lingdojo/kana-dojo

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	100.0	0.25	25.00
`testing_score`	65.0	0.20	13.00
`documentation_score`	88.0	0.15	13.20
`practices_score`	87.0	0.15	13.05
`code_quality`	80.0	0.10	8.00
Overall		1.00	85.0

high Security checks software dependencies conf 0.90 ✓ Repobility 4 occurrences [MINED118] Dockerfile FROM `node:20-alpine` not pinned by digest: `FROM node:20-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Replace with: `FROM node:20-alpine@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).

2 files, 4 locations

Dockerfile:5, 13, 23 (3 hits)

Dockerfile.dev:3

high Security checks cicd CI/CD security conf 0.92 Dockerfile copies the entire context without .dockerignore

Create .dockerignore before using broad context copies, or copy only the required files and directories.

Dockerfile.dev:19 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.92 Dockerfile copies the entire context without .dockerignore

Create .dockerignore before using broad context copies, or copy only the required files and directories.

Dockerfile:16 CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 63 occurrences GitHub Action is tag-pinned rather than SHA-pinned

[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lo…

12 files, 57 locations

.github/workflows/pr-check.yml:25, 45, 103, 109, 122, 151, 155 (14 hits)

.github/workflows/hourly-community-issue.yml:36, 79, 87, 1283 (8 hits)

.github/workflows/github-metrics.yml:20, 61, 64 (6 hits)

.github/workflows/pr-community-review.yml:65, 71, 80 (6 hits)

.github/workflows/auto-reset-community-backlog.yml:54, 60 (4 hits)

.github/workflows/backfill-community-backlog.yml:29, 35 (4 hits)

.github/workflows/issue-closed-community-backlog.yml:24, 30 (4 hits)

.github/workflows/stale-community-issues.yml:27, 70, 76 (3 hits)

CI/CD securitySupply chainGitHub Actions

high System graph security security conf 1.00 Insecure pattern 'exec_used' in sql.js.d.ts:15

Found a known-risky pattern (exec_used). Review and replace if possible.

sql.js.d.ts:15 Exec used

high System graph cicd CI/CD security conf 1.00 pull_request_target workflow appears to check out untrusted PR code

pull_request_target runs with base-repo privileges. Checking out PR head code in that context can expose repository tokens or secrets to attacker-controlled code.

.github/workflows/pr-community-review.yml CI/CD securitySupply chainGithub actions

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.

high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 31.6% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes.

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /llms.txt.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/llms.txt/route.ts:5

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /now/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/indexnow/route.ts:119

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /progress-sync/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/progress-sync/route.ts:195

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /security.txt.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/security.txt/route.ts:8

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /trivia/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/trivia/route.ts:60

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /analyze-text/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/analyze-text/route.ts:178

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /now/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/indexnow/route.ts:24

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /progress-sync/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/progress-sync/route.ts:253

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /trigger-thanos-community-content/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

app/api/trigger-thanos-community-content/route.ts:22

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

app/layout.tsx:193

medium Security checks quality Quality conf 1.00 3 occurrences [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

3 files, 3 locations

features/Experiments/components/Hanabi.tsx:88

features/Experiments/components/KanaNebula.tsx:77

features/Experiments/components/KanaZen.tsx:25

medium Security checks cicd CI/CD security conf 0.90 Docker build context has no .dockerignore

Add .dockerignore with at least .git, .env, private keys, dependency folders, build outputs, and local databases.

.dockerignore CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Add a non-root USER in the final runtime stage after files and permissions are prepared.

Dockerfile.dev:4 CI/CD securitycontainers

high Security checks quality Quality conf 0.74 10 occurrences Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

8 files, 10 locations

public/sw.js:108, 114 (2 hits)

shared/utils/indexnow.ts:19, 45 (2 hits)

features/Translator/services/textAnalysisAPI.ts:51

features/Translator/services/translationAPI.ts:145

next.config.ts:187

shared/hooks/game/useTrivia.ts:78

shared/ui-composite/Performance/SessionPrefetch.tsx:11

shared/ui-composite/misc/RandomFact.tsx:20

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — app/[locale]/anki-converter/page.tsx:221

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — app/[locale]/resources/[category]/[subcategory]/page.tsx:171

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — app/[locale]/resources/[category]/page.tsx:149

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — app/[locale]/resources/page.tsx:124

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — core/analytics/GoogleAnalytics.tsx:17

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — core/analytics/MSClarity.tsx:12

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — features/Resources/components/CategoryHeader.tsx:69

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/AuthorSchema.tsx:118

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/BreadcrumbSchema.tsx:32

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/CourseSchema.tsx:73

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/FAQSchema.tsx:57

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/HowToSchema.tsx:122

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/ItemListSchema.tsx:177

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/LearningResourceSchema.tsx:159

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/StructuredData.tsx:13

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — shared/ui-composite/SEO/VideoSchema.tsx:130

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/api/community-stats/route.ts:14

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/api/indexnow/route.ts:74

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/api/translate/route.ts:445

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/sw.js:168

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — shared/infra/server/redis.ts:15

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — shared/ui-composite/Decorations/Decorations.tsx:148

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — shared/utils/decorations/decorationUtils.ts:57

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph cicd CI/CD security conf 1.00 13 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

12 files, 12 locations

.github/workflows/auto-reset-community-backlog.yml

.github/workflows/backfill-community-backlog.yml

.github/workflows/backfill-pr-authors.yml

.github/workflows/community-maintenance.yml

.github/workflows/github-metrics.yml

.github/workflows/hourly-community-issue.yml

.github/workflows/issue-closed-community-backlog.yml

.github/workflows/main.yml

CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in app/[locale]/anki-converter/page.tsx:221

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

app/[locale]/anki-converter/page.tsx:221 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in app/[locale]/resources/[category]/[subcategory]/page.tsx:171

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

app/[locale]/resources/[category]/[subcategory]/page.tsx:171 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in app/[locale]/resources/[category]/page.tsx:149

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

app/[locale]/resources/[category]/page.tsx:149 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in app/[locale]/resources/page.tsx:124

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

app/[locale]/resources/page.tsx:124 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in core/analytics/GoogleAnalytics.tsx:17

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

core/analytics/GoogleAnalytics.tsx:17 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in core/analytics/MSClarity.tsx:12

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

core/analytics/MSClarity.tsx:12 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in features/Resources/components/CategoryHeader.tsx:69

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

features/Resources/components/CategoryHeader.tsx:69 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/AuthorSchema.tsx:118

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/AuthorSchema.tsx:118 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/BreadcrumbSchema.tsx:32

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/BreadcrumbSchema.tsx:32 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/CourseSchema.tsx:73

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/CourseSchema.tsx:73 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/FAQSchema.tsx:57

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/FAQSchema.tsx:57 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/HowToSchema.tsx:122

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/HowToSchema.tsx:122 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/ItemListSchema.tsx:177

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/ItemListSchema.tsx:177 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/LearningResourceSchema.tsx:159

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/LearningResourceSchema.tsx:159 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/StructuredData.tsx:13

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/StructuredData.tsx:13 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in shared/ui-composite/SEO/VideoSchema.tsx:130

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

shared/ui-composite/SEO/VideoSchema.tsx:130 Dangerous innerhtml

high Security checks cicd CI/CD security conf 0.56 Compose service does not declare a runtime user

Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.

docker-compose.yml:5 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 Compose service lacks no-new-privileges hardening

Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.

docker-compose.yml:5 CI/CD securitycontainers

low Security checks quality Quality conf 0.60 30 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 20 locations

app/[locale]/(main)/jlpt/n4/page.tsx:1, 4 (2 hits)

app/[locale]/(main)/jlpt/n5/page.tsx:1, 4 (2 hits)

app/[locale]/(main)/vocabulary/jlpt-n2/page.tsx:4, 10 (2 hits)

app/[locale]/(main)/vocabulary/jlpt-n3/page.tsx:4, 10 (2 hits)

app/[locale]/(main)/vocabulary/jlpt-n4/page.tsx:4, 10 (2 hits)

app/[locale]/(main)/vocabulary/jlpt-n5/page.tsx:4, 10 (2 hits)

app/[locale]/(main)/vocabulary/page.tsx:10, 29 (2 hits)

app/[locale]/kana/train/timed/page.tsx:2, 5 (2 hits)

duplicationquality

low Security checks quality Quality conf 0.68 Multiple AI-agent scaffold marker files are present

Keep one current agent instruction file if it helps contributors, remove stale progress/completion markers, and make sure the README, tests, and CI describe the real supported behavior.

AGENTS.md:1

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

Add humans.txt with team ownership, contact URL, key documentation links, and the last-updated date.

humans.txt

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph hardware Supply chain conf 1.00 3 occurrences Docker base image is tag-pinned but not digest-pinned: node:20-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

lines 5, 13, 23

Dockerfile:5, 13, 23 (3 hits)

containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: canvas-confetti.d.ts