UNIFIED
Repobility · multi-layer engine · AI coders
Complete repo analysis
Last scanned 1 week ago
·
v4
·
100 findings from
2 sources.
Findings combine the legacy security pipeline AND the multi-layer engine
(atlas, wiring, flows, ranked) AND verified AI agent contributions.
{# ── 2026-05-17 R27 #5: score breakdown panel ──────────────────────
Surfaces the score_breakdown JSON that's been silently stored on
Repository for months. Turns hidden math into a trust signal. #}
Score breakdown
â 2026-05-17-v4
calibration-aware
| Component |
Sub-score |
Weight |
Contribution |
structure_score |
85.0
|
0.15 |
12.75 |
security_score |
80.4
|
0.25 |
20.10 |
testing_score |
36.0
|
0.20 |
7.20 |
documentation_score |
86.0
|
0.15 |
12.90 |
practices_score |
65.0
|
0.15 |
9.75 |
code_quality |
70.0
|
0.10 |
7.00 |
| Overall |
|
1.00 |
69.7 |
Calibrated penalty buckets (security_score):
threat: 19.6
security_score may be inflated — optional scanners skipped due to repo size/fast scan
Severity distribution — click a segment to filter
Top 10 actions, ranked by impact × ease.
Severity drives impact; tag-based fix-clarity drives ease.
#1
Possible secret in crates/jcode-protocol/src/lib.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-protocol/src/lib.rs:1185; move to env var / secrets manager.
crates/jcode-protocol/src/lib.rs:1185
#2
Possible secret in crates/jcode-desktop/src/session_launch.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-desktop/src/session_launch.rs:1391; move to env var / secrets manager.
crates/jcode-desktop/src/session_launch.rs:1391
#3
Possible secret in crates/jcode-desktop/src/session_launch.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-desktop/src/session_launch.rs:1397; move to env var / secrets manager.
crates/jcode-desktop/src/session_launch.rs:1397
#4
Possible secret in crates/jcode-desktop/src/main_tests.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-desktop/src/main_tests.rs:1239; move to env var / secrets manager.
crates/jcode-desktop/src/main_tests.rs:1239
#5
Possible secret in crates/jcode-desktop/src/main_tests.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-desktop/src/main_tests.rs:1247; move to env var / secrets manager.
crates/jcode-desktop/src/main_tests.rs:1247
#6
Possible secret in crates/jcode-desktop/src/main_tests.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-desktop/src/main_tests.rs:1257; move to env var / secrets manager.
crates/jcode-desktop/src/main_tests.rs:1257
#7
Possible secret in crates/jcode-desktop/src/main_tests.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in crates/jcode-desktop/src/main_tests.rs:1324; move to env var / secrets manager.
crates/jcode-desktop/src/main_tests.rs:1324
#8
Possible secret in src/message/tests.rs
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in src/message/tests.rs:201; move to env var / secrets manager.
src/message/tests.rs:201
#9
`fetch()` without try/.catch or AbortSignal — telemetry-worker/src/worker.js:6
GapSeverity.MEDIUM
Layer.QUALITY
score 0.225
Why: medium severity · crashes are likely without this
Fix: Wrap the `fetch(...)` in `try { ... } catch` in telemetry-worker/src/worker.js:6, OR pass `{ signal: AbortSignal.timeout(N) }` so the call cancels deterministically.
#10
Network/subprocess call without timeout or try/except — scripts/run_terminal_bench_campaign.py:21
GapSeverity.MEDIUM
Layer.QUALITY
score 0.225
Why: medium severity · crashes are likely without this
Fix: Add a `timeout=N` argument and wrap in `try/except` in scripts/run_terminal_bench_campaign.py:21 to prevent hung calls.
Click "Find this gap" on any action above to jump to it on the Findings tab.
Adjust the chip bar to filter by impact (severity), layer, or source.
{# ── 2026-05-17 Round 14: AI-agent bridge footer ──────────────────────
Discoverability: the /agents/voting/ guide + MCP manifest exist but
aren't linked from anywhere users actually land. Small, opt-in footer. #}