Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
201 of your 549 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.99s · analysis 135.88s · 14.4 MB · GitHub API rate-limit (preflight)

dragneel07-psm/E-LearningWebApp

https://github.com/dragneel07-psm/E-LearningWebApp · scanned 2026-06-16 04:23 UTC (2 months ago) · 10 languages

500 raw signals (492 security + 8 graph) 5th percentile · Python · large (100-500K LoC) System graph score 88 (lower by 46)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months ago · v1 · 293 actionable findings from 2 signal sources. 207 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
61.1
/100
Security checks
34
285 findings
System graph
88
88.9% cov · 8 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 0.0 0.25 0.00
testing_score 35.0 0.20 7.00
documentation_score 62.8 0.15 9.42
practices_score 89.0 0.15 13.35
code_quality 36.0 0.10 3.60
Overall 1.00 42.4
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 143 Medium 57 Low 39 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 285 System graph 8 Crowd 0 Layer: Quality 87 Security 34 Software 156 Cicd 15 Frontend 1
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 88.0/100 with 88.9% coverage. It contains 40 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 8 findings — concentrated in quality (6), frontend (1), cicd (1). Risk profile is low: 0 critical, 0 high, 3 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 224 of 293 actionable findings. 500 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection.
Review and fix per the pattern semantics. See CWE-89 / A03:2021 for context.
3 files, 3 locations
backend/scripts/create_library_tables.py:77
backend/scripts/create_library_tables_final.py:121
backend/scripts/create_library_tables_simple.py:80
high Security checks quality Quality conf 1.00 ✓ Repobility 10 occurrences Missing import: `email` used but not imported
The file uses `email.something(...)` but never imports `email`. This raises NameError at runtime the first time the line executes.
10 files, 10 locations
backend/academic/serializers/profiles.py:46
backend/academic/services/academic_year_service.py:659
backend/academic/views/academic.py:225
backend/academic/views/profiles.py:956
backend/academic/views/reports.py:875
backend/ai_engine/services/knowledge_graph_service.py:373
backend/core/management/commands/reconcile_public_users_to_tenants.py:354
backend/core/management/commands/upsert_tenant_user.py:70
critical Security checks software dependencies conf 0.88 shell-quote: GHSA-w7jw-789q-3m8p
shell-quote quote() does not escape newlines in object .op values
mobile/package-lock.json
high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-2v35-w6hq-6mfw
xmldom: Uncontrolled recursion in XML serialization leads to DoS
mobile/package-lock.json
high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-f6ww-3ggp-fr8h
xmldom has XML injection through unvalidated DocumentType serialization
mobile/package-lock.json
high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-j759-j44w-7fr8
xmldom has XML node injection through unvalidated comment serialization
mobile/package-lock.json
high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-wh4c-j3r5-mjhp
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
mobile/package-lock.json
high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-x6wf-f3px-wcqx
xmldom has XML node injection through unvalidated processing instruction serialization
mobile/package-lock.json
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /jobs/<str:job_id>/.
A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /jobs/<str:job_id>/.
backend/core/urls.py:41
low Security checks security Injection conf 0.50 3 occurrences [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.
Use parameterized queries: cursor.execute('SELECT * FROM t WHERE id = ?', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.
3 files, 3 locations
backend/scripts/create_library_tables.py:77
backend/scripts/create_library_tables_final.py:121
backend/scripts/create_library_tables_simple.py:80
high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences `self.instance` used but never assigned in __init__
Method `validate` of class `EmployeeSerializer` reads `self.instance`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
3 files, 25 locations
backend/hr_payroll/views.py:46, 58, 59, 67, 68, 75, 76, 87, +6 more (14 hits)
backend/hr_payroll/serializers.py:48, 49, 115, 116, 157, 158 (6 hits)
backend/hr_payroll/views_appraisal.py:86, 92, 115, 121, 127 (5 hits)
high Security checks software dependencies conf 0.88 axios: GHSA-35jp-ww65-95wh
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-3g43-6gmg-66jw
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-777c-7fjr-54vf
Allocation of Resources Without Limits or Throttling in Axios
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-pjwm-pj3p-43mv
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
mobile/package-lock.json
high Security checks software dependencies conf 0.88 axios: GHSA-q8qp-cvcw-x6jj
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
mobile/package-lock.json
high Security checks software dependencies conf 0.88 2 occurrences cryptography: GHSA-537c-gmf6-5ccf
Vulnerable OpenSSL included in cryptography wheels
2 files, 2 locations
backend/requirements.txt
requirements.txt
high Security checks software dependencies conf 0.88 cryptography: PYSEC-2026-35
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography woul…
requirements.txt
high Security checks software dependencies conf 0.88 cryptography: PYSEC-2026-36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in…
requirements.txt
low Security checks cicd CI/CD security conf 0.84 Database service publishes a host port
Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports.
docker-compose.yml:71 CI/CD securitycontainers
high Security checks software dependencies conf 0.88 django: GHSA-8p8v-wh79-9r56
Django vulnerable to Uncontrolled Resource Consumption
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-197
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read priv…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-198
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs …
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-199
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one …
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-200
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to rea…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-201
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cach…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-42
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-43
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not e…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-44
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not ev…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-45
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-46
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-47
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier,…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-48
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such a…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-49
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote attackers to load an unbounded request bod…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-50
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django …
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-51
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Djan…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-52
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluat…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-53
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evalua…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-54
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a l…
requirements.txt
high Security checks software dependencies conf 0.88 django: PYSEC-2026-55
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.…
requirements.txt
high Security checks cicd CI/CD security conf 0.92 Dockerfile copies the entire context without .dockerignore
COPY . or ADD . sends the full build context to Docker. Without .dockerignore this can include secrets, git history, and local artifacts.
frontend/Dockerfile:11 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.92 Dockerfile copies the entire context without .dockerignore
COPY . or ADD . sends the full build context to Docker. Without .dockerignore this can include secrets, git history, and local artifacts.
backend/Dockerfile:63 CI/CD securitycontainers
high Security checks software dependencies conf 0.90 ✓ Repobility 5 occurrences Dockerfile FROM `python:3.13-slim` not pinned by digest
`FROM python:3.13-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
2 files, 5 locations
frontend/Dockerfile:2, 8, 17 (3 hits)
backend/Dockerfile:2, 35 (2 hits)
high Security checks software dependencies conf 0.88 2 occurrences form-data: GHSA-hmw2-7cc7-3qxx
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
2 files, 2 locations
frontend/package-lock.json
mobile/package-lock.json
high Security checks cicd CI/CD security conf 0.90 ✓ Repobility GitHub Action is tag-pinned rather than SHA-pinned
Action `snyk/actions/node` tracks moving branch `@master` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.
.github/workflows/frontend-ci.yml:191 CI/CD securitySupply chainGitHub Actions
high Security checks software dependencies conf 0.88 lxml: PYSEC-2026-87
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='interna…
requirements.txt
high Security checks software dependencies conf 0.88 node-forge: GHSA-2328-f5f3-gj25
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
mobile/package-lock.json
high Security checks software dependencies conf 0.88 node-forge: GHSA-5m6q-g25r-mvwx
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
mobile/package-lock.json
high Security checks software dependencies conf 0.88 node-forge: GHSA-ppp5-5v6c-4jwp
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
mobile/package-lock.json
high Security checks software dependencies conf 0.88 node-forge: GHSA-q67f-28xg-22rw
Forge has signature forgery in Ed25519 due to missing S > L check
mobile/package-lock.json
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_admin_student_management
Test function `test_admin_student_management` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_admin_panel.py:22
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_ai_connection
Test function `test_ai_connection` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/core/views.py:600
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_ai_feedback
Test function `test_ai_feedback` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_sprint7.py:29
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_complete_workflow
Test function `test_complete_workflow` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_hall_tickets.py:36
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_gradebook
Test function `test_gradebook` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_sprint7.py:12
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_import
Test function `test_import` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_import_service.py:26
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_parent_portal
Test function `test_parent_portal` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_parent_portal.py:22
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_password
Test function `test_password` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/check_auth.py:15
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_reports
Test function `test_reports` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_reports_v2.py:25
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_student_endpoints
Test function `test_student_endpoints` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_student_dashboard.py:22
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_teacher_endpoints
Test function `test_teacher_endpoints` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
backend/scripts/verify_teacher_fix.py:23
high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers
mobile/package-lock.json
high Security checks software dependencies conf 0.88 pillow: GHSA-pwv6-vv43-88gr
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
requirements.txt
high Security checks software dependencies conf 0.88 pillow: GHSA-whj4-6x5x-4v2j
FITS GZIP decompression bomb in Pillow
requirements.txt
high Security checks software dependencies conf 0.88 pillow: PYSEC-2026-165
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2025-183
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-120
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting…
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-175
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no docu…
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-176
PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature ver…
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-177
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited out…
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-178
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b…
requirements.txt
high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-179
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secre…
requirements.txt
high Security checks security auth conf 0.83 4 occurrences Secret-like setting is echoed into a password input value
Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.
4 files, 4 locations
frontend/app/(saas)/saas/staff/page.tsx:445
frontend/app/admin/settings/staff-access/page.tsx:443
frontend/components/add-student-dialog.tsx:142
frontend/components/add-teacher-dialog.tsx:123
high Security checks software dependencies conf 0.88 urllib3: PYSEC-2026-141
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
requirements.txt
high Security checks software dependencies conf 0.88 urllib3: PYSEC-2026-142
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.dr…
requirements.txt
high Security checks software dependencies conf 0.90 ✓ Repobility Workflow container/services image `pgvector/pgvector:pg16` unpinned
`container/services image: pgvector/pgvector:pg16` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.
.github/workflows/backend-ci.yml:67
high Security checks software dependencies conf 0.88 ws: GHSA-96hv-2xvq-fx4p
ws: Memory exhaustion DoS from tiny fragments and data chunks
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 @opentelemetry/core: GHSA-8988-4f7v-96qf
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
frontend/package-lock.json
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 32.9% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
Only 32.9% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /analytics/teacher/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /analytics/teacher/.
backend/ai_engine/urls.py:68
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /capabilities/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /capabilities/.
backend/core/urls.py:44
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /chunks/search/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /chunks/search/.
backend/ai_engine/urls.py:61
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /jobs/quizzes/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /jobs/quizzes/.
backend/ai_engine/urls.py:60
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /jobs/summaries/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /jobs/summaries/.
backend/ai_engine/urls.py:59
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /saas-ai-usage/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /saas-ai-usage/.
backend/core/urls.py:47
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /saas-kpi/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /saas-kpi/.
backend/core/urls.py:46
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /school-profile/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /school-profile/.
backend/core/urls.py:45
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /tenant-check/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /tenant-check/.
backend/core/urls.py:43
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /tutor/chat/.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /tutor/chat/.
backend/ai_engine/urls.py:67
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/ai/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/ai/.
backend/config/urls.py:38
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/billing/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/billing/.
backend/config/urls.py:37
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/billing/school/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/billing/school/.
backend/config/urls.py:36
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/notifications/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /api/notifications/.
backend/config/urls.py:39
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /artifacts/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /artifacts/.
backend/ai_engine/urls.py:24
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /exams/generate/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /exams/generate/.
backend/ai_engine/urls.py:37
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /grading/drafts/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /grading/drafts/.
backend/ai_engine/urls.py:26
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /grading/rubrics/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /grading/rubrics/.
backend/ai_engine/urls.py:25
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /quizzes/generate/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /quizzes/generate/.
backend/ai_engine/urls.py:38
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /readyz/.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /readyz/.
backend/core/urls.py:39
low Security checks quality Error handling conf 1.00 3 occurrences [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
3 files, 3 locations
backend/academic/views/erp.py:112
backend/ai_engine/services/collaborative_filter_service.py:181
backend/config/celery.py:81
medium Security checks software Open redirect conf 1.00 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.
Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …
frontend/components/command-palette.tsx:164
medium Security checks quality Quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).
Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.
backend/config/settings/local.py:6
medium Security checks software dependencies conf 0.88 axios: GHSA-3w6x-2g7m-8v23
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-445q-vr5w-6q77
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-5c9x-8gcm-mpgx
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-898c-q2cr-xwhg
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-fvcv-3m26-pcqx
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-m7pr-hjqh-92cm
Axios: no_proxy bypass via IP alias allows SSRF
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-vf2m-468p-8v99
Axios: HTTP adapter streamed responses bypass maxContentLength
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-w9j2-pvgh-6h63
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 axios: GHSA-xx6v-rp6x-q39c
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2
brace-expansion: Large numeric range defeats documented `max` DoS protection
mobile/package-lock.json
low Security checks quality Error handling conf 0.55 ✓ Repobility 25 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
8 files, 25 locations
backend/billing_school/views.py:476, 483, 488, 498, 582, 596, 600, 608, +5 more (13 hits)
backend/core/views.py:124, 131, 706 (3 hits)
backend/billing_school/views_reports.py:297, 528 (2 hits)
backend/core/async_jobs.py:22, 147 (2 hits)
backend/gamification/signals.py:28, 52 (2 hits)
backend/core/serializers.py:203
backend/core/vector.py:12
backend/gamification/badge_evaluator.py:35
Error handlingquality
medium Security checks quality Quality conf 0.76 Compliance or security claim is near a placeholder link
Production pages should not pair trust claims such as SOC 2, GDPR, ISO, biometric consent, or encryption with placeholder links.
frontend/components/auth/login-form.tsx:286
medium Security checks cicd CI/CD security conf 0.86 Database dump or local database file is included in Docker build context
Database exports and local database files can contain production data, credentials, or large binary payloads that slow Docker builds and can be copied into images by broad COPY instructions.
.dockerignore CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.90 Docker build context has no .dockerignore
Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts.
.dockerignore CI/CD securitycontainers
medium Security checks software dependencies conf 0.88 follow-redirects: GHSA-r4q5-vmmm-2653
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
mobile/package-lock.json
high Security checks quality Quality conf 0.74 14 occurrences Frontend API reference is not matched by discovered backend routes
A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys.
10 files, 14 locations
frontend/lib/api.ts:2223, 2224, 3938 (3 hits)
frontend/app/school/page.tsx:133, 161 (2 hits)
frontend/services/api.ts:11, 115 (2 hits)
frontend/app/admin/finance/accounting/page.tsx:18
frontend/app/api/auth/2fa-activate/route.ts:13
frontend/app/api/auth/login/route.ts:11
frontend/components/auth/saas-login-form.tsx:149
frontend/hooks/use-tenant-identity.ts:68
medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned
Action `codecov/codecov-action` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.
lines 138, 208, 236
.github/workflows/frontend-ci.yml:138, 208, 236 (3 hits)
CI/CD securitySupply chainGitHub Actions
medium Security checks software dependencies conf 0.88 idna: GHSA-65pc-fj4g-8rjx
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
requirements.txt
medium Security checks software dependencies conf 0.88 2 occurrences js-yaml: GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
2 files, 2 locations
frontend/package-lock.json
mobile/package-lock.json
high Security checks software dependencies conf 0.90 npm package `@react-native-async-storage/async-storage` is 1 major version(s) behind (2.2.0 -> 3.1.1)
`@react-native-async-storage/async-storage` is pinned/resolved at 2.2.0 but the latest stable release on the npm registry is 3.1.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot ve…
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `@react-native-community/netinfo` is 1 major version(s) behind (11.5.2 -> 12.0.1)
`@react-native-community/netinfo` is pinned/resolved at 11.5.2 but the latest stable release on the npm registry is 12.0.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-up…
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `expo-blur` is 1 major version(s) behind (55.0.8 -> 56.0.3)
`expo-blur` is pinned/resolved at 55.0.8 but the latest stable release on the npm registry is 56.0.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `expo-device` is 1 major version(s) behind (55.0.9 -> 56.0.4)
`expo-device` is pinned/resolved at 55.0.9 but the latest stable release on the npm registry is 56.0.4 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `expo-file-system` is 1 major version(s) behind (55.0.10 -> 56.0.8)
`expo-file-system` is pinned/resolved at 55.0.10 but the latest stable release on the npm registry is 56.0.8 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `expo-font` is 1 major version(s) behind (55.0.4 -> 56.0.7)
`expo-font` is pinned/resolved at 55.0.4 but the latest stable release on the npm registry is 56.0.7 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `expo-notifications` is 1 major version(s) behind (55.0.10 -> 56.0.18)
`expo-notifications` is pinned/resolved at 55.0.10 but the latest stable release on the npm registry is 56.0.18 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs ra…
mobile/package.json
high Security checks software dependencies conf 0.90 2 occurrences npm package `expo-secure-store` is 1 major version(s) behind (55.0.8 -> 56.0.4)
`expo-secure-store` is pinned/resolved at 55.0.8 but the latest stable release on the npm registry is 56.0.4 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
2 occurrences
mobile/package.json (2 hits)
high Security checks software dependencies conf 0.90 npm package `expo-sharing` is 1 major version(s) behind (55.0.11 -> 56.0.18)
`expo-sharing` is pinned/resolved at 55.0.11 but the latest stable release on the npm registry is 56.0.18 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `expo-status-bar` is 1 major version(s) behind (55.0.4 -> 56.0.4)
`expo-status-bar` is pinned/resolved at 55.0.4 but the latest stable release on the npm registry is 56.0.4 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `react-native-gesture-handler` is 1 major version(s) behind (2.30.0 -> 3.0.1)
`react-native-gesture-handler` is pinned/resolved at 2.30.0 but the latest stable release on the npm registry is 3.0.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update…
mobile/package.json
high Security checks quality Quality conf 0.82 Parallel implementation file sits beside a canonical file
AI-assisted edits often create a new sibling file instead of integrating the change into the existing module. That leaves two paths for future maintainers to understand and can hide the code that is actually wired into the app.
backend/scripts/create_library_tables_final.py:1
medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 pillow: GHSA-5xmw-vc9v-4wf2
Pillow has a heap buffer overflow with nested list coordinates
requirements.txt
medium Security checks software dependencies conf 0.88 pillow: GHSA-r73j-pqj5-w3x7
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
requirements.txt
medium Security checks software dependencies conf 0.88 2 occurrences postcss: GHSA-qx2v-qp2m-jg93
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
2 files, 2 locations
frontend/package-lock.json
mobile/package-lock.json
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.
.well-known/security.txt
medium Security checks software dependencies conf 0.88 pyjwt: GHSA-993g-76c3-p5m4
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
requirements.txt
medium Security checks software dependencies conf 0.88 2 occurrences pypdf: GHSA-248m-82v9-q6g6
pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
2 files, 2 locations
backend/requirements.txt
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-3crg-w4f6-42mx
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-4pxv-j86v-mhcw
pypdf: Possible long runtimes for wrong size values in incremental mode
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-7gw9-cf7v-778f
pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-87mj-5ggw-8qc3
pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-9m86-7pmv-2852
pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams
requirements.txt
medium Security checks software dependencies conf 0.88 2 occurrences pypdf: GHSA-cj93-chg6-vgv8
pypdf: Possible large memory usage for large offsets for layout mode text
2 files, 2 locations
backend/requirements.txt
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-hqmh-ppp3-xvm7
pypdf: manipulated stream length values can exhaust RAM
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-jj6c-8h6c-hppx
pypdf has long runtimes for wrong size values in cross-reference and object streams
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-qpxp-75px-xjcp
pypdf has inefficient decoding of array-based streams
requirements.txt
medium Security checks software dependencies conf 0.88 pypdf: GHSA-x284-j5p8-9c5p
pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
requirements.txt
medium Security checks software dependencies conf 0.90 Python package `django-redis` is 2 major version(s) behind (5.4.0 -> 7.0.0)
`django-redis==5.4.0` is 2 major version(s) behind the latest stable release on PyPI (7.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:22
medium Security checks software dependencies conf 0.90 Python package `Django` is 1 major version(s) behind (5.2.9 -> 6.0.6)
`Django==5.2.9` is 1 major version(s) behind the latest stable release on PyPI (6.0.6). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:16
medium Security checks software dependencies conf 0.90 Python package `gunicorn` is 3 major version(s) behind (23.0.0 -> 26.0.0)
`gunicorn==23.0.0` is 3 major version(s) behind the latest stable release on PyPI (26.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:29
medium Security checks software dependencies conf 0.90 Python package `psutil` is 1 major version(s) behind (6.1.0 -> 7.2.2)
`psutil==6.1.0` is 1 major version(s) behind the latest stable release on PyPI (7.2.2). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:53
medium Security checks software dependencies conf 0.88 python-dotenv: GHSA-mf9w-mj56-hr94
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
requirements.txt
medium Security checks software dependencies conf 0.88 quill: GHSA-4943-9vgg-gr5r
Cross-site Scripting in quill
frontend/package-lock.json
medium Security checks software dependencies conf 0.88 requests: GHSA-gc5v-m9x4-r6x2
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
requirements.txt
medium Security checks quality Quality conf 0.72 Service worker is present without a web app manifest
A service worker without a manifest often means the PWA install surface is incomplete or inconsistent across devices.
manifest.json
medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced
A file created as a fixed/new/final/copy variant is not referenced by imports or path-like strings in the rest of the repository. This is a strong sign that an agent produced code beside the active application path.
backend/scripts/verify_teacher_fix.py:1
medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced
A file created as a fixed/new/final/copy variant is not referenced by imports or path-like strings in the rest of the repository. This is a strong sign that an agent produced code beside the active application path.
backend/scripts/create_library_tables_final.py:1
medium Security checks software dependencies conf 0.88 uuid: GHSA-w5hq-g745-h8pq
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
mobile/package-lock.json
medium Security checks software dependencies conf 0.88 yaml: GHSA-48c2-rrv3-qjmp
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
mobile/package-lock.json
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — check_and_create_course.py:26
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
low Security checks software dependencies conf 0.88 2 occurrences @babel/core: GHSA-4x5r-pxfx-6jf8
@babel/core: Arbitrary File Read via sourceMappingURL Comment
2 files, 2 locations
frontend/package-lock.json
mobile/package-lock.json
low Security checks software Race condition conf 1.00 [SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason.
Use `os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)` for atomic create-only. Use `tempfile.NamedTemporaryFile()` (not `mktemp`). For locking, use `fcntl.flock`.
backend/scripts/check_demo_schema.py:8
low Security checks cicd CI/CD security conf 0.68 2 occurrences App service does not wait for database health
depends_on controls startup order, but without condition: service_healthy an app can start while the database is still initializing and fail intermittently.
lines 1, 24
docker-compose.yml:1, 24 (2 hits)
CI/CD securitycontainers
low Security checks software dependencies conf 0.88 axios: GHSA-xhjh-pmcv-23jw
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
mobile/package-lock.json
high Security checks cicd CI/CD security conf 0.56 3 occurrences Compose service does not declare a runtime user
If the image does not define USER internally, this service may run as root.
lines 1, 24, 46
docker-compose.yml:1, 24, 46 (3 hits)
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.62 3 occurrences Compose service lacks no-new-privileges hardening
no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.
lines 1, 24, 46
docker-compose.yml:1, 24, 46 (3 hits)
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.72 Database service has no healthcheck
Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy.
docker-compose.yml:71 CI/CD securitycontainers
low Security checks software dependencies conf 0.88 django: GHSA-mjgh-79qc-68w3
Django has a Race Condition vulnerability
requirements.txt
high Security checks cicd CI/CD security conf 0.72 2 occurrences Dockerfile keeps pip download cache
Pip's package cache increases image size and can preserve unnecessary artifacts.
lines 27, 60
backend/Dockerfile:27, 60 (2 hits)
CI/CD securitycontainers
low Security checks quality Quality conf 0.64 Duplicate top-level symbol appears in a patch-style file
A generated replacement file defining the same public function or class name as another module can mean the new logic is not actually wired into the running code.
backend/scripts/verify_teacher_fix.py:1
low Security checks quality Quality conf 0.60 30 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
12 files, 20 locations
backend/scripts/fix_library_migration.py:42, 59, 60 (3 hits)
backend/academic/tests_exam_rbac.py:19, 21 (2 hits)
backend/academic/views/question.py:64, 73 (2 hits)
backend/ai_engine/services/exam_generator_service.py:12, 21 (2 hits)
backend/ai_engine/services/quiz_generator_service.py:17, 25 (2 hits)
backend/scripts/create_tables_v3.py:24, 81 (2 hits)
backend/scripts/create_via_django.py:13, 17 (2 hits)
backend/academic/tests_attendance_rbac.py:51
duplicationquality
low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 21 occurrences GitHub Action is tag-pinned rather than SHA-pinned
Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.
2 files, 21 locations
.github/workflows/frontend-ci.yml:21, 24, 40, 43, 48, 76, 79, 84, +10 more (18 hits)
.github/workflows/playwright.yml:27, 28, 37 (3 hits)
CI/CD securitySupply chainGitHub Actions
high Security checks software dependencies conf 0.90 npm package `@hookform/resolvers` is minor version(s) behind (5.2.2 -> 5.4.0)
`@hookform/resolvers` is pinned/resolved at 5.2.2 but the latest stable release on the npm registry is 5.4.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
frontend/package.json
high Security checks software dependencies conf 0.90 npm package `@radix-ui/react-avatar` is minor version(s) behind (1.1.11 -> 1.2.0)
`@radix-ui/react-avatar` is pinned/resolved at 1.1.11 but the latest stable release on the npm registry is 1.2.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rai…
frontend/package.json
high Security checks software dependencies conf 0.90 npm package `@react-navigation/bottom-tabs` is minor version(s) behind (7.15.2 -> 7.18.2)
`@react-navigation/bottom-tabs` is pinned/resolved at 7.15.2 but the latest stable release on the npm registry is 7.18.2 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update…
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `@react-navigation/native-stack` is minor version(s) behind (7.14.2 -> 7.17.5)
`@react-navigation/native-stack` is pinned/resolved at 7.14.2 but the latest stable release on the npm registry is 7.17.5 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-updat…
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `@react-navigation/native` is minor version(s) behind (7.1.31 -> 7.3.3)
`@react-navigation/native` is pinned/resolved at 7.1.31 but the latest stable release on the npm registry is 7.3.3 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs r…
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `axios` is minor version(s) behind (1.13.5 -> 1.18.0)
`axios` is pinned/resolved at 1.13.5 but the latest stable release on the npm registry is 1.18.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
high Security checks software dependencies conf 0.90 npm package `react-native-safe-area-context` is minor version(s) behind (5.6.2 -> 5.8.0)
`react-native-safe-area-context` is pinned/resolved at 5.6.2 but the latest stable release on the npm registry is 5.8.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update …
mobile/package.json
low Security checks quality Quality conf 0.64 Public docs site has no llms.txt
AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.
llms.txt
low Security checks quality Quality conf 0.50 Public web app has no humans.txt
humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.
humans.txt
low Security checks quality Quality conf 0.74 Public web app has no robots.txt
Public websites should publish a robots.txt file so crawlers and AI agents can discover crawl rules and sitemap locations without guessing.
robots.txt
low Security checks quality Quality conf 0.72 Public web app has no sitemap
A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.
sitemap.xml
low Security checks software dependencies conf 0.88 pygments: GHSA-5239-wwwm-4pmq
Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
requirements.txt
low Security checks software dependencies conf 0.90 Python package `anyio` is minor version(s) behind (4.12.1 -> 4.14.0)
`anyio==4.12.1` is minor version(s) behind the latest stable release on PyPI (4.14.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:2
low Security checks software dependencies conf 0.90 Python package `beautifulsoup4` is minor version(s) behind (4.14.3 -> 4.15.0)
`beautifulsoup4==4.14.3` is minor version(s) behind the latest stable release on PyPI (4.15.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:6
low Security checks software dependencies conf 0.90 Python package `certifi` is minor version(s) behind (2026.2.25 -> 2026.5.20)
`certifi==2026.2.25` is minor version(s) behind the latest stable release on PyPI (2026.5.20). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:7
low Security checks software dependencies conf 0.90 Python package `dj-database-url` is minor version(s) behind (3.0.1 -> 3.1.2)
`dj-database-url==3.0.1` is minor version(s) behind the latest stable release on PyPI (3.1.2). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:15
low Security checks software dependencies conf 0.90 Python package `django-tenants` is minor version(s) behind (3.9.0 -> 3.10.1)
`django-tenants==3.9.0` is minor version(s) behind the latest stable release on PyPI (3.10.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:23
low Security checks software dependencies conf 0.90 Python package `djangorestframework` is minor version(s) behind (3.16.1 -> 3.17.1)
`djangorestframework==3.16.1` is minor version(s) behind the latest stable release on PyPI (3.17.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:24
low Security checks software dependencies conf 0.90 Python package `idna` is minor version(s) behind (3.11 -> 3.18)
`idna==3.11` is minor version(s) behind the latest stable release on PyPI (3.18). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:34
low Security checks software dependencies conf 0.90 Python package `jiter` is minor version(s) behind (0.13.0 -> 0.15.0)
`jiter==0.13.0` is minor version(s) behind the latest stable release on PyPI (0.15.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:35
low Security checks software dependencies conf 0.90 Python package `kiwisolver` is minor version(s) behind (1.4.9 -> 1.5.0)
`kiwisolver==1.4.9` is minor version(s) behind the latest stable release on PyPI (1.5.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:36
low Security checks software dependencies conf 0.90 Python package `linkify-it-py` is minor version(s) behind (2.0.3 -> 2.1.0)
`linkify-it-py==2.0.3` is minor version(s) behind the latest stable release on PyPI (2.1.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:37
low Security checks software dependencies conf 0.90 Python package `markdown-it-py` is minor version(s) behind (4.0.0 -> 4.2.0)
`markdown-it-py==4.0.0` is minor version(s) behind the latest stable release on PyPI (4.2.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:39
low Security checks software dependencies conf 0.90 Python package `mdit-py-plugins` is minor version(s) behind (0.5.0 -> 0.6.1)
`mdit-py-plugins==0.5.0` is minor version(s) behind the latest stable release on PyPI (0.6.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:41
low Security checks software dependencies conf 0.90 Python package `openai` is minor version(s) behind (2.24.0 -> 2.41.1)
`openai==2.24.0` is minor version(s) behind the latest stable release on PyPI (2.41.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:45
low Security checks software dependencies conf 0.90 Python package `packaging` is minor version(s) behind (26.0 -> 26.2)
`packaging==26.0` is minor version(s) behind the latest stable release on PyPI (26.2). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:48
low Security checks software dependencies conf 0.90 Python package `platformdirs` is minor version(s) behind (4.9.2 -> 4.10.0)
`platformdirs==4.9.2` is minor version(s) behind the latest stable release on PyPI (4.10.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:51
low Security checks software dependencies conf 0.90 Python package `prometheus_client` is minor version(s) behind (0.21.0 -> 0.25.0)
`prometheus_client==0.21.0` is minor version(s) behind the latest stable release on PyPI (0.25.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
requirements.txt:52
high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact
Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area.
backend/scripts/verify_teacher_fix.py:1
high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact
Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area.
backend/scripts/verify_backup.py:1
low Security checks cicd CI/CD security conf 0.35 ✓ Repobility 23 occurrences Workflow references repository secrets in a pull_request workflow
Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.
2 files, 23 locations
.github/workflows/frontend-ci.yml:172, 194, 210, 211, 212, 238, 239, 240, +4 more (12 hits)
.github/workflows/backend-ci.yml:182, 183, 191, 192, 193, 194, 218, 228, +3 more (11 hits)
CI/CD securityworkflow secretsGitHub Actions
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 10 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Tests conf 1.00 Low test-to-source ratio
1 tests / 5 src (ratio 0.20).
high Security checks software dependencies conf 0.90 npm package `@radix-ui/react-accordion` is patch version(s) behind (1.2.12 -> 1.2.14)
`@radix-ui/react-accordion` is pinned/resolved at 1.2.12 but the latest stable release on the npm registry is 1.2.14 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs…
frontend/package.json
high Security checks software dependencies conf 0.90 2 occurrences npm package `@radix-ui/react-dialog` is patch version(s) behind (1.1.15 -> 1.1.17)
`@radix-ui/react-dialog` is pinned/resolved at 1.1.15 but the latest stable release on the npm registry is 1.1.17 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs ra…
2 occurrences
frontend/package.json (2 hits)
high Security checks software dependencies conf 0.90 npm package `@radix-ui/react-dropdown-menu` is patch version(s) behind (2.1.16 -> 2.1.18)
`@radix-ui/react-dropdown-menu` is pinned/resolved at 2.1.16 but the latest stable release on the npm registry is 2.1.18 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update…
frontend/package.json
high Security checks software dependencies conf 0.90 npm package `dotenv` is patch version(s) behind (17.4.1 -> 17.4.2)
`dotenv` is pinned/resolved at 17.4.1 but the latest stable release on the npm registry is 17.4.2 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `zustand` is patch version(s) behind (5.0.11 -> 5.0.14)
`zustand` is pinned/resolved at 5.0.11 but the latest stable release on the npm registry is 5.0.14 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
mobile/package.json
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/20da0a1c-4516-4610-b858-854a2f468893/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/20da0a1c-4516-4610-b858-854a2f468893/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.