81452b7f8efa0298", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/ai_interpreter.py:661"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-acef1e0a85fef699", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in backfill_alerter.py:140"}, "properties": {"repobilityId": "9bc4d1c4485ed475", "scanner": "scanner-primary", "fingerprint": "acef1e0a85fef699", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backfill_alerter.py"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-835e867b31e3ee50", "level": "error", "message": {"text": "Insecure pattern 'chmod_777' in archive/preflight.py:647"}, "properties": {"repobilityId": "e99ba0a105e901d8", "scanner": "scanner-primary", "fingerprint": "835e867b31e3ee50", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "chmod_777"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "archive/preflight.py"}, "region": {"startLine": 647}}}]}, {"ruleId": "scanner-1fcb8b960c661682", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/read-ahead.html:640"}, "properties": {"repobilityId": "0c00a8ca47e3730b", "scanner": "scanner-primary", "fingerprint": "1fcb8b960c661682", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/read-ahead.html"}, "region": {"startLine": 640}}}]}, {"ruleId": "scanner-35430f2787774b48", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in html/read-ahead.html:168"}, "properties": {"repobilityId": "7dda6c844cb14d6e", "scanner": "scanner-primary", "fingerprint": "35430f2787774b48", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/read-ahead.html"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-21bbdf990a1c7e3e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in html/annual.html:826"}, "properties": {"repobilityId": "fa7c182527d52f99", "scanner": "scanner-primary", "fingerprint": "21bbdf990a1c7e3e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/annual.html"}, "region": {"startLine": 826}}}]}, {"ruleId": "scanner-c6338b4f68747591", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/watcher_status.html:302"}, "properties": {"repobilityId": "d14ff142cb85d08a", "scanner": "scanner-primary", "fingerprint": "c6338b4f68747591", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/watcher_status.html"}, "region": {"startLine": 302}}}]}, {"ruleId": "scanner-86276004885e1b3c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/watchlist.html:538"}, "properties": {"repobilityId": "a5af1bc046dfb53c", "scanner": "scanner-primary", "fingerprint": "86276004885e1b3c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/watchlist.html"}, "region": {"startLine": 538}}}]}, {"ruleId": "scanner-2d879328ede07866", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/wall.html:79"}, "properties": {"repobilityId": "53c81a224fbb0d95", "scanner": "scanner-primary", "fingerprint": "2d879328ede07866", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/wall.html"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-e654496173895eee", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/my-alerts.html:187"}, "properties": {"repobilityId": "c77e2d8458b520d8", "scanner": "scanner-primary", "fingerprint": "e654496173895eee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/my-alerts.html"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-0adb8590a03c3321", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in html/mockups/global-watch-mockup.html:206"}, "properties": {"repobilityId": "a0bc95cbd937b3bb", "scanner": "scanner-primary", "fingerprint": "0adb8590a03c3321", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "html/mockups/global-watch-mockup.html"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f1a071e43a531ea4", "level": "note", "message": {"text": "Very large file: watcher_signup.py (1453 lines)"}, "properties": {"repobilityId": "6823560d34f2de21", "scanner": "scanner-primary", "fingerprint": "f1a071e43a531ea4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-58341ecbb1def479", "level": "note", "message": {"text": "Very large file: tests/test_core.py (2991 lines)"}, "properties": {"repobilityId": "d36141da7781bff1", "scanner": "scanner-primary", "fingerprint": "58341ecbb1def479", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "821a0b73e7bb71dd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "397572b1d22a871f", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7779def18076029d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "193faf432e1c4c5f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c9b667390749f6d3", "level": "none", "message": {"text": "Commented-code block (6 lines) in lunar_hunter.py:57"}, "properties": {"repobilityId": "1893a36861a2ac12", "scanner": "scanner-primary", "fingerprint": "c9b667390749f6d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bcc177d2f8d34a5b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 watchdog.py:67"}, "properties": {"repobilityId": "699692ad2c25baeb", "scanner": "scanner-primary", "fingerprint": "bcc177d2f8d34a5b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a7f3371300820d4f", "level": "none", "message": {"text": "Commented-code block (6 lines) in linkpick.py:37"}, "properties": {"repobilityId": "c5a8215718ce01f4", "scanner": "scanner-primary", "fingerprint": "a7f3371300820d4f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-13129d769146ca6b", "level": "note", "message": {"text": "Legacy-named symbol `test_prune_sent_removes_old` in tests/test_core.py:1079"}, "properties": {"repobilityId": "f31b0987e4677635", "scanner": "scanner-primary", "fingerprint": "13129d769146ca6b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-eb0f9280a8941083", "level": "none", "message": {"text": "Commented-code block (7 lines) in agents/ai_interpreter.py:176"}, "properties": {"repobilityId": "9208d56f927c3581", "scanner": "scanner-primary", "fingerprint": "eb0f9280a8941083", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-12a6bb013c385a93", "level": "none", "message": {"text": "Commented-code block (5 lines) in agents/product_extract.py:269"}, "properties": {"repobilityId": "c141c8f1e9a90589", "scanner": "scanner-primary", "fingerprint": "12a6bb013c385a93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cb3d80cc048a392d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6772987502d9518b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "784225d8f944012a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "50e8e5be5e198497", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-f51790517f5ff48d", "level": "error", "message": {"text": "Flask mutation route `watch` without `@login_required` \u2014 watcher_signup.py:360"}, "properties": {"repobilityId": "74c3d28258d69e8b", "scanner": "scanner-primary", "fingerprint": "f51790517f5ff48d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 360}}}]}, {"ruleId": "scanner-ee8f786565a12f36", "level": "error", "message": {"text": "Flask mutation route `keyword_quality` without `@login_required` \u2014 watcher_signup.py:645"}, "properties": {"repobilityId": "7115ed2d53d18146", "scanner": "scanner-primary", "fingerprint": "ee8f786565a12f36", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 645}}}]}, {"ruleId": "scanner-a271dcf9e61d6c4c", "level": "error", "message": {"text": "Flask mutation route `resend_link` without `@login_required` \u2014 watcher_signup.py:671"}, "properties": {"repobilityId": "9def5f14cb4a63cd", "scanner": "scanner-primary", "fingerprint": "a271dcf9e61d6c4c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 671}}}]}, {"ruleId": "scanner-48bcf4c28aac8663", "level": "error", "message": {"text": "Flask mutation route `stop_watching` without `@login_required` \u2014 watcher_signup.py:728"}, "properties": {"repobilityId": "a94f8c879942909a", "scanner": "scanner-primary", "fingerprint": "48bcf4c28aac8663", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 728}}}]}, {"ruleId": "scanner-3385b47ecdd40fb8", "level": "error", "message": {"text": "Flask mutation route `set_watch_maker` without `@login_required` \u2014 watcher_signup.py:745"}, "properties": {"repobilityId": "c4715f7fcf9cddcf", "scanner": "scanner-primary", "fingerprint": "3385b47ecdd40fb8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 745}}}]}, {"ruleId": "scanner-e1cb997d0999470b", "level": "error", "message": {"text": "Flask mutation route `verify_phone` without `@login_required` \u2014 watcher_signup.py:909"}, "properties": {"repobilityId": "285ccb0389a19f13", "scanner": "scanner-primary", "fingerprint": "e1cb997d0999470b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 909}}}]}, {"ruleId": "scanner-08fbc678c84c1795", "level": "error", "message": {"text": "Flask mutation route `track_pageview` without `@login_required` \u2014 watcher_signup.py:935"}, "properties": {"repobilityId": "4fe3de9a2ec67db2", "scanner": "scanner-primary", "fingerprint": "08fbc678c84c1795", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 935}}}]}, {"ruleId": "scanner-8ad880641a1a83b4", "level": "error", "message": {"text": "Flask mutation route `watch_remove` without `@login_required` \u2014 watcher_signup.py:955"}, "properties": {"repobilityId": "73beda00f06dc032", "scanner": "scanner-primary", "fingerprint": "8ad880641a1a83b4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 955}}}]}, {"ruleId": "scanner-6cab99f2953eaec2", "level": "error", "message": {"text": "Flask mutation route `unsubscribe` without `@login_required` \u2014 watcher_signup.py:1032"}, "properties": {"repobilityId": "fd3d19ed608bf483", "scanner": "scanner-primary", "fingerprint": "6cab99f2953eaec2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 1032}}}]}, {"ruleId": "scanner-c70601104ae57a99", "level": "error", "message": {"text": "Flask mutation route `check_url` without `@login_required` \u2014 watcher_signup.py:1150"}, "properties": {"repobilityId": "5e1bf0f60b792c96", "scanner": "scanner-primary", "fingerprint": "c70601104ae57a99", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 1150}}}]}, {"ruleId": "scanner-3dba106eaae82ace", "level": "error", "message": {"text": "Flask mutation route `nkd_submit` without `@login_required` \u2014 watcher_signup.py:1253"}, "properties": {"repobilityId": "b3542f964b7ea02f", "scanner": "scanner-primary", "fingerprint": "3dba106eaae82ace", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 1253}}}]}, {"ruleId": "scanner-ac675db087eaecf3", "level": "error", "message": {"text": "Flask mutation route `feedback` without `@login_required` \u2014 watcher_signup.py:1411"}, "properties": {"repobilityId": "d7f4740fd7d77a89", "scanner": "scanner-primary", "fingerprint": "ac675db087eaecf3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "watcher_signup.py"}, "region": {"startLine": 1411}}}]}, {"ruleId": "scanner-5109d0098e444b13", "level": "note", "message": {"text": "Unused endpoint: ANY /api/watch"}, "properties": {"repobilityId": "72b32d50667777c4", "scanner": "scanner-primary", "fingerprint": "5109d0098e444b13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed378f96ed3e13cc", "level": "note", "message": {"text": "Unused endpoint: ANY /api/keyword-quality"}, "properties": {"repobilityId": "7fc6d4f8b3189d5f", "scanner": "scanner-primary", "fingerprint": "ed378f96ed3e13cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e7cba4a079024ff2", "level": "note", "message": {"text": "Unused endpoint: ANY /api/makers"}, "properties": {"repobilityId": "70107e5c30ed44ee", "scanner": "scanner-primary", "fingerprint": "e7cba4a079024ff2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b42c94f1d413b57f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/resend-link"}, "properties": {"repobilityId": "f78aabbbb7a6a2cd", "scanner": "scanner-primary", "fingerprint": "b42c94f1d413b57f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fa24de488535c0d", "level": "note", "message": {"text": "Unused endpoint: ANY /api/my-watch/<watch_id>"}, "properties": {"repobilityId": "d671fefa34ba5f3a", "scanner": "scanner-primary", "fingerprint": "4fa24de488535c0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d71d00927862a2ae", "level": "note", "message": {"text": "Unused endpoint: ANY /api/watch-maker/<watch_id>"}, "properties": {"repobilityId": "a7fc251264e49062", "scanner": "scanner-primary", "fingerprint": "d71d00927862a2ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-199a203d0a48b7ab", "level": "note", "message": {"text": "Unused endpoint: ANY /api/my-watch/<token>"}, "properties": {"repobilityId": "7a7bf5aaa658b2fc", "scanner": "scanner-primary", "fingerprint": "199a203d0a48b7ab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a97f527df37b16a7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/my-alerts/<token>"}, "properties": {"repobilityId": "b76a103efb8578f0", "scanner": "scanner-primary", "fingerprint": "a97f527df37b16a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-999b7d061ba9a05d", "level": "note", "message": {"text": "Unused endpoint: ANY /api/verify/<token>"}, "properties": {"repobilityId": "65f4b1bcb3341717", "scanner": "scanner-primary", "fingerprint": "999b7d061ba9a05d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d06e5d050c85491", "level": "note", "message": {"text": "Unused endpoint: ANY /api/verify-phone"}, "properties": {"repobilityId": "e041063834eb1cb7", "scanner": "scanner-primary", "fingerprint": "6d06e5d050c85491", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14f52e981382c950", "level": "note", "message": {"text": "Unused endpoint: ANY /api/watch-remove/<watch_id>/<token>"}, "properties": {"repobilityId": "c3f7e3340e2c633d", "scanner": "scanner-primary", "fingerprint": "14f52e981382c950", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1690840295011a86", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ack/<token>"}, "properties": {"repobilityId": "6fc450b5457c83b3", "scanner": "scanner-primary", "fingerprint": "1690840295011a86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32832ceaaa5ac2dc", "level": "note", "message": {"text": "Unused endpoint: ANY /api/unsubscribe/<token>"}, "properties": {"repobilityId": "10ebfa568b4935a9", "scanner": "scanner-primary", "fingerprint": "32832ceaaa5ac2dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec3442aa0b6ba39d", "level": "note", "message": {"text": "Unused endpoint: ANY /api/stats"}, "properties": {"repobilityId": "28cc5ec8661d59b9", "scanner": "scanner-primary", "fingerprint": "ec3442aa0b6ba39d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0821d7bc3ee12715", "level": "note", "message": {"text": "Unused endpoint: ANY /api/check-url"}, "properties": {"repobilityId": "583a47d98a70575b", "scanner": "scanner-primary", "fingerprint": "0821d7bc3ee12715", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60cc32f4f70febcc", "level": "note", "message": {"text": "Unused endpoint: ANY /api/nkd/<token>"}, "properties": {"repobilityId": "7bbf5b3788859a08", "scanner": "scanner-primary", "fingerprint": "60cc32f4f70febcc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8bde1b80f0c42af", "level": "note", "message": {"text": "Unused endpoint: ANY /api/nkd/wall"}, "properties": {"repobilityId": "9367a5a27184a1c2", "scanner": "scanner-primary", "fingerprint": "b8bde1b80f0c42af", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0cf24c469a8d39b8", "level": "note", "message": {"text": "Unused endpoint: ANY /api/feedback"}, "properties": {"repobilityId": "5242f1e1097598de", "scanner": "scanner-primary", "fingerprint": "0cf24c469a8d39b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e892aabe09a0096d", "level": "note", "message": {"text": "Unused endpoint: ANY /go_shankyou/<token>"}, "properties": {"repobilityId": "81dcbfe77eba7cd0", "scanner": "scanner-primary", "fingerprint": "e892aabe09a0096d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81bdfb2cee300334", "level": "note", "message": {"text": "Unused endpoint: ANY /sharp/<token>"}, "properties": {"repobilityId": "44ae1b2afaae6e84", "scanner": "scanner-primary", "fingerprint": "81bdfb2cee300334", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}