← Back to scan
File as GitHub Issue repo: appwrite/appwrite

Push this scan report to appwrite/appwrite

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Compose service mounts the Docker socket

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT SEC009 [SEC009] .env File Committed: .env file with secrets committed to repository. .env
CRIT DKC008 Compose service mounts the Docker socket tests/resources/docker/docker-compose.y…:214
CRIT DKC008 Compose service mounts the Docker socket tests/resources/docker/docker-compose.y…:354
CRIT DKC008 Compose service mounts the Docker socket tests/resources/docker/docker-compose.y…:1
CRIT DKC008 Compose service mounts the Docker socket docker-compose.yml:977
CRIT DKC008 Compose service mounts the Docker socket docker-compose.yml:1228
CRIT DKC008 Compose service mounts the Docker socket docker-compose.yml:13
CRIT DKC007 Compose service contains a literal secret environment value docker-compose.yml:1152
CRIT MINED123 [MINED123] Trojan Source bidi character (RLM) in source: Line 54 contains a Unicode bidir… app/config/locale/currencies.php:54
CRIT CORE_ENV_FILE .env file committed to repository .env
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). src/Appwrite/Platform/Modules/Proxy/Htt…:98
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). src/Appwrite/Platform/Modules/Proxy/Htt…:93
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). src/Appwrite/Platform/Modules/Proxy/Htt…:81
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… public/sdk-console/services/locale.ts:30
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… public/sdk-console/services/functions.ts:39
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… public/sdk-console/services/databases.ts:43
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` r… .github/workflows/tests.yml:195
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:192
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` r… .github/workflows/tests.yml:125
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:122
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` r… .github/workflows/tests.yml:89
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:86
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` r… .github/workflows/tests.yml:74
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:51
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:29
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/linter.yml:15
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/static-analysis.yml:11
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/cleanup-cache.yml:13
HIGH MINED115 [MINED115] Action `github/ai-moderator` pinned to mutable ref `@v1`: `uses: github/ai-mod… .github/workflows/ai-moderator.yml:30
HIGH MINED115 [MINED115] Action `github/codeql-action/analyze` pinned to mutable ref `@v2`: `uses: gith… .github/workflows/codeql-analysis.yml:71
HIGH MINED115 [MINED115] Action `github/codeql-action/autobuild` pinned to mutable ref `@v2`: `uses: gi… .github/workflows/codeql-analysis.yml:57
HIGH MINED115 [MINED115] Action `github/codeql-action/init` pinned to mutable ref `@v2`: `uses: github/… .github/workflows/codeql-analysis.yml:50
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/codeql-analysis.yml:37
HIGH MINED115 [MINED115] Action `peter-evans/create-or-update-comment` pinned to mutable ref `@v3`: `us… .github/workflows/pr-scan.yml:100
HIGH MINED115 [MINED115] Action `peter-evans/find-comment` pinned to mutable ref `@v3`: `uses: peter-ev… .github/workflows/pr-scan.yml:92
HIGH MINED115 [MINED115] Action `actions/github-script` pinned to mutable ref `@v7`: `uses: actions/git… .github/workflows/pr-scan.yml:47
HIGH MINED115 [MINED115] Action `aquasecurity/trivy-action` pinned to mutable ref `@0.20.0`: `uses: aqu… .github/workflows/pr-scan.yml:37
HIGH MINED115 [MINED115] Action `aquasecurity/trivy-action` pinned to mutable ref `@0.20.0`: `uses: aqu… .github/workflows/pr-scan.yml:29
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/pr-scan.yml:14
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/sdk-preview.yml:44
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/sdk-preview.yml:22
HIGH MINED118 [MINED118] Dockerfile FROM `appwrite/base:0.10.6` not pinned by digest: `FROM appwrite/ba… Dockerfile:14
HIGH MINED118 [MINED118] Dockerfile FROM `composer:2.0` not pinned by digest: `FROM composer:2.0` resol… Dockerfile:1
HIGH DKC011 Database service publishes a host port tests/resources/docker/docker-compose.y…:306
HIGH DKC011 Database service publishes a host port docker-compose.yml:1185
HIGH DKC011 Database service publishes a host port docker-compose.yml:1069
HIGH DKC011 Database service publishes a host port docker-compose.yml:1051
HIGH CORE_NO_TESTS No test files found —
MED SEC134 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum… src/Appwrite/Utopia/Response/Model/Log.…:35
MED SEC134 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum… src/Appwrite/Utopia/Response/Model/Iden…:53
MED SEC134 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum… src/Appwrite/Utopia/Response/Model/Docu…:110
MED DKR003 Compose service `redis-insight` image uses the latest tag docker-compose.yml:1185
MED DKR002 Compose service `maildev` image has no explicit tag tests/resources/docker/docker-compose.y…:324
MED DKR002 Compose service `adminer` image has no explicit tag docker-compose.yml:1152
MED DKR002 Compose service `appwrite-task-scheduler-messages` image has no explicit tag docker-compose.yml:935
MED DKR002 Compose service `appwrite-task-scheduler-executions` image has no explicit tag docker-compose.yml:908
MED DKR002 Compose service `appwrite-task-scheduler-functions` image has no explicit tag docker-compose.yml:880
MED DKR002 Compose service `appwrite-worker-stats-usage` image has no explicit tag docker-compose.yml:849
MED DKR002 Compose service `appwrite-worker-stats-resources` image has no explicit tag docker-compose.yml:818
MED DKR002 Compose service `appwrite-task-stats-resources` image has no explicit tag docker-compose.yml:787
MED DKR002 Compose service `appwrite-task-maintenance` image has no explicit tag docker-compose.yml:744
MED DKR002 Compose service `appwrite-worker-migrations` image has no explicit tag docker-compose.yml:702
MED DKR002 Compose service `appwrite-worker-messaging` image has no explicit tag docker-compose.yml:647
MED DKR002 Compose service `appwrite-worker-mails` image has no explicit tag docker-compose.yml:613
MED DKR002 Compose service `appwrite-worker-functions` image has no explicit tag docker-compose.yml:570
MED DKR002 Compose service `appwrite-worker-certificates` image has no explicit tag docker-compose.yml:531
MED DKR002 Compose service `appwrite-worker-builds` image has no explicit tag docker-compose.yml:457
MED DKR002 Compose service `appwrite-worker-databases` image has no explicit tag docker-compose.yml:426
MED DKR002 Compose service `appwrite-worker-deletes` image has no explicit tag docker-compose.yml:363
MED DKR002 Compose service `appwrite-worker-webhooks` image has no explicit tag docker-compose.yml:330
MED DKR002 Compose service `appwrite-worker-audits` image has no explicit tag docker-compose.yml:301
MED DKR002 Compose service `appwrite-realtime` image has no explicit tag docker-compose.yml:251
MED DKR002 Compose service `appwrite` image has no explicit tag docker-compose.yml:1228
MED DKC015 Database service has no healthcheck tests/resources/docker/docker-compose.y…:306
MED DKC015 Database service has no healthcheck docker-compose.yml:1051
MED DKR015 Docker build context is very large .dockerignore
MED DKR001 Docker final stage has no non-root USER Dockerfile:105
MED DKC013 Database service has no persistent data volume docker-compose.yml:1185
MED DKC007 Compose service contains a literal secret environment value tests/resources/docker/docker-compose.y…:306
MED CORE_LARGE_FILES Average file size is 742 lines (recommend <300) —
LOW AIC003 Duplicated implementation block across source files public/sdk-web/services/functions.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/services/databases.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/services/avatars.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/service.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/role.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/query.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/permission.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/models.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/index.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-web/client.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/teams.ts:12
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/teams.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/storage.ts:15
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/storage.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/locale.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/functions.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/databases.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/services/avatars.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/service.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/role.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/query.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/permission.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/models.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/index.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-project/client.ts:1
LOW AIC003 Duplicated implementation block across source files public/sdk-console/services/teams.ts:12
LOW AIC003 Duplicated implementation block across source files public/sdk-console/services/storage.ts:15
LOW AIC003 Duplicated implementation block across source files app/worker.php:416
LOW AIC003 Duplicated implementation block across source files app/worker.php:85
LOW AIC003 Duplicated implementation block across source files app/realtime.php:85
LOW DKC015 Database service has no healthcheck tests/resources/docker/docker-compose.y…:343
LOW DKC015 Database service has no healthcheck docker-compose.yml:1185
LOW DKC015 Database service has no healthcheck docker-compose.yml:1069
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:291
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:263
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:244
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:214
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:190
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:165
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:144
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:123
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:102
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:87
LOW DKC016 App service does not wait for database health tests/resources/docker/docker-compose.y…:354
LOW DKC016 App service does not wait for database health docker-compose.yml:251
LOW DKC016 App service does not wait for database health docker-compose.yml:1228
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:324
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:291
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:263
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:244
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:214
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:190
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:165
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:144
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:123
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:102
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:87
LOW DKC010 Compose service lacks no-new-privileges hardening tests/resources/docker/docker-compose.y…:354
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1212
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1152
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1143
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1134
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1112
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:251
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1228
LOW DKC017 Database password is wired through an environment variable placeholder docker-compose.yml:1051
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:324
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:291
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:263
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:244
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:214
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:190
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:165
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:144
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:123
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:102
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:87
LOW DKC006 Compose service does not declare a runtime user tests/resources/docker/docker-compose.y…:354
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1212
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1152
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1143
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1134
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1112
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:251
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1228
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… src/Appwrite/Utopia/Response/Model/Docu…:109
INFO MINED048 [MINED048] Php Error Suppress: @function() suppresses errors silently. Hides real issues. src/Appwrite/Platform/Tasks/Upgrade.php:32
INFO MINED048 [MINED048] Php Error Suppress: @function() suppresses errors silently. Hides real issues. src/Appwrite/Platform/Tasks/Install.php:62
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/Appwrite/Platform/Modules/Console/H…:123
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… app/controllers/api/console.php:110
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… app/config/storage/logos.php:3
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … .github/workflows/static-analysis/local…:32
Reset to top 5 173 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `appwrite/appwrite`

**Score: 81/100 (C+)**  ·  173 findings  ·  scanned 2026-06-05 10:16 UTC  ·  53,452 LOC

| Severity | Count |
|---|---|
| CRITICAL | 10 |
| HIGH | 38 |
| MEDIUM | 32 |
| LOW | 86 |

📊 [Full filterable report](https://repobility.com/scan/02f7d406-321a-4cbd-b4ea-79ebfd3ac5aa/)  ·  ![scorecard](https://repobility.com/scan/02f7d406-321a-4cbd-b4ea-79ebfd3ac5aa/report.png?v=1780654575-s2)

### Top findings

1. **CRITICAL** `SEC009` — .env File Committed: .env file with secrets committed to repository.
   `.env`
2. **CRITICAL** `DKC008` — Compose service mounts the Docker socket
   `tests/resources/docker/docker-compose.yml:214`
3. **CRITICAL** `DKC008` — Compose service mounts the Docker socket
   `tests/resources/docker/docker-compose.yml:354`
4. **CRITICAL** `DKC008` — Compose service mounts the Docker socket
   `tests/resources/docker/docker-compose.yml:1`
5. **CRITICAL** `DKC008` — Compose service mounts the Docker socket
   `docker-compose.yml:977`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/02f7d406-321a-4cbd-b4ea-79ebfd3ac5aa/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 4 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'appwrite/appwrite' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
71/180 findings (39%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.