Architecture check
SAP-samples/recap2026-latest-and-greatest-cap-features
0 errors, 17 warnings
No critical or high-risk findings. 4 worth a look.
17 warnings in the paths between 13 routes and 14 tables.
Every file was read, but 6 places in them could not be parsed — listed under the findings.
Tables
14
Rules run
19/19
Findings by route
7 of 13 routes flagged · 19/19 rules ran
- Errors
- Warnings
- No findings
17 findings
4 medium13 low
17 findings, each with the route, the table it reaches, the file and line, and the fix. Free with an account.
6 places could not be parsed, so any route or table declared there is missing from this report:
xstravels/srv/travel-service.cds— action deductDiscount — handler body is JavaScript, tables not resolved from CDSxstravels/srv/travel-service.cds— action acceptTravel — handler body is JavaScript, tables not resolved from CDSxstravels/srv/travel-service.cds— action rejectTravel — handler body is JavaScript, tables not resolved from CDSxstravels/srv/travel-service.cds— action reopenTravel — handler body is JavaScript, tables not resolved from CDSxstravels/srv/travel-service.cds— TravelService.Currencies projects Currencies, which is not declared in this projectxstravels/srv/travel-service.cds— TravelService.Flights projects Flights, which is not declared in this project
What this is
Wyro reads the repository’s routes and data models and checks the paths between them: whether a route can reach a table without passing a guard, whether a datastore holding personal data is exposed to a public read, whether an endpoint that issues credentials requires the credentials it issues.
It is rule-based, not a model. The same commit produces the same result every time, and it does not guess at business rules it cannot see. A rule with nothing to look at is reported as not having run — never as a pass.
This check runs on public source through GitHub’s own API and needs no account. A free account adds the findings, the editable architecture canvas, private repositories on paid plans, and a CI gate. No card required.
Maintain this repository? You can have this report removed, and a real vulnerability is disclosed to you privately before it is published. How public reports are handled.