Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

201 of your 549 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.99s · analysis 135.88s · 14.4 MB · GitHub API rate-limit (preflight)

dragneel07-psm/E-LearningWebApp

https://github.com/dragneel07-psm/E-LearningWebApp · scanned 2026-06-16 04:23 UTC (2 months ago) · 10 languages

500 raw signals (492 security + 8 graph) 5th percentile · Python · large (100-500K LoC) System graph score 88 (lower by 46)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months ago · v1 · 293 actionable findings from 2 signal sources. 207 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 8 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	0.0	0.25	0.00
`testing_score`	35.0	0.20	7.00
`documentation_score`	62.8	0.15	9.42
`practices_score`	89.0	0.15	13.35
`code_quality`	36.0	0.10	3.60
Overall		1.00	42.4

Severity distribution — click a segment to filter

Active filters: severity: medium × excluding tests × Reset all

Severity: Critical 2 High 143 Medium 57 Low 39 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 285 System graph 8 Crowd 0 Layer: Quality 87 Security 34 Software 156 Cicd 15 Frontend 1

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 88.0/100 with 88.9% coverage. It contains 40 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 8 findings — concentrated in quality (6), frontend (1), cicd (1). Risk profile is low: 0 critical, 0 high, 3 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 56 of 293 actionable findings. 500 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium Security checks software dependencies conf 0.88 @opentelemetry/core: GHSA-8988-4f7v-96qf

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

frontend/package-lock.json

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

medium Security checks software Open redirect conf 1.00 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.

Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …

frontend/components/command-palette.tsx:164

medium Security checks quality Quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).

Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.

backend/config/settings/local.py:6

medium Security checks software dependencies conf 0.88 axios: GHSA-3w6x-2g7m-8v23

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-445q-vr5w-6q77

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-5c9x-8gcm-mpgx

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-62hf-57xw-28j9

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-898c-q2cr-xwhg

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-fvcv-3m26-pcqx

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-m7pr-hjqh-92cm

Axios: no_proxy bypass via IP alias allows SSRF

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-vf2m-468p-8v99

Axios: HTTP adapter streamed responses bypass maxContentLength

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-w9j2-pvgh-6h63

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-xx6v-rp6x-q39c

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2

brace-expansion: Large numeric range defeats documented `max` DoS protection

mobile/package-lock.json

medium Security checks quality Quality conf 0.76 Compliance or security claim is near a placeholder link

Production pages should not pair trust claims such as SOC 2, GDPR, ISO, biometric consent, or encryption with placeholder links.

frontend/components/auth/login-form.tsx:286

medium Security checks cicd CI/CD security conf 0.86 Database dump or local database file is included in Docker build context

Database exports and local database files can contain production data, credentials, or large binary payloads that slow Docker builds and can be copied into images by broad COPY instructions.

.dockerignore CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.90 Docker build context has no .dockerignore

Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts.

.dockerignore CI/CD securitycontainers

medium Security checks software dependencies conf 0.88 follow-redirects: GHSA-r4q5-vmmm-2653

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

mobile/package-lock.json

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `codecov/codecov-action` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 138, 208, 236

.github/workflows/frontend-ci.yml:138, 208, 236 (3 hits)

CI/CD securitySupply chainGitHub Actions

medium Security checks software dependencies conf 0.88 idna: GHSA-65pc-fj4g-8rjx

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

requirements.txt

medium Security checks software dependencies conf 0.88 2 occurrences js-yaml: GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

2 files, 2 locations

frontend/package-lock.json

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 pillow: GHSA-5xmw-vc9v-4wf2

Pillow has a heap buffer overflow with nested list coordinates

requirements.txt

medium Security checks software dependencies conf 0.88 pillow: GHSA-r73j-pqj5-w3x7

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

requirements.txt

medium Security checks software dependencies conf 0.88 2 occurrences postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

2 files, 2 locations

frontend/package-lock.json

mobile/package-lock.json

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 pyjwt: GHSA-993g-76c3-p5m4

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

requirements.txt

medium Security checks software dependencies conf 0.88 2 occurrences pypdf: GHSA-248m-82v9-q6g6

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

2 files, 2 locations

backend/requirements.txt

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-3crg-w4f6-42mx

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-4pxv-j86v-mhcw

pypdf: Possible long runtimes for wrong size values in incremental mode

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-7gw9-cf7v-778f

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-87mj-5ggw-8qc3

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-9m86-7pmv-2852

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

requirements.txt

medium Security checks software dependencies conf 0.88 2 occurrences pypdf: GHSA-cj93-chg6-vgv8

pypdf: Possible large memory usage for large offsets for layout mode text

2 files, 2 locations

backend/requirements.txt

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-hqmh-ppp3-xvm7

pypdf: manipulated stream length values can exhaust RAM

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-jj6c-8h6c-hppx

pypdf has long runtimes for wrong size values in cross-reference and object streams

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-qpxp-75px-xjcp

pypdf has inefficient decoding of array-based streams

requirements.txt

medium Security checks software dependencies conf 0.88 pypdf: GHSA-x284-j5p8-9c5p

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

requirements.txt

medium Security checks software dependencies conf 0.90 Python package `django-redis` is 2 major version(s) behind (5.4.0 -> 7.0.0)

`django-redis==5.4.0` is 2 major version(s) behind the latest stable release on PyPI (7.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:22

medium Security checks software dependencies conf 0.90 Python package `Django` is 1 major version(s) behind (5.2.9 -> 6.0.6)

`Django==5.2.9` is 1 major version(s) behind the latest stable release on PyPI (6.0.6). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:16

medium Security checks software dependencies conf 0.90 Python package `gunicorn` is 3 major version(s) behind (23.0.0 -> 26.0.0)

`gunicorn==23.0.0` is 3 major version(s) behind the latest stable release on PyPI (26.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:29

medium Security checks software dependencies conf 0.90 Python package `psutil` is 1 major version(s) behind (6.1.0 -> 7.2.2)

`psutil==6.1.0` is 1 major version(s) behind the latest stable release on PyPI (7.2.2). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:53

medium Security checks software dependencies conf 0.88 python-dotenv: GHSA-mf9w-mj56-hr94

python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

requirements.txt

medium Security checks software dependencies conf 0.88 quill: GHSA-4943-9vgg-gr5r

Cross-site Scripting in quill

frontend/package-lock.json

medium Security checks software dependencies conf 0.88 requests: GHSA-gc5v-m9x4-r6x2

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

requirements.txt

medium Security checks quality Quality conf 0.72 Service worker is present without a web app manifest

A service worker without a manifest often means the PWA install surface is incomplete or inconsistent across devices.

manifest.json

medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced

A file created as a fixed/new/final/copy variant is not referenced by imports or path-like strings in the rest of the repository. This is a strong sign that an agent produced code beside the active application path.

backend/scripts/verify_teacher_fix.py:1

medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced

backend/scripts/create_library_tables_final.py:1

medium Security checks software dependencies conf 0.88 uuid: GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

mobile/package-lock.json

medium Security checks software dependencies conf 0.88 yaml: GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

mobile/package-lock.json

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — check_and_create_course.py:26

`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

CI/CD securityCoverage

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/20da0a1c-4516-4610-b858-854a2f468893/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/20da0a1c-4516-4610-b858-854a2f468893/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.