mxyxyz9/Tabs-ide

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

Scan timing: clone 4.28s · analysis 5.74s · 8.5 MB · GitHub preflight 459ms

https://github.com/mxyxyz9/Tabs-ide.git · scanned 2026-05-22 12:46 UTC (3 weeks ago) · 10 languages

353 raw signals (69 security + 284 graph) 61st percentile · Typescript · large (100-500K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 weeks ago · v2 · 124 actionable findings from 2 signal sources. 86 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 105 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	87.9	0.25	21.98
`testing_score`	95.0	0.20	19.00
`documentation_score`	79.0	0.15	11.85
`practices_score`	67.0	0.15	10.05
`code_quality`	59.9	0.10	5.99
Overall		1.00	77.9

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 1 Medium 11 Low 75 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 19 System graph 105 Crowd 0 Layer: Security 4 Quality 37 Software 53 Cicd 4 Api 1 Frontend 25

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B+ (78/100). Dimensions: security 88, maintainability 60. 69 findings (30 security). 138,935 lines analyzed.

Showing 87 of 124 actionable findings. 210 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 15 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `oven-sh/setup-bun` pinned to mutable ref `@v2` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

3 files, 15 locations

.github/workflows/release.yml:59, 116, 237, 289, 338 (9 hits)

.github/workflows/ci.yml:18, 84 (4 hits)

.github/workflows/pr-vouch.yml:80 (2 hits)

CI/CD securitySupply chainGitHub Actions

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 43 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v6` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

5 files, 43 locations

.github/workflows/release.yml:30, 64, 110, 121, 220, 232, 242, 265, +5 more (23 hits)

.github/workflows/ci.yml:15, 23, 28, 38, 81, 89 (12 hits)

.github/workflows/pr-vouch.yml:28, 88 (4 hits)

.github/workflows/pr-size.yml:19, 67, 128 (3 hits)

.github/workflows/issue-labels.yml:21

CI/CD securitySupply chainGitHub Actions

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

apps/web/src/components/KeybindingsToast.browser.tsx:385

medium Security checks quality Quality conf 0.73 Codex session log reader may expose prompts or tool-call content

Codex session JSONL files can contain prompts, tool events, paths, and operational metadata, not only token counts. Token dashboards and exporters should avoid retaining or sharing raw session text.

apps/server/src/provider/Layers/CodexAdapter.ts:2

high Security checks quality Quality conf 0.80 localStorage write failures are swallowed silently

localStorage quotas are small and writes can fail. Catching storage errors without a user-visible warning causes silent data loss when notes, images, or snapshots exceed quota.

apps/web/src/store.ts:76

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/components/ChatMarkdown.tsx:203

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/marketing/src/lib/releases.ts:23

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/server/src/projectFaviconRoute.test.ts:65

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/server/src/wsServer.test.ts:628

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/public/mockServiceWorker.js:238

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/components/WorkspaceShell.tsx:2092

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release.yml CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ChatMarkdown.tsx:203

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

apps/web/src/components/ChatMarkdown.tsx:203 Dangerous innerhtml

low Security checks quality Quality conf 0.60 15 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 13 locations

apps/web/src/components/chat/TraitsPicker.browser.tsx:36, 61 (2 hits)

apps/server/src/git/Layers/CodexTextGeneration.ts:185

apps/server/src/persistence/Layers/ProjectionProjects.ts:78

apps/server/src/persistence/Layers/ProjectionThreadActivities.ts:69

apps/server/src/persistence/Layers/ProjectionThreadMessages.ts:76

apps/server/src/persistence/Layers/ProjectionThreads.ts:73

apps/server/src/persistence/Layers/ProjectionTurns.ts:46

apps/server/src/provider/Layers/CodexProvider.ts:14

duplicationquality

low System graph software Dead code candidate conf 1.00 File has no detected symbols: apps/desktop/src/confirmDialog.test.ts