{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-37c66dde9b8a2b1a", "name": "Possibly dead Python function: department_label", "shortDescription": {"text": "Possibly dead Python function: department_label"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e924365dba287317", "name": "Possibly dead Python function: current_user", "shortDescription": {"text": "Possibly dead Python function: current_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08a52e2597115f8b", "name": "Possibly dead Python function: checker", "shortDescription": {"text": "Possibly dead Python function: checker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6df656bf27f99ad3", "name": "Possibly dead Python function: fmt_points", "shortDescription": {"text": "Possibly dead Python function: fmt_points"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3dc5a44c591bb52d", "name": "Possibly dead Python function: fmt_da", "shortDescription": {"text": "Possibly dead Python function: fmt_da"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26a357587ed61205", "name": "Possibly dead Python function: group_key", "shortDescription": {"text": "Possibly dead Python function: group_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe4753f517805620", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1e20b2a6ec77172", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c53cf7c7bea5a123", "name": "Stray `console.log` in TS/JS \u2014 webapp/static/htmx.min.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 webapp/static/htmx.min.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d5705f17499ff526", "name": "Insecure pattern 'eval_used' in classement/engine.py:233", "shortDescription": {"text": "Insecure pattern 'eval_used' in classement/engine.py:233"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6ae4531c9eceb7a", "name": "Insecure pattern 'new_function_used' in webapp/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'new_function_used' in webapp/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0fa53e362310af2a", "name": "Insecure pattern 'direct_innerhtml_assignment' in webapp/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in webapp/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d77effc5dd6ac735", "name": "Insecure pattern 'insert_adjacent_html' in webapp/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in webapp/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749fdfccedc9d208", "name": "Insecure pattern 'domparser_html_parse' in webapp/static/htmx.min.js:1", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in webapp/static/htmx.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 48 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17cface47dd7f9bc", "name": "Agent authority lacks a verifier contract: .claude/commands/campagne.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/campagne.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `SESSION_MAX_AGE`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nclassement/models.py:to_dict, classement/models.py:to_dict, classement/models.py:to_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nwebapp/routes/auth.py:login_form, webapp/routes/auth.py:login\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nwebapp/routes/enseignant.py:editer_activite, webapp/routes/enseignant.py:modifier_activite, webapp/routes/enseignant.py:remplace_justificatif, webapp/routes/enseignant.py:supprime_activite\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b98b5b3cc630d1e5", "name": "FastAPI POST `creer_utilisateur` without auth dependency \u2014 webapp/routes/admin.py:37", "shortDescription": {"text": "FastAPI POST `creer_utilisateur` without auth dependency \u2014 webapp/routes/admin.py:37"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-903d65a981710ac9", "name": "FastAPI POST `importer_utilisateurs` without auth dependency \u2014 webapp/routes/admin.py:61", "shortDescription": {"text": "FastAPI POST `importer_utilisateurs` without auth dependency \u2014 webapp/routes/admin.py:61"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-99c16ca9d0f135d7", "name": "FastAPI POST `basculer_actif` without auth dependency \u2014 webapp/routes/admin.py:77", "shortDescription": {"text": "FastAPI POST `basculer_actif` without auth dependency \u2014 webapp/routes/admin.py:77"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c9fab7a07b8815a", "name": "FastAPI POST `reinitialiser_motdepasse` without auth dependency \u2014 webapp/routes/admin.py:90", "shortDescription": {"text": "FastAPI POST `reinitialiser_motdepasse` without auth dependency \u2014 webapp/routes/admin.py:90"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a3829959c6902553", "name": "FastAPI POST `ajouter_benefice` without auth dependency \u2014 webapp/routes/admin.py:132", "shortDescription": {"text": "FastAPI POST `ajouter_benefice` without auth dependency \u2014 webapp/routes/admin.py:132"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da4dbb698c0cb313", "name": "FastAPI POST `supprimer_benefice` without auth dependency \u2014 webapp/routes/admin.py:155", "shortDescription": {"text": "FastAPI POST `supprimer_benefice` without auth dependency \u2014 webapp/routes/admin.py:155"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec74a40ef2d87ccc", "name": "FastAPI POST `maj_campagne` without auth dependency \u2014 webapp/routes/admin.py:185", "shortDescription": {"text": "FastAPI POST `maj_campagne` without auth dependency \u2014 webapp/routes/admin.py:185"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-96f85b41101d0f60", "name": "FastAPI POST `reouvrir` without auth dependency \u2014 webapp/routes/admin.py:217", "shortDescription": {"text": "FastAPI POST `reouvrir` without auth dependency \u2014 webapp/routes/admin.py:217"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bbfcf48c52e6efa4", "name": "FastAPI POST `decision` without auth dependency \u2014 webapp/routes/commission.py:150", "shortDescription": {"text": "FastAPI POST `decision` without auth dependency \u2014 webapp/routes/commission.py:150"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80a8957c6174fa44", "name": "FastAPI POST `tout_valider` without auth dependency \u2014 webapp/routes/commission.py:187", "shortDescription": {"text": "FastAPI POST `tout_valider` without auth dependency \u2014 webapp/routes/commission.py:187"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f954a952d7a49270", "name": "FastAPI POST `geler` without auth dependency \u2014 webapp/routes/commission.py:321", "shortDescription": {"text": "FastAPI POST `geler` without auth dependency \u2014 webapp/routes/commission.py:321"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f85cff1373e9cdad", "name": "Unused endpoint: GET /justificatifs/{entry_id}", "shortDescription": {"text": "Unused endpoint: GET /justificatifs/{entry_id}"}, "fullDescription": {"text": "`webapp/routes/fichiers.py` declares `GET /justificatifs/{entry_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b42d6564abf79fa4", "name": "Unused endpoint: GET /connexion", "shortDescription": {"text": "Unused endpoint: GET /connexion"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `GET /connexion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-732574abcc760492", "name": "Unused endpoint: POST /connexion", "shortDescription": {"text": "Unused endpoint: POST /connexion"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `POST /connexion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc5a1ca58c618ae4", "name": "Unused endpoint: POST /deconnexion", "shortDescription": {"text": "Unused endpoint: POST /deconnexion"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `POST /deconnexion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-834e58587df22baa", "name": "Unused endpoint: GET /mon-mot-de-passe", "shortDescription": {"text": "Unused endpoint: GET /mon-mot-de-passe"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `GET /mon-mot-de-passe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c493b15f3bf656f", "name": "Unused endpoint: POST /mon-mot-de-passe", "shortDescription": {"text": "Unused endpoint: POST /mon-mot-de-passe"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `POST /mon-mot-de-passe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-beea8a2ad07d1c3f", "name": "Unused endpoint: GET /sante", "shortDescription": {"text": "Unused endpoint: GET /sante"}, "fullDescription": {"text": "`webapp/routes/auth.py` declares `GET /sante` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd75453722fdc7b0", "name": "Unused endpoint: GET /utilisateurs", "shortDescription": {"text": "Unused endpoint: GET /utilisateurs"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `GET /utilisateurs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b7a6129bad90e6e", "name": "Unused endpoint: POST /utilisateurs", "shortDescription": {"text": "Unused endpoint: POST /utilisateurs"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /utilisateurs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75cbf757d54d6e2b", "name": "Unused endpoint: POST /utilisateurs/import", "shortDescription": {"text": "Unused endpoint: POST /utilisateurs/import"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /utilisateurs/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd94fa00c741cd96", "name": "Unused endpoint: POST /utilisateurs/{user_id}/basculer-actif", "shortDescription": {"text": "Unused endpoint: POST /utilisateurs/{user_id}/basculer-actif"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /utilisateurs/{user_id}/basculer-actif` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d3cdf735d8f09b9", "name": "Unused endpoint: POST /utilisateurs/{user_id}/motdepasse", "shortDescription": {"text": "Unused endpoint: POST /utilisateurs/{user_id}/motdepasse"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /utilisateurs/{user_id}/motdepasse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9338a30fe35ba84a", "name": "Unused endpoint: GET /benefices", "shortDescription": {"text": "Unused endpoint: GET /benefices"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `GET /benefices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65bce7e55c2614f0", "name": "Unused endpoint: POST /benefices", "shortDescription": {"text": "Unused endpoint: POST /benefices"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /benefices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d9245a69522554f", "name": "Unused endpoint: POST /benefices/{benefit_id}/supprimer", "shortDescription": {"text": "Unused endpoint: POST /benefices/{benefit_id}/supprimer"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /benefices/{benefit_id}/supprimer` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe7f43fe405cd20a", "name": "Unused endpoint: GET /campagne", "shortDescription": {"text": "Unused endpoint: GET /campagne"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `GET /campagne` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41cf7f17bc39afc5", "name": "Unused endpoint: POST /campagne", "shortDescription": {"text": "Unused endpoint: POST /campagne"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /campagne` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c696efe9ae2cfb7d", "name": "Unused endpoint: POST /dossiers/{dossier_id}/reouvrir", "shortDescription": {"text": "Unused endpoint: POST /dossiers/{dossier_id}/reouvrir"}, "fullDescription": {"text": "`webapp/routes/admin.py` declares `POST /dossiers/{dossier_id}/reouvrir` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c2fd46939004ed7", "name": "Unused endpoint: GET /score", "shortDescription": {"text": "Unused endpoint: GET /score"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `GET /score` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d655a3444a7f8328", "name": "Unused endpoint: POST /entrees/{criterion_id}", "shortDescription": {"text": "Unused endpoint: POST /entrees/{criterion_id}"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `POST /entrees/{criterion_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfe7e2b224df4537", "name": "Unused endpoint: POST /activites", "shortDescription": {"text": "Unused endpoint: POST /activites"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `POST /activites` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a705261337970ca", "name": "Unused endpoint: GET /section/{criterion_id}", "shortDescription": {"text": "Unused endpoint: GET /section/{criterion_id}"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `GET /section/{criterion_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61528911b828caf1", "name": "Unused endpoint: GET /activites/{entry_id}/edition", "shortDescription": {"text": "Unused endpoint: GET /activites/{entry_id}/edition"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `GET /activites/{entry_id}/edition` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e09f7d499f63cba2", "name": "Unused endpoint: POST /activites/{entry_id}/modifier", "shortDescription": {"text": "Unused endpoint: POST /activites/{entry_id}/modifier"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `POST /activites/{entry_id}/modifier` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a3bfca75cd306b", "name": "Unused endpoint: POST /activites/{entry_id}/justificatif", "shortDescription": {"text": "Unused endpoint: POST /activites/{entry_id}/justificatif"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `POST /activites/{entry_id}/justificatif` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c83d6ae7020a154c", "name": "Unused endpoint: DELETE /activites/{entry_id}", "shortDescription": {"text": "Unused endpoint: DELETE /activites/{entry_id}"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `DELETE /activites/{entry_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d8d88a2e3994853", "name": "Unused endpoint: POST /soumettre", "shortDescription": {"text": "Unused endpoint: POST /soumettre"}, "fullDescription": {"text": "`webapp/routes/enseignant.py` declares `POST /soumettre` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f834101ef7a7b0f3", "name": "Unused endpoint: GET /dossiers", "shortDescription": {"text": "Unused endpoint: GET /dossiers"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `GET /dossiers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-471fb80150261bc1", "name": "Unused endpoint: GET /dossiers/{dossier_id}", "shortDescription": {"text": "Unused endpoint: GET /dossiers/{dossier_id}"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `GET /dossiers/{dossier_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f07416d46da8ac3d", "name": "Unused endpoint: GET /dossiers/{dossier_id}/score", "shortDescription": {"text": "Unused endpoint: GET /dossiers/{dossier_id}/score"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `GET /dossiers/{dossier_id}/score` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddf92c398d9cacfa", "name": "Unused endpoint: POST /entrees/{entry_id}/decision", "shortDescription": {"text": "Unused endpoint: POST /entrees/{entry_id}/decision"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `POST /entrees/{entry_id}/decision` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80b97c2b7886e56b", "name": "Unused endpoint: POST /dossiers/{dossier_id}/tout-valider", "shortDescription": {"text": "Unused endpoint: POST /dossiers/{dossier_id}/tout-valider"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `POST /dossiers/{dossier_id}/tout-valider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2e668c353542b1b", "name": "Unused endpoint: GET /classement", "shortDescription": {"text": "Unused endpoint: GET /classement"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `GET /classement` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ecb33d7ed7cb7bb", "name": "Unused endpoint: GET /budget", "shortDescription": {"text": "Unused endpoint: GET /budget"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `GET /budget` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee246cd4555d2d38", "name": "Unused endpoint: POST /classement/geler", "shortDescription": {"text": "Unused endpoint: POST /classement/geler"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `POST /classement/geler` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcb4d5cf9221d094", "name": "Unused endpoint: GET /exports/{kind}", "shortDescription": {"text": "Unused endpoint: GET /exports/{kind}"}, "fullDescription": {"text": "`webapp/routes/commission.py` declares `GET /exports/{kind}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18862"}, "properties": {"repository": "SamRepository/classement-stages", "repoUrl": "https://github.com/SamRepository/classement-stages", "branch": "main"}, "results": [{"ruleId": "scanner-37c66dde9b8a2b1a", "level": "note", "message": {"text": "Possibly dead Python function: department_label"}, "properties": {"repobilityId": "5d1f6f916504ce99", "scanner": "scanner-primary", "fingerprint": "37c66dde9b8a2b1a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "classement/institutions.py:36"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e924365dba287317", "level": "note", "message": {"text": "Possibly dead Python function: current_user"}, "properties": {"repobilityId": "271089411e6e6afb", "scanner": "scanner-primary", "fingerprint": "e924365dba287317", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/auth.py:19"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08a52e2597115f8b", "level": "note", "message": {"text": "Possibly dead Python function: checker"}, "properties": {"repobilityId": "867db4ed14366803", "scanner": "scanner-primary", "fingerprint": "08a52e2597115f8b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/auth.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6df656bf27f99ad3", "level": "note", "message": {"text": "Possibly dead Python function: fmt_points"}, "properties": {"repobilityId": "bd32b1888d865560", "scanner": "scanner-primary", "fingerprint": "6df656bf27f99ad3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/templating.py:32"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3dc5a44c591bb52d", "level": "note", "message": {"text": "Possibly dead Python function: fmt_da"}, "properties": {"repobilityId": "a8cd10e7bd89b4ec", "scanner": "scanner-primary", "fingerprint": "3dc5a44c591bb52d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/templating.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26a357587ed61205", "level": "note", "message": {"text": "Possibly dead Python function: group_key"}, "properties": {"repobilityId": "9d2f53863b6248ea", "scanner": "scanner-primary", "fingerprint": "26a357587ed61205", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/services/scoring.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe4753f517805620", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "fe4753f517805620", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/alembic/versions/2c2c05599f46_schema_initial.py:18"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1e20b2a6ec77172", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "c1e20b2a6ec77172", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/alembic/versions/2c2c05599f46_schema_initial.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c53cf7c7bea5a123", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 webapp/static/htmx.min.js:1"}, "properties": {"repobilityId": "5678ed4e92ed8eb4", "scanner": "scanner-primary", "fingerprint": "c53cf7c7bea5a123", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "543a2d6506977750", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d5705f17499ff526", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in classement/engine.py:233"}, "properties": {"repobilityId": "6b846219970cea0b", "scanner": "scanner-primary", "fingerprint": "d5705f17499ff526", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "classement/engine.py"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-b6ae4531c9eceb7a", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in webapp/static/htmx.min.js:1"}, "properties": {"repobilityId": "468b1c79c19b06c9", "scanner": "scanner-primary", "fingerprint": "b6ae4531c9eceb7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fa53e362310af2a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in webapp/static/htmx.min.js:1"}, "properties": {"repobilityId": "c6edadc75ee69d5e", "scanner": "scanner-primary", "fingerprint": "0fa53e362310af2a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d77effc5dd6ac735", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in webapp/static/htmx.min.js:1"}, "properties": {"repobilityId": "c8811302094d9008", "scanner": "scanner-primary", "fingerprint": "d77effc5dd6ac735", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-749fdfccedc9d208", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in webapp/static/htmx.min.js:1"}, "properties": {"repobilityId": "f3c829f5273dfd51", "scanner": "scanner-primary", "fingerprint": "749fdfccedc9d208", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/static/htmx.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6e8466205f6d6892", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f1fcaa0104914821", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "68aa53b8673b0e89", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b782b1e34852eee0", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17cface47dd7f9bc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/campagne.md"}, "properties": {"repobilityId": "d889f9d3e5a28b2e", "scanner": "scanner-primary", "fingerprint": "17cface47dd7f9bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/campagne.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "86598d8125937160", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "edfae56f0bd492e4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "16a00dec3ce8527e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e32d521aabac706b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "9168768004da7f86", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3dcc5226e00033ba", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "dc3303760725288b", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3ee06cb7496b4f11", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-b98b5b3cc630d1e5", "level": "error", "message": {"text": "FastAPI POST `creer_utilisateur` without auth dependency \u2014 webapp/routes/admin.py:37"}, "properties": {"repobilityId": "b0f293a77a1ad788", "scanner": "scanner-primary", "fingerprint": "b98b5b3cc630d1e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-903d65a981710ac9", "level": "error", "message": {"text": "FastAPI POST `importer_utilisateurs` without auth dependency \u2014 webapp/routes/admin.py:61"}, "properties": {"repobilityId": "a7f9b8ea7b8adac2", "scanner": "scanner-primary", "fingerprint": "903d65a981710ac9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-99c16ca9d0f135d7", "level": "error", "message": {"text": "FastAPI POST `basculer_actif` without auth dependency \u2014 webapp/routes/admin.py:77"}, "properties": {"repobilityId": "4dc904b95438c2ef", "scanner": "scanner-primary", "fingerprint": "99c16ca9d0f135d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-6c9fab7a07b8815a", "level": "error", "message": {"text": "FastAPI POST `reinitialiser_motdepasse` without auth dependency \u2014 webapp/routes/admin.py:90"}, "properties": {"repobilityId": "1806fe05f9c6598c", "scanner": "scanner-primary", "fingerprint": "6c9fab7a07b8815a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-a3829959c6902553", "level": "error", "message": {"text": "FastAPI POST `ajouter_benefice` without auth dependency \u2014 webapp/routes/admin.py:132"}, "properties": {"repobilityId": "b30e493abfff02f1", "scanner": "scanner-primary", "fingerprint": "a3829959c6902553", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-da4dbb698c0cb313", "level": "error", "message": {"text": "FastAPI POST `supprimer_benefice` without auth dependency \u2014 webapp/routes/admin.py:155"}, "properties": {"repobilityId": "97140e6665949c1b", "scanner": "scanner-primary", "fingerprint": "da4dbb698c0cb313", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-ec74a40ef2d87ccc", "level": "error", "message": {"text": "FastAPI POST `maj_campagne` without auth dependency \u2014 webapp/routes/admin.py:185"}, "properties": {"repobilityId": "b5f7c87b1292df06", "scanner": "scanner-primary", "fingerprint": "ec74a40ef2d87ccc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-96f85b41101d0f60", "level": "error", "message": {"text": "FastAPI POST `reouvrir` without auth dependency \u2014 webapp/routes/admin.py:217"}, "properties": {"repobilityId": "a6357153d8293007", "scanner": "scanner-primary", "fingerprint": "96f85b41101d0f60", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/admin.py"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-bbfcf48c52e6efa4", "level": "error", "message": {"text": "FastAPI POST `decision` without auth dependency \u2014 webapp/routes/commission.py:150"}, "properties": {"repobilityId": "2d8552d349405e65", "scanner": "scanner-primary", "fingerprint": "bbfcf48c52e6efa4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/commission.py"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-80a8957c6174fa44", "level": "error", "message": {"text": "FastAPI POST `tout_valider` without auth dependency \u2014 webapp/routes/commission.py:187"}, "properties": {"repobilityId": "278897f96b42a56e", "scanner": "scanner-primary", "fingerprint": "80a8957c6174fa44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/commission.py"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-f954a952d7a49270", "level": "error", "message": {"text": "FastAPI POST `geler` without auth dependency \u2014 webapp/routes/commission.py:321"}, "properties": {"repobilityId": "b876b8bb21c7c555", "scanner": "scanner-primary", "fingerprint": "f954a952d7a49270", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webapp/routes/commission.py"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-f85cff1373e9cdad", "level": "note", "message": {"text": "Unused endpoint: GET /justificatifs/{entry_id}"}, "properties": {"repobilityId": "170e35a225804d73", "scanner": "scanner-primary", "fingerprint": "f85cff1373e9cdad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "5644c79969b3e6f4", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b42d6564abf79fa4", "level": "note", "message": {"text": "Unused endpoint: GET /connexion"}, "properties": {"repobilityId": "1ae51fde4bc1debf", "scanner": "scanner-primary", "fingerprint": "b42d6564abf79fa4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-732574abcc760492", "level": "note", "message": {"text": "Unused endpoint: POST /connexion"}, "properties": {"repobilityId": "30bbf74f712c2aaa", "scanner": "scanner-primary", "fingerprint": "732574abcc760492", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc5a1ca58c618ae4", "level": "note", "message": {"text": "Unused endpoint: POST /deconnexion"}, "properties": {"repobilityId": "22bddef32ee52c0a", "scanner": "scanner-primary", "fingerprint": "cc5a1ca58c618ae4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-834e58587df22baa", "level": "note", "message": {"text": "Unused endpoint: GET /mon-mot-de-passe"}, "properties": {"repobilityId": "343bb459c606dd89", "scanner": "scanner-primary", "fingerprint": "834e58587df22baa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c493b15f3bf656f", "level": "note", "message": {"text": "Unused endpoint: POST /mon-mot-de-passe"}, "properties": {"repobilityId": "beba5b6dd6959268", "scanner": "scanner-primary", "fingerprint": "7c493b15f3bf656f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-beea8a2ad07d1c3f", "level": "note", "message": {"text": "Unused endpoint: GET /sante"}, "properties": {"repobilityId": "3c876a12c2e3bc79", "scanner": "scanner-primary", "fingerprint": "beea8a2ad07d1c3f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd75453722fdc7b0", "level": "note", "message": {"text": "Unused endpoint: GET /utilisateurs"}, "properties": {"repobilityId": "7e75785991c35643", "scanner": "scanner-primary", "fingerprint": "bd75453722fdc7b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b7a6129bad90e6e", "level": "note", "message": {"text": "Unused endpoint: POST /utilisateurs"}, "properties": {"repobilityId": "7c0148025f43c00a", "scanner": "scanner-primary", "fingerprint": "2b7a6129bad90e6e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-75cbf757d54d6e2b", "level": "note", "message": {"text": "Unused endpoint: POST /utilisateurs/import"}, "properties": {"repobilityId": "c479e66ab679450e", "scanner": "scanner-primary", "fingerprint": "75cbf757d54d6e2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd94fa00c741cd96", "level": "note", "message": {"text": "Unused endpoint: POST /utilisateurs/{user_id}/basculer-actif"}, "properties": {"repobilityId": "a7712c5bd3fea0db", "scanner": "scanner-primary", "fingerprint": "bd94fa00c741cd96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7d3cdf735d8f09b9", "level": "note", "message": {"text": "Unused endpoint: POST /utilisateurs/{user_id}/motdepasse"}, "properties": {"repobilityId": "b3c9724cde7abfa3", "scanner": "scanner-primary", "fingerprint": "7d3cdf735d8f09b9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9338a30fe35ba84a", "level": "note", "message": {"text": "Unused endpoint: GET /benefices"}, "properties": {"repobilityId": "856b45fd150727b0", "scanner": "scanner-primary", "fingerprint": "9338a30fe35ba84a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65bce7e55c2614f0", "level": "note", "message": {"text": "Unused endpoint: POST /benefices"}, "properties": {"repobilityId": "15b5fe975fec1329", "scanner": "scanner-primary", "fingerprint": "65bce7e55c2614f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d9245a69522554f", "level": "note", "message": {"text": "Unused endpoint: POST /benefices/{benefit_id}/supprimer"}, "properties": {"repobilityId": "5c14cd122f61077b", "scanner": "scanner-primary", "fingerprint": "0d9245a69522554f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fe7f43fe405cd20a", "level": "note", "message": {"text": "Unused endpoint: GET /campagne"}, "properties": {"repobilityId": "82c2d25c7f04117d", "scanner": "scanner-primary", "fingerprint": "fe7f43fe405cd20a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41cf7f17bc39afc5", "level": "note", "message": {"text": "Unused endpoint: POST /campagne"}, "properties": {"repobilityId": "5c7e4325475eab6f", "scanner": "scanner-primary", "fingerprint": "41cf7f17bc39afc5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c696efe9ae2cfb7d", "level": "note", "message": {"text": "Unused endpoint: POST /dossiers/{dossier_id}/reouvrir"}, "properties": {"repobilityId": "7e12d88321bb352a", "scanner": "scanner-primary", "fingerprint": "c696efe9ae2cfb7d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3c2fd46939004ed7", "level": "note", "message": {"text": "Unused endpoint: GET /score"}, "properties": {"repobilityId": "e34281619a81881d", "scanner": "scanner-primary", "fingerprint": "3c2fd46939004ed7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d655a3444a7f8328", "level": "note", "message": {"text": "Unused endpoint: POST /entrees/{criterion_id}"}, "properties": {"repobilityId": "3eb76ba0d7244315", "scanner": "scanner-primary", "fingerprint": "d655a3444a7f8328", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfe7e2b224df4537", "level": "note", "message": {"text": "Unused endpoint: POST /activites"}, "properties": {"repobilityId": "9cbcc3f6a8c3f29c", "scanner": "scanner-primary", "fingerprint": "bfe7e2b224df4537", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0a705261337970ca", "level": "note", "message": {"text": "Unused endpoint: GET /section/{criterion_id}"}, "properties": {"repobilityId": "78c34cbe452435a3", "scanner": "scanner-primary", "fingerprint": "0a705261337970ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61528911b828caf1", "level": "note", "message": {"text": "Unused endpoint: GET /activites/{entry_id}/edition"}, "properties": {"repobilityId": "620df05df7400fb6", "scanner": "scanner-primary", "fingerprint": "61528911b828caf1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e09f7d499f63cba2", "level": "note", "message": {"text": "Unused endpoint: POST /activites/{entry_id}/modifier"}, "properties": {"repobilityId": "876c5b7ec81038eb", "scanner": "scanner-primary", "fingerprint": "e09f7d499f63cba2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-33a3bfca75cd306b", "level": "note", "message": {"text": "Unused endpoint: POST /activites/{entry_id}/justificatif"}, "properties": {"repobilityId": "c0ed17bc7d6e81b8", "scanner": "scanner-primary", "fingerprint": "33a3bfca75cd306b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c83d6ae7020a154c", "level": "note", "message": {"text": "Unused endpoint: DELETE /activites/{entry_id}"}, "properties": {"repobilityId": "60f33066d11442bd", "scanner": "scanner-primary", "fingerprint": "c83d6ae7020a154c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d8d88a2e3994853", "level": "note", "message": {"text": "Unused endpoint: POST /soumettre"}, "properties": {"repobilityId": "78f50663998dae50", "scanner": "scanner-primary", "fingerprint": "5d8d88a2e3994853", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f834101ef7a7b0f3", "level": "note", "message": {"text": "Unused endpoint: GET /dossiers"}, "properties": {"repobilityId": "e12c4445961ddadb", "scanner": "scanner-primary", "fingerprint": "f834101ef7a7b0f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-471fb80150261bc1", "level": "note", "message": {"text": "Unused endpoint: GET /dossiers/{dossier_id}"}, "properties": {"repobilityId": "23754e6035d125f0", "scanner": "scanner-primary", "fingerprint": "471fb80150261bc1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f07416d46da8ac3d", "level": "note", "message": {"text": "Unused endpoint: GET /dossiers/{dossier_id}/score"}, "properties": {"repobilityId": "93a4518eebad2a1b", "scanner": "scanner-primary", "fingerprint": "f07416d46da8ac3d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ddf92c398d9cacfa", "level": "note", "message": {"text": "Unused endpoint: POST /entrees/{entry_id}/decision"}, "properties": {"repobilityId": "2ae08f87a7ed9543", "scanner": "scanner-primary", "fingerprint": "ddf92c398d9cacfa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-80b97c2b7886e56b", "level": "note", "message": {"text": "Unused endpoint: POST /dossiers/{dossier_id}/tout-valider"}, "properties": {"repobilityId": "3206e6cb6644b3ac", "scanner": "scanner-primary", "fingerprint": "80b97c2b7886e56b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a2e668c353542b1b", "level": "note", "message": {"text": "Unused endpoint: GET /classement"}, "properties": {"repobilityId": "e0a90b9796c7c77c", "scanner": "scanner-primary", "fingerprint": "a2e668c353542b1b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ecb33d7ed7cb7bb", "level": "note", "message": {"text": "Unused endpoint: GET /budget"}, "properties": {"repobilityId": "988103ce5bfb93f1", "scanner": "scanner-primary", "fingerprint": "3ecb33d7ed7cb7bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee246cd4555d2d38", "level": "note", "message": {"text": "Unused endpoint: POST /classement/geler"}, "properties": {"repobilityId": "0cb171ea63297b3d", "scanner": "scanner-primary", "fingerprint": "ee246cd4555d2d38", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dcb4d5cf9221d094", "level": "note", "message": {"text": "Unused endpoint: GET /exports/{kind}"}, "properties": {"repobilityId": "eb81e085f369357f", "scanner": "scanner-primary", "fingerprint": "dcb4d5cf9221d094", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}