Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

koala73/worldmonitor

https://github.com/koala73/worldmonitor · scanned 2026-07-23 19:36 UTC (3 months ago)

245 raw signals (0 security + 245 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v9 · last Δ +3.2 (diff) · 241 actionable findings from 1 signal source. 4 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
62.6
/100
Security checks
63
0 findings
System graph
63
100.0% cov · 241 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 1 High 29 Medium 50 Low 150 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 241 Crowd 0 Layer: Software 11 Frontend 32 Security 69 Network 3 Hardware 2 Cicd 3 Quality 103 Dependencies 16 Api 2
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 62.6/100 with 100.0% coverage. It contains 19841 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 245 findings — concentrated in quality (103), security (69), frontend (32). Risk profile is high: 1 critical, 29 high, 55 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 225 of 241 actionable findings. 245 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-13311: shell-quote 1.8.4 — pro-test/package-lock.json
shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result …
VulnCve 2026 13311
high System graph security Trivy conf 1.00 CVE-2026-41676: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, …
VulnCve 2026 41676
high System graph security Trivy conf 1.00 CVE-2026-41678: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reverse…
VulnCve 2026 41678
high System graph security Trivy conf 1.00 CVE-2026-41681: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::diges…
VulnCve 2026 41681
high System graph security Trivy conf 1.00 CVE-2026-41898: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_c…
VulnCve 2026 41898
high System graph security Trivy conf 1.00 CVE-2026-42327: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, w…
VulnCve 2026 42327
high System graph api Wiring conf 0.90 Dangling fetch: GET /api/llm-health (src/components/LlmStatusIndicator.ts:39)
`src/components/LlmStatusIndicator.ts:39` calls `GET /api/llm-health` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/llm-health`
src/components/LlmStatusIndicator.ts:39 Dangling fetchFetch
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — consumer-prices-core/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: consumer-prices-core/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — docker/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: docker/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — docker/Dockerfile.redis-rest
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: docker/Dockerfile.redis-rest
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.digest-notifications
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.digest-notifications
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.relay
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.relay
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.seed-bundle-portwatch-port-activity
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.seed-bundle-portwatch-port-activity
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.seed-bundle-resilience-validation
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.seed-bundle-resilience-validation
Misconfig
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.32.6 — package-lock.json
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — blog-site/package-lock.json
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — package-lock.json
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security security conf 1.00 Insecure pattern 'eval_used' in src/bootstrap/sentry-init.ts:333
Found a known-risky pattern (eval_used). Review and replace if possible.
src/bootstrap/sentry-init.ts:333 Eval used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in scripts/_seed-utils.mjs:895
Found a known-risky pattern (exec_used). Review and replace if possible.
scripts/_seed-utils.mjs:895 Exec used
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/audit-resilience-cohorts.mjs:70
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/audit-resilience-cohorts.mjs:70 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/capture-resilience-energy-v2-acceptance.mjs:19
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/capture-resilience-energy-v2-acceptance.mjs:19 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/check-sentry-coverage.mjs:30
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/check-sentry-coverage.mjs:30 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/freeze-resilience-ranking.mjs:22
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/freeze-resilience-ranking.mjs:22 Node child process
high System graph cicd CI/CD security conf 1.00 pull_request_target workflow appears to check out untrusted PR code
pull_request_target runs with base-repo privileges. Checking out PR head code in that context can expose repository tokens or secrets to attacker-controlled code.
.github/workflows/contributor-trust.yml CI/CD securitySupply chainGithub actions
high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869). js-yaml: YAML merge-key chains can force quadratic CPU consumption Aliases: CVE-2026-59869 Advisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m Fix: upgra…
package-lock.json ScaOsvGhsa 52cp r559 cp3m
high System graph dependencies dependencies conf 1.00 Vulnerable dependency sharp 0.32.6: GHSA-f88m-g3jw-g9cj
OSV.dev reports `sharp` at version `0.32.6` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 Advisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj Fix: upgrade `sh…
package-lock.json ScaOsvGhsa f88m g3jw g9cj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj
OSV.dev reports `sharp` at version `0.34.5` (resolved in `blog-site/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 Advisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj Fix: u…
blog-site/package.json ScaOsvGhsa f88m g3jw g9cj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency tauri 2.10.3: GHSA-7gmj-67g7-phm9
OSV.dev reports `tauri` at version `2.10.3` (resolved in `src-tauri/Cargo.lock`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184). Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands Aliases: CVE-2026-42184 Advisory: https://osv.dev/vulnerability/…
src-tauri/Cargo.toml ScaOsvGhsa 7gmj 67g7 phm9
high System graph dependencies dependencies conf 0.70 Vulnerable dependency wrangler 3.95.0: GHSA-36p8-mvp6-cv38
OSV.dev reports `wrangler` at version `3.95.0` (declared in `workers/api-cors-preflight/package.json`) is affected by GHSA-36p8-mvp6-cv38 (aka CVE-2026-0933). Note: `3.95.0` is the declared floor of a range — the installed version may be newer. Wrangler affected by OS Command Injection in `wrangle…
workers/api-cors-preflight/package.json ScaOsvGhsa 36p8 mvp6 cv38
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — public/pro/assets/index-kuCMAtx-.js:9
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
public/pro/assets/index-kuCMAtx-.js:9 Fq dangerous html
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 11.1.0 — pro-test/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — pro-test/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — scripts/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42184: tauri 2.10.3 — src-tauri/Cargo.lock
Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local or…
VulnCve 2026 42184
medium System graph security Trivy conf 1.00 CVE-2026-44662: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffe…
VulnCve 2026 44662
medium System graph security Trivy conf 1.00 CVE-2026-45784: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-…
VulnCve 2026 45784
medium System graph security Trivy conf 1.00 CVE-2026-59729: astro 6.4.8 — blog-site/package-lock.json
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) ## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `"' >/=` or whitespace ar…
VulnCve 2026 59729
medium System graph hardware Security conf 1.00 Dockerfile runs as root: consumer-prices-core/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: docker/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — sdk/python/src/worldmonitor_sdk/__init__.py:125
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
sdk/python/src/worldmonitor_sdk/__init__.py:125 SecurityPython
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — consumer-prices-core/src/acquisition/types.ts:53
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
consumer-prices-core/src/acquisition/types.ts:53 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — src/app/country-intel.ts:1092
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
src/app/country-intel.ts:1092 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — src/components/DeckGLMap.ts:923
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
src/components/DeckGLMap.ts:923 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — src/services/breaking-news-alerts.ts:223
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
src/services/breaking-news-alerts.ts:223 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — src/services/preferences-content.ts:548
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
src/services/preferences-content.ts:548 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — src/utils/cloud-prefs-sync.ts:738
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
src/utils/cloud-prefs-sync.ts:738 runtime safetyRobustnessUnhandled promise
medium System graph security Trivy conf 1.00 GHSA-4g3v-8h47-v7g6: astro 6.4.8 — blog-site/package-lock.json
Astro: Reflected XSS via unescaped View Transition animation properties ## Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an a…
VulnGhsa 4g3v 8h47 v7g6
medium System graph security Trivy conf 1.00 GHSA-7gcf-g7xr-8hxj: serde_with 3.17.0 — src-tauri/Cargo.lock
serde_with: KeyValueMap serialization panics on empty sequence or map entries ### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumptio…
VulnGhsa 7gcf g7xr 8hxj
medium System graph security Trivy conf 1.00 GHSA-wrw7-89jp-8q8g: glib 0.18.5 — src-tauri/Cargo.lock
Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable referenc…
VulnGhsa wrw7 89jp 8q8g
medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
5 files, 5 locations
.github/workflows/build-desktop.yml
.github/workflows/docker-publish.yml
.github/workflows/publish-cli.yml
.github/workflows/publish-python.yml
.github/workflows/publish-ruby.yml
CI/CD securitySupply chainGithub actions
medium System graph security Semgrep conf 0.55 header redefinition — docker/nginx.conf:46
The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all…
docker/nginx.conf:46 SecurityNginx
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/_agent-metadata.ts:35
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/_agent-metadata.ts:35 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/_cors.js:87
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/_cors.js:87 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/a2a.ts:46
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/a2a.ts:46 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/agent-auth.ts:30
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/agent-auth.ts:30 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/ask.ts:40
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/ask.ts:40 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/docs-mcp.ts:56
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/docs-mcp.ts:56 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/geo.js:10
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/geo.js:10 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/http-message-signatures-directory.ts:91
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/http-message-signatures-directory.ts:91 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/oauth-authorization-server.ts:81
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/oauth-authorization-server.ts:81 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/oauth-protected-resource.ts:45
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/oauth-protected-resource.ts:45 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/oauth/authorize.js:202
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/oauth/authorize.js:202 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/security/report.js:10
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/security/report.js:10 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/version.js:22
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/version.js:22 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in vite.config.ts:745
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
vite.config.ts:745 Cors wildcard
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in src/components/Panel.ts:1183
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
src/components/Panel.ts:1183 Direct innerhtml assignment
medium System graph security security conf 0.85 Insecure pattern 'direct_innerhtml_assignment' in src/utils/dom-utils.ts:73
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
src/utils/dom-utils.ts:73 Direct innerhtml assignment
medium System graph security Semgrep conf 0.55 missing internal — docker/nginx.conf:105
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
docker/nginx.conf:105 SecurityNginx
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 289 placeholder/mock markers across 113 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph network Security conf 1.00 Privileged port 256 in use
Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
docker/Dockerfile Ports
medium System graph network Security conf 1.00 Privileged port 54 in use
Port 54 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
docker/Dockerfile Ports
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 6.4.8: GHSA-4g3v-8h47-v7g6
OSV.dev reports `astro` at version `6.4.8` (resolved in `blog-site/package-lock.json`) is affected by GHSA-4g3v-8h47-v7g6. Astro: Reflected XSS via unescaped View Transition animation properties Advisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6 Fix: upgrade `astro` past the affected ran…
blog-site/package.json ScaOsvGhsa 4g3v 8h47 v7g6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 6.4.8: GHSA-f48w-9m4c-m7f5
OSV.dev reports `astro` at version `6.4.8` (resolved in `blog-site/package-lock.json`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729). Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) Aliases: CVE-2026-59729 Advisory: https://osv.de…
blog-site/package.json ScaOsvGhsa f48w 9m4c m7f5
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550). JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases Aliases: CVE-2026-53550 Advisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68 …
package-lock.json ScaOsvGhsa h67p 54hq rp68
low System graph quality Maintenance conf 1.00 52 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph quality Integrity conf 1.00 84 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `AGSI_API_KEY`, `ALLOW_UNAUTHENTICATED_RELAY`, `API_BASE`, `API_RATE_LIMIT_ENFORCE`, `AXIOM_QUERY_TOKEN`, `AXIOM_QUERY_URL`, `BASELINE`, `BASELINE_RANKING_SNAPSHOT` + 76 more. Add them (with a placeholder/comment) to .env.example so onboarding does…
config drift
low System graph api Wiring conf 1.00 85 backend endpoints not called by scanned frontend
No scanned frontend call matched these backend routes. Sample: ANY /api/telegram-feed, ANY /api/gpsjam, ANY /api/rss-proxy, ANY /api/fwdstart, ANY /api/oref-alerts, ANY /api/geo, ANY /api/opensky, ANY /api/og-story + 77 more. This is fine when endpoints serve external clients (mobile apps, SDKs, th…
Unused endpoint
low System graph security Trivy conf 1.00 CVE-2026-41677: openssl 0.10.75 — src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that ret…
VulnCve 2026 41677
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.29.0 — pro-test/package-lock.json
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph security Trivy conf 1.00 CVE-2026-59727: astro 6.4.8 — blog-site/package-lock.json
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands ### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the render…
VulnCve 2026 59727
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — api/mcp-proxy.ts:52
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
api/mcp-proxy.ts:52 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — public/mapbox-gl-rtl-text.min.js:4
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
public/mapbox-gl-rtl-text.min.js:4 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/App.ts:658
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/App.ts:658 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/app/data-loader.ts:982
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/app/data-loader.ts:982 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/app/event-handlers.ts:1210
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/app/event-handlers.ts:1210 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/app/panel-layout.ts:491
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/app/panel-layout.ts:491 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/app/search-manager.ts:727
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/app/search-manager.ts:727 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/bootstrap/sw-update.ts:135
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/bootstrap/sw-update.ts:135 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/components/CIIPanel.ts:314
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/components/CIIPanel.ts:314 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/components/Map.ts:1874
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/components/Map.ts:1874 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/components/MapContainer.ts:465
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/components/MapContainer.ts:465 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/components/StrategicPosturePanel.ts:49
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/components/StrategicPosturePanel.ts:49 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/components/StrategicRiskPanel.ts:159
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/components/StrategicRiskPanel.ts:159 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/main.ts:471
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/main.ts:471 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/services/breaking-news-alerts.ts:187
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/services/breaking-news-alerts.ts:187 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/services/checkout.ts:618
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/services/checkout.ts:618 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/services/runtime.ts:377
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/services/runtime.ts:377 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/utils/circuit-breaker.ts:370
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
src/utils/circuit-breaker.ts:370 Fq console leak
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 1455 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency astro is a major version behind
`astro` is pinned at `6.4.7` in `blog-site/package.json` while the latest release on the npm registry is `7.1.3` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`.
blog-site/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency keyring is a major version behind
`keyring` is pinned at `3` in `src-tauri/Cargo.toml` while the latest release on the cargo registry is `4.1.5` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `keyring` to `4.1.5`.
src-tauri/Cargo.toml FreshnessOutdated
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — consumer-prices-core/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: consumer-prices-core/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — docker/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: docker/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — docker/Dockerfile.redis-rest
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: docker/Dockerfile.redis-rest
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.digest-notifications
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.digest-notifications
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.publish-bootstrap-tiers
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.publish-bootstrap-tiers
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.seed-bundle-portwatch-port-activity
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.seed-bundle-portwatch-port-activity
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.seed-bundle-resilience-validation
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.seed-bundle-resilience-validation
Misconfig
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.7.3 — src-tauri/Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.8.5 — src-tauri/Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph frontend Frontend quality conf 0.85 Icon-only button without accessible name — src/app/panel-layout.ts:1318
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
src/app/panel-layout.ts:1318 Fq button no label
low System graph frontend Frontend quality conf 0.85 Icon-only button without accessible name — src/components/AviationCommandBar.ts:322
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
src/components/AviationCommandBar.ts:322 Fq button no label
low System graph frontend Frontend quality conf 0.85 Icon-only button without accessible name — src/components/ConsumerPricesPanel.ts:376
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
src/components/ConsumerPricesPanel.ts:376 Fq button no label
low System graph frontend Frontend quality conf 0.85 Icon-only button without accessible name — src/settings-window.ts:113
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
src/settings-window.ts:113 Fq button no label
low System graph security security conf 1.00 Insecure pattern 'document_write' in api/oauth/authorize.js:194
Found a known-risky pattern (document_write). Review and replace if possible.
api/oauth/authorize.js:194 Document write
low System graph security security conf 1.00 Insecure pattern 'document_write' in public/wm-widget-sandbox.html:69
Found a known-risky pattern (document_write). Review and replace if possible.
public/wm-widget-sandbox.html:69 Document write
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: workers/api-cors-preflight/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
workers/api-cors-preflight/package.json LockfileReproducibilityGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `droppedTooOld` in scripts/seed-portwatch-port-activity.mjs:1022
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `iptv_hd_abr_v1` in src/components/LiveNewsPanel.ts:263
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `passesLegacy` in scripts/notification-relay.cjs:884
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `pruneOld` in src/services/signal-aggregator.ts:156
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `RefreshDataLegacy` in api/oauth/token.ts:290
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `rest_v1` in server/worldmonitor/intelligence/v1/get-country-facts.ts:168
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `scoreEnergyLegacy` in server/worldmonitor/resilience/v1/_dimension-scorers.ts:1753
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `shouldBeDeprecated` in scripts/openapi-inject-deprecated.mjs:81
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `unstable_legacy` in public/pro/assets/index-kuCMAtx-.js:8
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
package.json CI/CD securitySupply chainNpm
low System graph software Dead code conf 1.00 Possibly dead Python function: conflict_events
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:233
low System graph software Dead code conf 1.00 Possibly dead Python function: country_brief
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:221
low System graph software Dead code conf 1.00 Possibly dead Python function: cyber_threats
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:237
low System graph software Dead code conf 1.00 Possibly dead Python function: forecast_predictions
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:253
low System graph software Dead code conf 1.00 Possibly dead Python function: list_prompts
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:183
low System graph software Dead code conf 1.00 Possibly dead Python function: list_resources
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:187
low System graph software Dead code conf 1.00 Possibly dead Python function: maritime_activity
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:257
low System graph software Dead code conf 1.00 Possibly dead Python function: market_data
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:229
low System graph software Dead code conf 1.00 Possibly dead Python function: natural_disasters
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:245
low System graph software Dead code conf 1.00 Possibly dead Python function: news_intelligence
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:241
low System graph software Dead code conf 1.00 Possibly dead Python function: sanctions_data
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
sdk/python/src/worldmonitor_sdk/__init__.py:249
low System graph security Trivy conf 1.00 Secret leak: Stripe Publishable Key — public/pro/assets/index-BplFCogO.js
Trivy detected a possible secret in `public/pro/assets/index-BplFCogO.js`. Rule: stripe-publishable-token Severity: LOW Match (redacted): .js");return{Clerk:n}},[]),r="***************************************",a=new s(r Action: rotate the credential and remove it from the repo. Use a secrets manag…
Secret
low System graph quality Complexity conf 1.00 Very large file: api/health.js (1629 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: api/mcp/registry/cache-tools.ts (1944 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: api/mcp/registry/rpc-tools.ts (1260 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: convex/__tests__/billing.test.ts (4545 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: convex/__tests__/followed-countries-mutations.test.ts (1534 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: convex/__tests__/waveRuns.test.ts (1221 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: convex/broadcast/waveRuns.ts (2149 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: convex/http.ts (1620 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: convex/payments/billing.ts (3514 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: e2e/runtime-fetch.spec.ts (1785 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: pro-test/src/App.tsx (1418 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/_seed-utils.mjs (2044 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/ais-relay.cjs (11721 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/compare-resilience-current-vs-proposed.mjs (1464 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/notification-relay.cjs (1375 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/seed-aviation.mjs (1527 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/seed-digest-notifications.mjs (3122 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/seed-forecast-resolutions.mjs (1409 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/seed-forecasts.mjs (19043 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/seed-military-flights.mjs (1436 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: scripts/seed-portwatch-port-activity.mjs (1406 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/_shared/brief-render.js (1674 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/gateway.ts (1942 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/worldmonitor/intelligence/v1/get-risk-scores.ts (1638 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/worldmonitor/market/v1/analyze-stock.ts (1475 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/worldmonitor/news/v1/list-feed-digest.ts (1586 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/worldmonitor/resilience/v1/_dimension-scorers.ts (2894 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/worldmonitor/resilience/v1/_indicator-registry.ts (1402 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/worldmonitor/resilience/v1/_shared.ts (1379 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src-tauri/sidecar/local-api-server.mjs (1900 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src-tauri/sidecar/local-api-server.test.mjs (2082 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src-tauri/src/main.rs (1516 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/App.ts (2398 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/app/country-intel.ts (1925 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/app/data-loader.ts (4022 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/app/event-handlers.ts (2279 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/app/panel-layout.ts (3496 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/bootstrap/sentry-init.ts (839 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/CountryDeepDivePanel.ts (3227 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/DeckGLMap.ts (7803 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/GlobeMap.ts (3796 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/LiveNewsPanel.ts (1849 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/Map.ts (4455 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/MapContainer.ts (1555 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/MapPopup.ts (3576 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/Panel.ts (1393 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/components/UnifiedSettings.ts (1552 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/config/ai-datacenters.ts (3981 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/config/apt-groups.ts (1933 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/config/feeds.ts (1211 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/config/geo-map.ts (2745 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/config/panels.ts (1521 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/generated/server/worldmonitor/economic/v1/service_server.ts (2101 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/generated/server/worldmonitor/intelligence/v1/service_server.ts (2125 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/generated/server/worldmonitor/market/v1/service_server.ts (1709 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/generated/server/worldmonitor/supply_chain/v1/service_server.ts (1632 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/services/checkout.ts (1302 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/services/followed-countries.ts (1381 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/services/notifications-settings.ts (1093 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/services/oref-locations.ts (1504 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/brief-dedup-embedding.test.mjs (1240 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/brief-from-digest-stories.test.mjs (2336 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/brief-llm.test.mjs (1994 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/brief-magazine-render.test.mjs (1248 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/brief-why-matters-analyst.test.mjs (1310 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/deploy-config.test.mjs (2749 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/followed-countries-sign-in-handoff.test.mjs (1330 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/forecast-detectors.test.mjs (4185 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/forecast-resolutions-seeder.test.mjs (1777 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/forecast-trace-export.test.mjs (8998 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/gateway-internal-mcp.test.mjs (1177 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/mcp-proxy.test.mjs (1137 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/mcp-resources.test.mjs (1321 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/mcp.test.mjs (3465 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/portwatch-port-activity-seed.test.mjs (1236 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/redis-caching.test.mjs (1680 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/regional-snapshot.test.mjs (1096 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/sentry-beforesend.test.mjs (1315 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/widget-builder.test.mjs (2061 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: vite.config.ts (1663 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 6.4.8: GHSA-7pw4-f3q4-r2p2
OSV.dev reports `astro` at version `6.4.8` (resolved in `blog-site/package-lock.json`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727). Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands Aliases: CVE-2026-59727 Advisory: https://osv.dev/vulnerabili…
blog-site/package.json ScaOsvGhsa 7pw4 f3q4 r2p2
low System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.27.4: GHSA-g7r4-m6w7-qqqr
OSV.dev reports `esbuild` at version `0.27.4` (resolved in `consumer-prices-core/package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr. esbuild allows arbitrary file read when running the development server on Windows Advisory: https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr Fix: upgrade `esbu…
consumer-prices-core/package-lock.json ScaOsvGhsa g7r4 m6w7 qqqr
low System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr
OSV.dev reports `esbuild` at version `0.27.7` (resolved in `package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr. esbuild allows arbitrary file read when running the development server on Windows Advisory: https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr Fix: upgrade `esbuild` past the affecte…
package-lock.json ScaOsvGhsa g7r4 m6w7 qqqr
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/1d8c44e9-ff4a-4e26-92b1-a7c0dd8d2345/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/1d8c44e9-ff4a-4e26-92b1-a7c0dd8d2345/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.