← Back to scan
File as GitHub Issue repo: Maher-Amara/Fail2BanEntreprise

Push this scan report to Maher-Amara/Fail2BanEntreprise

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Detected a Generic API Key, potentially exposing access to various services and sensitive

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… .env.example:28
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… .env.example:16
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… .env.example:12
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… .env.example:11
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… .env.example:7
HIGH DKR014 Dockerfile copies the entire context without .dockerignore web/Dockerfile:22
HIGH MINED118 Dockerfile FROM `node:trixie` not pinned by digest web/Dockerfile:30
HIGH MINED118 Dockerfile FROM `node:trixie` not pinned by digest web/Dockerfile:1
HIGH GHSA-c2c7-rcm5-vvqj picomatch: GHSA-c2c7-rcm5-vvqj web/package-lock.json
HIGH GHSA-q4gf-8mx6-v5v3 next: GHSA-q4gf-8mx6-v5v3 web/package-lock.json
HIGH GHSA-mg66-mrh9-m8jx next: GHSA-mg66-mrh9-m8jx web/package-lock.json
HIGH GHSA-c4j6-fc7j-m34r next: GHSA-c4j6-fc7j-m34r web/package-lock.json
HIGH GHSA-8h8q-6873-q5fj next: GHSA-8h8q-6873-q5fj web/package-lock.json
HIGH GHSA-492v-c6pp-mqqv next: GHSA-492v-c6pp-mqqv web/package-lock.json
HIGH GHSA-36qx-fr4f-26g5 next: GHSA-36qx-fr4f-26g5 web/package-lock.json
HIGH GHSA-26hh-7cqf-hhc6 next: GHSA-26hh-7cqf-hhc6 web/package-lock.json
HIGH GHSA-267c-6grr-h53f next: GHSA-267c-6grr-h53f web/package-lock.json
HIGH JRN009 Secret-like setting is echoed into a password input value web/app/setup/page.tsx:108
HIGH JRN009 Secret-like setting is echoed into a password input value web/app/login/page.tsx:84
HIGH JRN009 Secret-like setting is echoed into a password input value web/app/invite/[token]/page.tsx:79
HIGH CORE_NO_TESTS No test files found —
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. web/app/login/page.tsx:18
MED DKR003 Compose service `cloudflared` image uses the latest tag docker-compose.yml:41
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DEPCUR-NPM npm package `@types/bcryptjs` is 1 major version(s) behind (2.4.6 -> 3.0.0) web/package.json
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED GHSA-qx2v-qp2m-jg93 postcss: GHSA-qx2v-qp2m-jg93 web/package-lock.json
MED GHSA-3v7f-55p6-f55p picomatch: GHSA-3v7f-55p6-f55p web/package-lock.json
MED GHSA-wfc6-r584-vfw7 next: GHSA-wfc6-r584-vfw7 web/package-lock.json
MED GHSA-h64f-5h5j-jqjh next: GHSA-h64f-5h5j-jqjh web/package-lock.json
MED GHSA-gx5p-jg67-6x7h next: GHSA-gx5p-jg67-6x7h web/package-lock.json
MED GHSA-ffhc-5mcf-pf4q next: GHSA-ffhc-5mcf-pf4q web/package-lock.json
MED GHSA-jxxr-4gwj-5jf2 brace-expansion: GHSA-jxxr-4gwj-5jf2 web/package-lock.json
MED GHSA-f886-m6hf-6m8v brace-expansion: GHSA-f886-m6hf-6m8v web/package-lock.json
MED DKR018 Database dump or local database file is included in Docker build context .dockerignore
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/servers/page.tsx:53
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/servers/page.tsx:39
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/servers/page.tsx:33
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/servers/page.tsx:26
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/profile/page.tsx:18
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:231
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:226
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:220
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:211
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:205
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:199
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:194
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/page.tsx:187
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/invite/[token]/page.tsx:32
MED JRN003 Frontend API reference is not matched by discovered backend routes web/app/invite/[token]/page.tsx:18
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/dashboard/route.ts:4
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/intel/route.ts:6
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/servers/route.ts:32
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/servers/route.ts:13
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/me/route.ts:4
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/whitelist/route.ts:25
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/whitelist/route.ts:11
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/unban-me/route.ts:24
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … web/app/api/unban-me/route.ts:5
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… web/app/api/unban/route.ts:8
MED CORE_NO_CI No CI/CD configuration found —
LOW DEPCUR-NPM npm package `ioredis` is minor version(s) behind (5.10.1 -> 5.11.0) web/package.json
LOW DEPCUR-NPM npm package `better-sqlite3` is minor version(s) behind (12.8.0 -> 12.10.0) web/package.json
LOW GHSA-vfv6-92ff-j949 next: GHSA-vfv6-92ff-j949 web/package-lock.json
LOW GHSA-3g8h-86w9-wvmq next: GHSA-3g8h-86w9-wvmq web/package-lock.json
LOW AIC003 Duplicated implementation block across source files web/app/setup/page.tsx:75
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:13
LOW CORE_NO_LICENSE No LICENSE file —
INFO DEPCUR-NPM npm package `maxmind` is patch version(s) behind (5.0.5 -> 5.0.6) web/package.json
INFO DEPCUR-NPM npm package `jose` is patch version(s) behind (6.2.2 -> 6.2.3) web/package.json
Reset to top 5 71 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `Maher-Amara/Fail2BanEntreprise`

**Score: 61/100 (F)**  ·  71 findings  ·  scanned 2026-06-04 04:06 UTC  ·  3,690 LOC

| Severity | Count |
|---|---|
| CRITICAL | 5 |
| HIGH | 16 |
| MEDIUM | 40 |
| LOW | 8 |

📊 [Full filterable report](https://repobility.com/scan/22571c91-55ad-4884-818b-d252be90b564/)  ·  ![scorecard](https://repobility.com/scan/22571c91-55ad-4884-818b-d252be90b564/report.png?v=1780545961-s2)

### Top findings

1. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `.env.example:28`
2. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `.env.example:16`
3. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `.env.example:12`
4. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `.env.example:11`
5. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `.env.example:7`

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/22571c91-55ad-4884-818b-d252be90b564/_
Premium account
This scan was submitted by a Enterprise-tier account. Premium accounts have full outreach control â Repobility doesn't pre-fill the 'file as GitHub issue' button for paid users. You can still file the issue manually using the markdown body above (Copy markdown), or contact us if you'd like batch-filing enabled for your account.
Megaproject â high spam risk
Could not determine 'Maher-Amara/Fail2BanEntreprise' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.