Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
3 of your 51 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.65s · analysis 3.96s · 0.4 MB · GitHub API rate-limit (preflight)

regolith-labs/ore

https://github.com/regolith-labs/ore · scanned 2026-06-05 14:55 UTC (5 days, 3 hours ago) · 10 languages

48 raw signals (38 security + 10 graph) 0th percentile · Rust · small (2-20K LoC) System graph score 96 (lower by 48)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 3 hours ago · v2 · 41 actionable findings from 2 signal sources. 2 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
77.9
/100
Security checks
59
36 findings
System graph
96
66.7% cov · 5 findings
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 75.0 0.15 11.25
security_score 55.0 0.25 13.75
testing_score 0.0 0.20 0.00
documentation_score 61.0 0.15 9.15
practices_score 42.0 0.15 6.30
code_quality 79.4 0.10 7.94
Overall 1.00 48.4
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 25 Medium 6 Low 3 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 36 System graph 5 Crowd 0 Layer: Software 29 Quality 8 Api 1 Frontend 1 Security 1 Cicd 1
Scan summary Quality grade D+ (48/100). Dimensions: security 55, maintainability 75. 38 findings (27 security). 3,958 lines analyzed.

Showing 34 of 41 actionable findings. 43 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks software Resource exhaustion conf 1.00 3 occurrences [SEC035] Unbounded Resource Allocation — DoS risk: Allocating resources (buffers, recursion stack, large ranges) based on user input without an upper bound. Attackers send `size=10000000` to exhaust memory, or trigger expensive computation. CWE-770/400. Examples: CVE-2023-44487 (HTTP/2 Rapid Reset), countless YAML/XML billion-laughs variants.
Cap user-controlled sizes BEFORE allocation: size = min(int(request.args.get('n', 100)), MAX_SIZE) Set framework-level limits: Flask: app.config['MAX_CONTENT_LENGTH'] = 10 * 1024 * 1024 FastAPI: use middleware to enforce request size Django: DATA_UPLOAD_MAX_MEMORY_SIZE in settings.py …
3 files, 3 locations
program/src/automate.rs:8
program/src/bury.rs:10
program/src/deploy.rs:10
high Security checks software dependencies conf 0.88 bincode: RUSTSEC-2025-0141
Bincode is unmaintained
Cargo.lock
high Security checks software dependencies conf 0.88 bytes: RUSTSEC-2026-0007
Integer overflow in `BytesMut::reserve`
Cargo.lock
high Security checks software dependencies conf 0.88 curve25519-dalek: RUSTSEC-2024-0344
Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`
Cargo.lock
high Security checks software dependencies conf 0.88 derivative: RUSTSEC-2024-0388
`derivative` is unmaintained; consider using an alternative
Cargo.lock
high Security checks software dependencies conf 0.88 ed25519-dalek: RUSTSEC-2022-0093
Double Public Key Signing Function Oracle Attack on `ed25519-dalek`
Cargo.lock
high Security checks software dependencies conf 0.88 keccak: RUSTSEC-2026-0012
Unsoundness in opt-in ARMv8 assembly backend for `keccak`
Cargo.lock
high Security checks software dependencies conf 0.88 libsecp256k1: RUSTSEC-2025-0161
libsecp256k1 is unmaintained
Cargo.lock
high Security checks software dependencies conf 0.88 number_prefix: RUSTSEC-2025-0119
number_prefix crate is unmaintained
Cargo.lock
high Security checks software dependencies conf 0.88 openssl: GHSA-8c75-8mhr-p7r9
rust-openssl has incorrect bounds assertion in aes key wrap
Cargo.lock
high Security checks software dependencies conf 0.88 openssl: GHSA-ghm9-cr32-g9qj
rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
Cargo.lock
high Security checks software dependencies conf 0.88 openssl: GHSA-hppc-g8h3-xhp3
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
Cargo.lock
high Security checks software dependencies conf 0.88 openssl: GHSA-pqf5-4pqq-29f5
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
Cargo.lock
high Security checks software dependencies conf 0.88 openssl: GHSA-xp3w-r5p5-63rr
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
Cargo.lock
high Security checks software dependencies conf 0.88 openssl: RUSTSEC-2025-0022
Use-After-Free in `Md::fetch` and `Cipher::fetch`
Cargo.lock
high Security checks software dependencies conf 0.88 paste: RUSTSEC-2024-0436
paste - no longer maintained
Cargo.lock
high Security checks software dependencies conf 0.88 quinn-proto: RUSTSEC-2026-0037
Denial of service in Quinn endpoints
Cargo.lock
high Security checks software dependencies conf 0.88 rand: RUSTSEC-2026-0097
Rand is unsound with a custom logger using `rand::rng()`
Cargo.lock
high Security checks software dependencies conf 0.88 rkyv: RUSTSEC-2026-0001
Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
Cargo.lock
high Security checks software dependencies conf 0.88 rustls-pemfile: RUSTSEC-2025-0134
rustls-pemfile is unmaintained
Cargo.lock
high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0049
CRLs not considered authoritative by Distribution Point due to faulty matching logic
Cargo.lock
high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0098
Name constraints for URI names were incorrectly accepted
Cargo.lock
high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0099
Name constraints were accepted for certificates asserting a wildcard name
Cargo.lock
high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0104
Reachable panic in certificate revocation list parsing
Cargo.lock
high Security checks software dependencies conf 0.88 time: RUSTSEC-2026-0009
Denial of Service via Stack Exhaustion
Cargo.lock
medium Security checks software dependencies conf 0.88 borsh: GHSA-fjx5-qpf4-xjf2
Parsing borsh messages with ZST which are not-copy/clone is unsound
Cargo.lock
medium Security checks software dependencies conf 0.88 openssl: GHSA-phqj-4mhp-q6mq
rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
Cargo.lock
medium Security checks software dependencies conf 0.88 openssl: GHSA-xv59-967r-8726
rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
Cargo.lock
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.
auth
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
0 test file(s) for 30 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.
Coverage
low Security checks quality Quality conf 0.60 Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
program/src/buyback.rs:106 duplicationquality
low Security checks quality Documentation No LICENSE file
Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).
low Security checks software dependencies conf 0.88 openssl: GHSA-xmgf-hq76-4vx2
rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length
Cargo.lock
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/067f3907-809f-477f-8d8b-53ea4603bba3/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/067f3907-809f-477f-8d8b-53ea4603bba3/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.