← Back to scan
File as GitHub Issue repo: dragneel07-psm/E-LearningWebApp

Push this scan report to dragneel07-psm/E-LearningWebApp

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

AI scaffold leftover — Lorem ipsum / example.com / John Doe in code

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… frontend/components/command-palette.tsx:164
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/app/admin/finance/reports/cash…:68
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/app/admin/finance/reports/bank…:70
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/app/admin/finance/reports/agin…:84
MED SEC134 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum… backend/scripts/verify_models.py:67
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … backend/scripts/seed_saas_data.py:87
MED SEC042 [SEC042] SQL identifier injection via f-string in cursor execute: f-string SQL normalizes… backend/scripts/create_library_tables_s…:80
MED SEC042 [SEC042] SQL identifier injection via f-string in cursor execute: f-string SQL normalizes… backend/scripts/create_library_tables_f…:121
MED SEC042 [SEC042] SQL identifier injection via f-string in cursor execute: f-string SQL normalizes… backend/scripts/create_library_tables.py:77
MED SEC123 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production … backend/core/tests_tenant_security.py:33
MED SEC123 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production … backend/config/settings/local.py:6
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/core/reports.py:14
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/ai_engine/services/lesson_summa…:93
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/config/celery.py:81
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/ai_engine/services/collaborativ…:181
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/academic/views/erp.py:112
MED MINED111 Bare except continues silently backend/billing_school/views_reports.py:297
MED MINED111 Bare except continues silently backend/billing_school/views_reports.py:528
MED MINED111 Bare except continues silently backend/billing_school/views.py:614
MED MINED111 Bare except continues silently backend/billing_school/views.py:948
MED MINED111 Bare except continues silently backend/billing_school/views.py:608
MED MINED111 Bare except continues silently backend/billing_school/views.py:600
MED MINED111 Bare except continues silently backend/billing_school/views.py:596
MED MINED111 Bare except continues silently backend/billing_school/views.py:498
MED MINED111 Bare except continues silently backend/billing_school/views.py:977
MED MINED111 Bare except continues silently backend/billing_school/views.py:971
MED MINED111 Bare except continues silently backend/billing_school/views.py:963
MED MINED111 Bare except continues silently backend/billing_school/views.py:582
MED MINED111 Bare except continues silently backend/billing_school/views.py:488
MED MINED111 Bare except continues silently backend/billing_school/views.py:483
MED MINED111 Bare except continues silently backend/billing_school/views.py:476
MED MINED111 Bare except continues silently backend/gamification/badge_evaluator.py:35
MED MINED111 Bare except continues silently backend/gamification/signals.py:52
MED MINED111 Bare except continues silently backend/gamification/signals.py:28
MED MINED111 Bare except continues silently backend/core/vector.py:12
MED MINED111 Bare except continues silently backend/core/views.py:706
MED MINED111 Bare except continues silently backend/core/views.py:131
MED MINED111 Bare except continues silently backend/core/views.py:124
MED MINED111 Bare except continues silently backend/core/serializers.py:203
MED MINED111 Bare except continues silently backend/core/async_jobs.py:147
MED MINED111 Bare except continues silently backend/core/async_jobs.py:22
MED COMP001 [COMP001] High cognitive complexity: Function `handle` has cognitive complexity 22 (Sonar… backend/academic/management/commands/se…:65
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DEPCUR-NPM npm package `react-native-gesture-handler` is 1 major version(s) behind (2.30.0 -> 3.0.1) mobile/package.json
MED DEPCUR-NPM npm package `expo-status-bar` is 1 major version(s) behind (55.0.4 -> 56.0.4) mobile/package.json
MED DEPCUR-NPM npm package `expo-sharing` is 1 major version(s) behind (55.0.11 -> 56.0.18) mobile/package.json
MED DEPCUR-NPM npm package `expo-secure-store` is 1 major version(s) behind (55.0.8 -> 56.0.4) mobile/package.json
MED DEPCUR-NPM npm package `expo-notifications` is 1 major version(s) behind (55.0.10 -> 56.0.18) mobile/package.json
MED DEPCUR-NPM npm package `expo-linear-gradient` is 1 major version(s) behind (55.0.8 -> 56.0.4) mobile/package.json
MED DEPCUR-NPM npm package `expo-font` is 1 major version(s) behind (55.0.4 -> 56.0.7) mobile/package.json
MED DEPCUR-NPM npm package `expo-file-system` is 1 major version(s) behind (55.0.10 -> 56.0.8) mobile/package.json
MED DEPCUR-NPM npm package `expo-device` is 1 major version(s) behind (55.0.9 -> 56.0.4) mobile/package.json
MED DEPCUR-NPM npm package `expo-blur` is 1 major version(s) behind (55.0.8 -> 56.0.3) mobile/package.json
MED DEPCUR-NPM npm package `@react-native-community/netinfo` is 1 major version(s) behind (11.5.2 -> 12.… mobile/package.json
MED DEPCUR-NPM npm package `@react-native-async-storage/async-storage` is 1 major version(s) behind (2.2… mobile/package.json
MED DEPCUR-PY Python package `psutil` is 1 major version(s) behind (6.1.0 -> 7.2.2) requirements.txt:53
MED DEPCUR-PY Python package `gunicorn` is 3 major version(s) behind (23.0.0 -> 26.0.0) requirements.txt:29
MED DEPCUR-PY Python package `django-redis` is 2 major version(s) behind (5.4.0 -> 7.0.0) requirements.txt:22
MED DEPCUR-PY Python package `Django` is 1 major version(s) behind (5.2.9 -> 6.0.6) requirements.txt:16
MED MINED115 Action `amondnet/vercel-action` pinned to mutable ref `@v25` .github/workflows/frontend-ci.yml:236
MED MINED115 Action `amondnet/vercel-action` pinned to mutable ref `@v25` .github/workflows/frontend-ci.yml:208
MED MINED115 Action `codecov/codecov-action` pinned to mutable ref `@v4` .github/workflows/frontend-ci.yml:138
MED GHSA-gc5v-m9x4-r6x2 requests: GHSA-gc5v-m9x4-r6x2 requirements.txt
MED GHSA-mf9w-mj56-hr94 python-dotenv: GHSA-mf9w-mj56-hr94 requirements.txt
MED GHSA-x284-j5p8-9c5p pypdf: GHSA-x284-j5p8-9c5p requirements.txt
MED GHSA-qpxp-75px-xjcp pypdf: GHSA-qpxp-75px-xjcp requirements.txt
MED GHSA-jj6c-8h6c-hppx pypdf: GHSA-jj6c-8h6c-hppx requirements.txt
MED GHSA-hqmh-ppp3-xvm7 pypdf: GHSA-hqmh-ppp3-xvm7 requirements.txt
MED GHSA-cj93-chg6-vgv8 pypdf: GHSA-cj93-chg6-vgv8 requirements.txt
MED GHSA-9m86-7pmv-2852 pypdf: GHSA-9m86-7pmv-2852 requirements.txt
MED GHSA-87mj-5ggw-8qc3 pypdf: GHSA-87mj-5ggw-8qc3 requirements.txt
MED GHSA-7gw9-cf7v-778f pypdf: GHSA-7gw9-cf7v-778f requirements.txt
MED GHSA-4pxv-j86v-mhcw pypdf: GHSA-4pxv-j86v-mhcw requirements.txt
MED GHSA-3crg-w4f6-42mx pypdf: GHSA-3crg-w4f6-42mx requirements.txt
MED GHSA-248m-82v9-q6g6 pypdf: GHSA-248m-82v9-q6g6 requirements.txt
MED GHSA-r73j-pqj5-w3x7 pillow: GHSA-r73j-pqj5-w3x7 requirements.txt
MED GHSA-5xmw-vc9v-4wf2 pillow: GHSA-5xmw-vc9v-4wf2 requirements.txt
MED GHSA-65pc-fj4g-8rjx idna: GHSA-65pc-fj4g-8rjx requirements.txt
MED GHSA-993g-76c3-p5m4 pyjwt: GHSA-993g-76c3-p5m4 requirements.txt
MED GHSA-48c2-rrv3-qjmp yaml: GHSA-48c2-rrv3-qjmp mobile/package-lock.json
MED GHSA-58qx-3vcg-4xpx ws: GHSA-58qx-3vcg-4xpx mobile/package-lock.json
MED GHSA-w5hq-g745-h8pq uuid: GHSA-w5hq-g745-h8pq mobile/package-lock.json
MED GHSA-qx2v-qp2m-jg93 postcss: GHSA-qx2v-qp2m-jg93 mobile/package-lock.json
MED GHSA-3v7f-55p6-f55p picomatch: GHSA-3v7f-55p6-f55p mobile/package-lock.json
MED GHSA-h67p-54hq-rp68 js-yaml: GHSA-h67p-54hq-rp68 mobile/package-lock.json
MED GHSA-r4q5-vmmm-2653 follow-redirects: GHSA-r4q5-vmmm-2653 mobile/package-lock.json
MED GHSA-jxxr-4gwj-5jf2 brace-expansion: GHSA-jxxr-4gwj-5jf2 mobile/package-lock.json
MED GHSA-f886-m6hf-6m8v brace-expansion: GHSA-f886-m6hf-6m8v mobile/package-lock.json
MED GHSA-xx6v-rp6x-q39c axios: GHSA-xx6v-rp6x-q39c mobile/package-lock.json
MED GHSA-w9j2-pvgh-6h63 axios: GHSA-w9j2-pvgh-6h63 mobile/package-lock.json
MED GHSA-vf2m-468p-8v99 axios: GHSA-vf2m-468p-8v99 mobile/package-lock.json
MED GHSA-m7pr-hjqh-92cm axios: GHSA-m7pr-hjqh-92cm mobile/package-lock.json
MED GHSA-fvcv-3m26-pcqx axios: GHSA-fvcv-3m26-pcqx mobile/package-lock.json
MED GHSA-898c-q2cr-xwhg axios: GHSA-898c-q2cr-xwhg mobile/package-lock.json
MED GHSA-62hf-57xw-28j9 axios: GHSA-62hf-57xw-28j9 mobile/package-lock.json
MED GHSA-5c9x-8gcm-mpgx axios: GHSA-5c9x-8gcm-mpgx mobile/package-lock.json
MED GHSA-445q-vr5w-6q77 axios: GHSA-445q-vr5w-6q77 mobile/package-lock.json
MED GHSA-3w6x-2g7m-8v23 axios: GHSA-3w6x-2g7m-8v23 mobile/package-lock.json
MED GHSA-4943-9vgg-gr5r quill: GHSA-4943-9vgg-gr5r frontend/package-lock.json
MED GHSA-qx2v-qp2m-jg93 postcss: GHSA-qx2v-qp2m-jg93 frontend/package-lock.json
MED GHSA-h67p-54hq-rp68 js-yaml: GHSA-h67p-54hq-rp68 frontend/package-lock.json
MED GHSA-8988-4f7v-96qf @opentelemetry/core: GHSA-8988-4f7v-96qf frontend/package-lock.json
MED GHSA-cj93-chg6-vgv8 pypdf: GHSA-cj93-chg6-vgv8 backend/requirements.txt
MED GHSA-248m-82v9-q6g6 pypdf: GHSA-248m-82v9-q6g6 backend/requirements.txt
MED DKR018 Database dump or local database file is included in Docker build context .dockerignore
MED AIC001 Parallel implementation file sits beside a canonical file backend/scripts/create_library_tables_f…:1
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED AIC004 Suspicious implementation file appears unreferenced backend/scripts/verify_teacher_fix.py:1
MED AIC004 Suspicious implementation file appears unreferenced backend/scripts/create_library_tables_f…:1
MED JRN005 Compliance or security claim is near a placeholder link frontend/components/auth/login-form.tsx:286
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/services/api.ts:115
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/services/api.ts:11
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/public/sw.js:238
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/lib/ws-ticket.ts:27
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/lib/api.ts:3938
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/lib/api.ts:2224
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/lib/api.ts:2223
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/hooks/use-tenant-identity.ts:68
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/components/auth/saas-login-for…:149
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/app/school/page.tsx:161
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/app/school/page.tsx:133
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/app/api/auth/login/route.ts:11
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/app/api/auth/2fa-activate/rout…:13
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/app/admin/finance/accounting/p…:18
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 32.9% of discovered … —
MED WEB012 Service worker is present without a web app manifest manifest.json
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/config/urls.py:39
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/config/urls.py:38
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/config/urls.py:37
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/config/urls.py:36
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/ai_engine/urls.py:38
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/ai_engine/urls.py:37
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/ai_engine/urls.py:26
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/ai_engine/urls.py:25
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/ai_engine/urls.py:24
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/core/urls.py:39
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/ai_engine/urls.py:68
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/ai_engine/urls.py:67
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/ai_engine/urls.py:61
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/ai_engine/urls.py:60
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/ai_engine/urls.py:59
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/core/urls.py:47
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/core/urls.py:46
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/core/urls.py:45
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/core/urls.py:44
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/core/urls.py:43
LOW SEC124 [SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/ex… backend/scripts/check_demo_schema.py:8
LOW COMP001 [COMP001] High cognitive complexity: Function `get_progress_percentage` has cognitive com… backend/academic/serializers/academic.py:69
LOW DEPCUR-NPM npm package `@radix-ui/react-avatar` is minor version(s) behind (1.1.11 -> 1.2.0) frontend/package.json
LOW DEPCUR-NPM npm package `@hookform/resolvers` is minor version(s) behind (5.2.2 -> 5.4.0) frontend/package.json
LOW DEPCUR-NPM npm package `react-native-safe-area-context` is minor version(s) behind (5.6.2 -> 5.8.0) mobile/package.json
LOW DEPCUR-NPM npm package `axios` is minor version(s) behind (1.13.5 -> 1.18.0) mobile/package.json
LOW DEPCUR-NPM npm package `@react-navigation/native-stack` is minor version(s) behind (7.14.2 -> 7.17.5) mobile/package.json
LOW DEPCUR-NPM npm package `@react-navigation/native` is minor version(s) behind (7.1.31 -> 7.3.3) mobile/package.json
LOW DEPCUR-NPM npm package `@react-navigation/bottom-tabs` is minor version(s) behind (7.15.2 -> 7.18.2) mobile/package.json
LOW DEPCUR-PY Python package `prometheus_client` is minor version(s) behind (0.21.0 -> 0.25.0) requirements.txt:52
LOW DEPCUR-PY Python package `platformdirs` is minor version(s) behind (4.9.2 -> 4.10.0) requirements.txt:51
LOW DEPCUR-PY Python package `packaging` is minor version(s) behind (26.0 -> 26.2) requirements.txt:48
LOW DEPCUR-PY Python package `openai` is minor version(s) behind (2.24.0 -> 2.41.1) requirements.txt:45
LOW DEPCUR-PY Python package `mdit-py-plugins` is minor version(s) behind (0.5.0 -> 0.6.1) requirements.txt:41
LOW DEPCUR-PY Python package `markdown-it-py` is minor version(s) behind (4.0.0 -> 4.2.0) requirements.txt:39
LOW DEPCUR-PY Python package `linkify-it-py` is minor version(s) behind (2.0.3 -> 2.1.0) requirements.txt:37
LOW DEPCUR-PY Python package `kiwisolver` is minor version(s) behind (1.4.9 -> 1.5.0) requirements.txt:36
LOW DEPCUR-PY Python package `jiter` is minor version(s) behind (0.13.0 -> 0.15.0) requirements.txt:35
LOW DEPCUR-PY Python package `idna` is minor version(s) behind (3.11 -> 3.18) requirements.txt:34
LOW DEPCUR-PY Python package `djangorestframework` is minor version(s) behind (3.16.1 -> 3.17.1) requirements.txt:24
LOW DEPCUR-PY Python package `django-tenants` is minor version(s) behind (3.9.0 -> 3.10.1) requirements.txt:23
LOW DEPCUR-PY Python package `dj-database-url` is minor version(s) behind (3.0.1 -> 3.1.2) requirements.txt:15
LOW DEPCUR-PY Python package `certifi` is minor version(s) behind (2026.2.25 -> 2026.5.20) requirements.txt:7
LOW DEPCUR-PY Python package `beautifulsoup4` is minor version(s) behind (4.14.3 -> 4.15.0) requirements.txt:6
LOW DEPCUR-PY Python package `anyio` is minor version(s) behind (4.12.1 -> 4.14.0) requirements.txt:2
LOW MINED116 Workflow references `secrets.SLACK_WEBHOOK` in a `pull_request` workflow .github/workflows/backend-ci.yml:273
LOW MINED116 Workflow references `secrets.DIGITALOCEAN_ACCESS_TOKEN` in a `pull_request` workflow .github/workflows/backend-ci.yml:265
LOW MINED116 Workflow references `secrets.PRODUCTION_DATABASE_URL` in a `pull_request` workflow .github/workflows/backend-ci.yml:255
LOW MINED116 Workflow references `secrets.DIGITALOCEAN_ACCESS_TOKEN` in a `pull_request` workflow .github/workflows/backend-ci.yml:228
LOW MINED116 Workflow references `secrets.STAGING_DATABASE_URL` in a `pull_request` workflow .github/workflows/backend-ci.yml:218
LOW MINED116 Workflow references `secrets.DOCKER_USERNAME` in a `pull_request` workflow .github/workflows/backend-ci.yml:194
LOW MINED116 Workflow references `secrets.DOCKER_USERNAME` in a `pull_request` workflow .github/workflows/backend-ci.yml:193
LOW MINED116 Workflow references `secrets.DOCKER_USERNAME` in a `pull_request` workflow .github/workflows/backend-ci.yml:192
LOW GHSA-5239-wwwm-4pmq pygments: GHSA-5239-wwwm-4pmq requirements.txt
LOW GHSA-mjgh-79qc-68w3 django: GHSA-mjgh-79qc-68w3 requirements.txt
LOW GHSA-xhjh-pmcv-23jw axios: GHSA-xhjh-pmcv-23jw mobile/package-lock.json
LOW GHSA-4x5r-pxfx-6jf8 @babel/core: GHSA-4x5r-pxfx-6jf8 mobile/package-lock.json
LOW GHSA-4x5r-pxfx-6jf8 @babel/core: GHSA-4x5r-pxfx-6jf8 frontend/package-lock.json
LOW WEB001 Public web app has no robots.txt robots.txt
LOW WEB002 Public web app has no sitemap sitemap.xml
LOW DKC015 Database service has no healthcheck docker-compose.yml:71
LOW DKR012 Dockerfile keeps pip download cache backend/Dockerfile:60
LOW DKR012 Dockerfile keeps pip download cache backend/Dockerfile:27
LOW DKC016 App service does not wait for database health docker-compose.yml:24
LOW DKC016 App service does not wait for database health docker-compose.yml:1
LOW WEB008 Public docs site has no llms.txt llms.txt
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:46
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:24
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:46
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:24
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1
LOW WEB011 Public web app has no humans.txt humans.txt
Reset to top 5 200 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `dragneel07-psm/E-LearningWebApp`

**Score: 61/100 (D)**  ·  492 findings  ·  scanned 2026-06-16 04:23 UTC  ·  194,880 LOC

| Severity | Count |
|---|---|
| CRITICAL | 21 |
| HIGH | 148 |
| MEDIUM | 147 |
| LOW | 122 |

📊 [Full filterable report](https://repobility.com/scan/20da0a1c-4516-4610-b858-854a2f468893/)  ·  ![scorecard](https://repobility.com/scan/20da0a1c-4516-4610-b858-854a2f468893/report.png?v=1781583795-s2)

### Top findings

1. **MEDIUM** `SEC046` — Client-side open redirect — window.location = server-supplied URL
   `frontend/components/command-palette.tsx:164` · CWE-601 · A01:2021 Broken Access Control (open redirect)
2. **MEDIUM** `SEC041` — Tabnabbing — target="_blank" without rel="noopener noreferrer"
   `frontend/app/admin/finance/reports/cash-book/page.tsx:68` · A05:2021 Security Misconfiguration
3. **MEDIUM** `SEC041` — Tabnabbing — target="_blank" without rel="noopener noreferrer"
   `frontend/app/admin/finance/reports/bank-book/page.tsx:70` · A05:2021 Security Misconfiguration
4. **MEDIUM** `SEC041` — Tabnabbing — target="_blank" without rel="noopener noreferrer"
   `frontend/app/admin/finance/reports/aging/page.tsx:84` · A05:2021 Security Misconfiguration
5. **MEDIUM** `SEC134` — AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
   `backend/scripts/verify_models.py:67`

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/20da0a1c-4516-4610-b858-854a2f468893/_
Megaproject â high spam risk
Could not determine 'dragneel07-psm/E-LearningWebApp' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.