Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

InsertCleverNameHere/Drums-Trainer

https://github.com/InsertCleverNameHere/Drums-Trainer · scanned 2026-08-07 00:10 UTC (1 month ago)

40 raw signals (0 security + 40 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v1 · 40 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
89.2
/100
Security checks
89
0 findings
System graph
89
50.0% cov · 40 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 22 Medium 16 Low 2 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 40 Crowd 0 Layer: Security 8 Cicd 3 Quality 5 Dependencies 24
Scan summary Repository scanned at 89.2/100 with 50.0% coverage. It contains 458 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 40 findings — concentrated in dependencies (24), security (8), quality (5). Risk profile is high: 0 critical, 22 high, 16 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 40 of 40 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/bump-version.js:11
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/bump-version.js:11 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/generate-changelog.js:10
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/generate-changelog.js:10 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/parse-commit.js:17
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/parse-commit.js:17 Node child process
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.16: GHSA-mh99-v99m-4gvg
OSV.dev reports `brace-expansion` at version `1.1.16` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounde…
package-lock.json ScaOsvGhsa mh99 v99m 4gvg
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.16: GHSA-rgw5-rvv9-x895
OSV.dev reports `brace-expansion` at version `1.1.16` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounde…
package-lock.json ScaOsvGhsa rgw5 rvv9 x895
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.1.2: GHSA-mh99-v99m-4gvg
OSV.dev reports `brace-expansion` at version `2.1.2` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded…
package-lock.json ScaOsvGhsa mh99 v99m 4gvg
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.1.2: GHSA-rgw5-rvv9-x895
OSV.dev reports `brace-expansion` at version `2.1.2` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded…
package-lock.json ScaOsvGhsa rgw5 rvv9 x895
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg
OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded…
package-lock.json ScaOsvGhsa mh99 v99m 4gvg
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895
OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded…
package-lock.json ScaOsvGhsa rgw5 rvv9 x895
high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.3.0: GHSA-5p4m-2wfm-xmqj
OSV.dev reports `js-yaml` at version `4.3.0` (resolved in `package-lock.json`) is affected by GHSA-5p4m-2wfm-xmqj. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) —…
package-lock.json ScaOsvGhsa 5p4m 2wfm xmqj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.0.5: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `3.0.5` (resolved in `package-lock.json`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch ReDoS: nested *() extglobs generate …
package-lock.json ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.0.5: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `3.0.5` (resolved in `package-lock.json`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch has a ReDoS via repeated wildcards w…
package-lock.json ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.0.5: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `3.0.5` (resolved in `package-lock.json`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch has ReDoS: matchOne() combinatorial …
package-lock.json ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency sharp 0.32.6: GHSA-f88m-g3jw-g9cj
OSV.dev reports `sharp` at version `0.32.6` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. Note: `sharp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328…
package-lock.json ScaOsvGhsa f88m g3jw g9cj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-23hp-3jrh-7fpw (aka CVE-2026-59873). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar: Decompression/parse DoS via unlimited input Ali…
package-lock.json ScaOsvGhsa 23hp 3jrh 7fpw
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-34x7-hfp2-rc4v (aka CVE-2026-24842). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar Vulnerable to Arbitrary File Creation/Overwrite v…
package-lock.json ScaOsvGhsa 34x7 hfp2 rc4v
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-83g3-92jg-28cx (aka CVE-2026-26960). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Arbitrary File Read/Write via Hardlink Target Escape Throu…
package-lock.json ScaOsvGhsa 83g3 92jg 28cx
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-8qq5-rm4j-mr97 (aka CVE-2026-23745). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar is Vulnerable to Arbitrary File Overwrite and Sym…
package-lock.json ScaOsvGhsa 8qq5 rm4j mr97
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-8x88-c5mf-7j5w (aka CVE-2026-59874). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar: Negative tar entry size causes infinite loop in …
package-lock.json ScaOsvGhsa 8x88 c5mf 7j5w
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-9ppj-qmqm-q256 (aka CVE-2026-31802). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar Symlink Path Traversal via Drive-Relative Linkpat…
package-lock.json ScaOsvGhsa 9ppj qmqm q256
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-qffp-2rhf-9h96 (aka CVE-2026-29786). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. tar has Hardlink Path Traversal via Drive-Relative Linkpat…
package-lock.json ScaOsvGhsa qffp 2rhf 9h96
high System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-r6q2-hw4h-h46w (aka CVE-2026-23950). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Race Condition in node-tar Path Reservations via Unicode L…
package-lock.json ScaOsvGhsa r6q2 hw4h h46w
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — js/main.js:212
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
js/main.js:212 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — js/ui/notices.js:108
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
js/ui/notices.js:108 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — js/uiController.js:558
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
js/uiController.js:558 runtime safetyRobustnessUnhandled promise
medium System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/release.yml:27 CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/release.yml CI/CD securitySupply chainGithub actions
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in js/profiler.js:376
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
js/profiler.js:376 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in js/ui/notices.js:70
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
js/ui/notices.js:70 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in js/uiController.js:478
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
js/uiController.js:478 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in libs/js/nouislider.min.js:2
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/js/nouislider.min.js:2 Direct innerhtml assignment
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
1 test file(s) for 36 source file(s) (ratio 0.03). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-gvwx-54wh-qm9j (aka CVE-2026-59875). Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar: Uncaught Exception DoS via NUL byte in PAX path/…
package-lock.json ScaOsvGhsa gvwx 54wh qm9j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-r292-9mhp-454m. Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack…
package-lock.json ScaOsvGhsa r292 9mhp 454m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-vmf3-w455-68vh. Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vmf3-w4…
package-lock.json ScaOsvGhsa vmf3 w455 68vh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp
OSV.dev reports `tar` at version `6.2.1` (resolved in `package-lock.json`) is affected by GHSA-w8wr-v893-vjvp. Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w8wr-v8…
package-lock.json ScaOsvGhsa w8wr v893 vjvp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tar 7.5.20: GHSA-r292-9mhp-454m
OSV.dev reports `tar` at version `7.5.20` (resolved in `package-lock.json`) is affected by GHSA-r292-9mhp-454m. Note: `tar` is a transitive dependency — pulled in by another package, not declared directly in a manifest. node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stac…
package-lock.json ScaOsvGhsa r292 9mhp 454m
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 45 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/pr-validate.yml:13 CI/CD securitySupply chainGithub actions
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/1af4221f-8ede-4d9e-97c8-1a7e1b390538/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/1af4221f-8ede-4d9e-97c8-1a7e1b390538/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.