MarcelMichau/fake-survey-generator

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

16 of your 24 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 1.37s · analysis 18.6s · 1.3 MB · GitHub API rate-limit (preflight)

https://github.com/MarcelMichau/fake-survey-generator · scanned 2026-06-05 14:34 UTC (5 days, 3 hours ago) · 10 languages

71 raw signals (23 security + 48 graph) System graph score 82 (lower by 13)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 3 hours ago · v2 · 34 actionable findings from 2 signal sources. 13 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 20 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	94.8	0.25	23.70
`testing_score`	29.0	0.20	5.80
`documentation_score`	61.0	0.15	9.15
`practices_score`	81.0	0.15	12.15
`code_quality`	75.2	0.10	7.52
Overall		1.00	68.1

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 4 Medium 6 Low 19 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 14 System graph 20 Crowd 0 Layer: Cicd 6 Software 12 Quality 7 Api 1 Hardware 8

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B- (68/100). Dimensions: security 95, maintainability 65. 23 findings (12 security). 10,992 lines analyzed.

Showing 29 of 34 actionable findings. 47 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks software dependencies conf 0.90 ✓ Repobility 6 occurrences Dockerfile FROM `node:25` not pinned by digest

`FROM node:25` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

3 files, 6 locations

src/client/ui/Dockerfile:1, 8 (2 hits)

src/server/FakeSurveyGenerator.Api/Dockerfile:3, 9 (2 hits)

src/server/FakeSurveyGenerator.Worker/Dockerfile:3, 7 (2 hits)

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `github/codeql-action/init` pinned to mutable ref `@v3` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 57, 86

.github/workflows/codeql.yml:57, 86 (4 hits)

CI/CD securitySupply chainGitHub Actions

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 51, 75

.github/workflows/codeql.yml:51, 75 (4 hits)

CI/CD securitySupply chainGitHub Actions

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

src/client/ui/Dockerfile:9 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore

COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts.

src/server/FakeSurveyGenerator.Worker/Dockerfile:25 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore

COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts.

src/server/FakeSurveyGenerator.Api/Dockerfile:27 CI/CD securitycontainers

high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell

Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.

.agents/skills/aspire-orchestration/SKILL.md:28

high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell

Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.

.agents/skills/aspire/SKILL.md:140

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/client/ui/src/components/VersionInfo.tsx:12

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/client/ui/src/hooks/useApiCall.ts:38

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph hardware Security conf 1.00 Dockerfile runs as root: src/client/ui/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

low Security checks quality Quality conf 0.60 Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

src/server/FakeSurveyGenerator.Application/Infrastructure/Migrations/SurveyContextModelSnapshot.cs:14 duplicationquality

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/dotnet/aspnet:10.0-resolute-chiseled-extra

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/server/FakeSurveyGenerator.Api/Dockerfile:3 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/dotnet/aspnet:10.0-resolute-chiseled-extra

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/server/FakeSurveyGenerator.Worker/Dockerfile:3 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/dotnet/sdk:10.0

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/server/FakeSurveyGenerator.Api/Dockerfile:9 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/dotnet/sdk:10.0

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/server/FakeSurveyGenerator.Worker/Dockerfile:7 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: nginx:1.29-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/client/ui/Dockerfile:8 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:25

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/client/ui/Dockerfile:1 containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/client/ui/postcss.config.js