Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

TolgaYanar/huddle

https://github.com/TolgaYanar/huddle · scanned 2026-06-16 00:39 UTC (2 months, 2 weeks ago)

84 raw signals (0 security + 84 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 84 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 84 findings

Severity distribution — click a segment to filter

Active filters: layer: api × excluding tests × Reset all

Severity: Critical 0 High 3 Medium 10 Low 32 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 84 Crowd 0 Layer: Frontend 24 Security 3 Cicd 1 Quality 44 Api 12

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 63.4/100 with 100.0% coverage. It contains 1415 nodes across 18 cross-layer flows, written primarily in mixed languages. Engine surfaced 84 findings — concentrated in quality (44), frontend (24), api (12). Risk profile is high: 0 critical, 3 high, 10 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 12 of 84 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph api Wiring conf 1.00 Dangling fetch: GET /api/youtube-search?q=${encodeURIComponent(q)}&maxResults=12 (apps/web/app/r/[roomId]/components/addVideosToPlaylistModal/api.ts:11)

`apps/web/app/r/[roomId]/components/addVideosToPlaylistModal/api.ts:11` calls `GET /api/youtube-search?q=${encodeURIComponent(q)}&maxResults=12` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/youtube-search` If this…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://commons.wikimedia.org/w/api.php?${params} (apps/web/app/api/image-search/route.ts:141)

`apps/web/app/api/image-search/route.ts:141` calls `GET https://commons.wikimedia.org/w/api.php?${params}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/commons.wikimedia.org/w/api.php` If this points at an …

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://kick.com/api/v1/channels/${channel} (apps/web/app/api/video-info/route.ts:266)

`apps/web/app/api/video-info/route.ts:266` calls `GET https://kick.com/api/v1/channels/${channel}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/kick.com/api/v1/channels/<p>` If this points at an external AP…

Dangling fetchFetch

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /api/saved-rooms/:roomId

`apps/server/src/routes/savedRooms.js` declares `DELETE /api/saved-rooms/:roomId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/auth/me

`apps/server/src/routes/auth.js` declares `GET /api/auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/saved-rooms

`apps/server/src/routes/savedRooms.js` declares `GET /api/saved-rooms` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/login

`apps/server/src/routes/auth.js` declares `POST /api/auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/login-token

`apps/server/src/routes/auth.js` declares `POST /api/auth/login-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/logout

`apps/server/src/routes/auth.js` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/register

`apps/server/src/routes/auth.js` declares `POST /api/auth/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/register-token

`apps/server/src/routes/auth.js` declares `POST /api/auth/register-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/saved-rooms

`apps/server/src/routes/savedRooms.js` declares `POST /api/saved-rooms` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/14bad2f4-c7f2-41bf-857e-fd136dbaf79f/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/14bad2f4-c7f2-41bf-857e-fd136dbaf79f/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.