langflow-ai/openrag

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	16.1	0.25	4.03
`testing_score`	71.0	0.20	14.20
`documentation_score`	88.0	0.15	13.20
`practices_score`	75.0	0.15	11.25
`code_quality`	57.9	0.10	5.79
Overall		1.00	61.2

critical Security checks cicd CI/CD security conf 0.96 Compose service contains a literal secret environment value

Literal secrets in Compose files are committed to source and exposed through container inspection.

src/tui/_assets/docker-compose.yml:144 CI/CD securitycontainers

critical Security checks cicd CI/CD security conf 0.96 Compose service contains a literal secret environment value

Literal secrets in Compose files are committed to source and exposed through container inspection.

docker-compose.yml:144 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.90 Database service has no persistent data volume

Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state.

src/tui/_assets/docker-compose.yml:35 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.90 Database service has no persistent data volume

Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state.

docker-compose.yml:35 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.84 4 occurrences Database service publishes a host port

Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports.

2 files, 4 locations

docker-compose.yml:1, 35 (2 hits)

src/tui/_assets/docker-compose.yml:1, 35 (2 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.95 Docker final stage runs as root

The final runtime stage explicitly uses root. A compromised app process would have root inside the container.

Dockerfile.langflow:14 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.92 Dockerfile pipes a remote script into a shell

Piping downloaded code directly into a shell bypasses checksum verification and makes builds dependent on mutable remote content.

Dockerfile.backend:11 CI/CD securitycontainers

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /onboarding-status.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /onboarding-status.

src/api/config.py:32

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /users/{user_id}.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /users/{user_id}.

src/api/admin/rbac.py:236

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /users/{user_id}/roles/{role_id}.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /users/{user_id}/roles/{role_id}.

src/api/admin/rbac.py:336

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /me.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /me.

src/api/users.py:52

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /me/permissions.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /me/permissions.

src/api/users.py:86

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /roles.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /roles.

src/api/admin/rbac.py:388

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /users.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /users.

src/api/admin/rbac.py:167

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /users/{user_id}.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /users/{user_id}.

src/api/admin/rbac.py:179

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PATCH /users/{user_id}.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PATCH /users/{user_id}.

src/api/admin/rbac.py:191

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /roles.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /roles.

src/api/admin/rbac.py:397

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /users/{user_id}/roles.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /users/{user_id}/roles.

src/api/admin/rbac.py:303

medium Security checks security auth conf 0.72 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

low Security checks quality Error handling conf 0.45 3 occurrences [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.

3 files, 3 locations

alembic/env.py:36

src/agent.py:517

warm_up_docling.py:25

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

sdks/typescript/src/chat.ts:172

high Security checks quality Quality conf 0.72 Agent control bridge may listen on a network interface without visible auth

Agent, MCP, sidecar, and command bridge servers often start as local helpers. Binding them to 0.0.0.0 or a default all-interface listener without an authorization guard can expose tool execution or session data to the LAN.

src/main.py:4

medium Security checks cicd CI/CD security conf 0.88 Database service has no healthcheck

Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy.

src/tui/_assets/docker-compose.yml:35 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.88 Database service has no healthcheck

Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy.

docker-compose.yml:35 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

Dockerfile.langflow.dev:4 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

Dockerfile.backend:55 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.94 Dockerfile base image uses the latest tag

The latest tag is mutable and can change without a code review, producing different images from the same source.

Dockerfile:41 CI/CD securitycontainers

low Security checks quality Quality conf 0.60 12 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

10 files, 12 locations

frontend/app/onboarding/_components/openai-onboarding.tsx:48, 49 (2 hits)

frontend/app/settings/_components/openai-settings-dialog.tsx:30, 66 (2 hits)

flows/components/mcp_component.py:124

frontend/app/api/queries/useGetSettingsQuery.ts:41

frontend/app/onboarding/_components/ibm-onboarding.tsx:99

frontend/app/settings/_components/ingest-settings-section.tsx:53

frontend/app/settings/_components/ollama-settings-dialog.tsx:89

frontend/app/settings/_components/s3-settings-dialog.tsx:79

duplicationquality

high Security checks quality Quality conf 0.74 15 occurrences Frontend API reference is not matched by discovered backend routes

A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys.

12 files, 12 locations

frontend/app/api/mutations/useAssignRoleMutation.ts:13

frontend/app/api/mutations/useCancelTaskMutation.ts:27

frontend/app/api/mutations/useCreateApiKeyMutation.ts:30

frontend/app/api/mutations/useCreateFilter.ts:19

frontend/app/api/mutations/useDeleteDocument.ts:19

frontend/app/api/mutations/useDeleteFilter.ts:15

frontend/app/api/mutations/useDisconnectConnectorMutation.ts:11

frontend/app/api/mutations/useIBMCOSConfigureMutation.ts:20

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell

Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.

src/tui/utils/startup_checks.py:225

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.56 4 occurrences Compose service does not declare a runtime user

If the image does not define USER internally, this service may run as root.

2 files, 4 locations

docker-compose.yml:47, 144 (2 hits)

src/tui/_assets/docker-compose.yml:47, 144 (2 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 6 occurrences Compose service lacks no-new-privileges hardening

no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.

2 files, 6 locations

docker-compose.yml:47, 131, 144 (3 hits)

src/tui/_assets/docker-compose.yml:47, 131, 144 (3 hits)

CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.72 Dockerfile installs recommended OS packages

Installing recommended packages often pulls in unnecessary runtime surface area.

Dockerfile.langflow.dev:18 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.72 Dockerfile keeps pip download cache

Pip's package cache increases image size and can preserve unnecessary artifacts.

Dockerfile.langflow.dev:29 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.72 Dockerfile keeps pip download cache

Pip's package cache increases image size and can preserve unnecessary artifacts.

Dockerfile.langflow:6 CI/CD securitycontainers

high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact

Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area.

src/app/routes/public_v1.py:1

Complete repo analysis