Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
27 of your 123 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 4.82s · analysis 5.03s · 32.1 MB · GitHub preflight 431ms

Kitware/CDash

https://github.com/Kitware/CDash · scanned 2026-06-05 18:24 UTC (4 days, 18 hours ago) · 10 languages

240 raw signals (116 security + 124 graph) 11/13 scanners ran 86th percentile · Php · large (100-500K LoC) System graph score 70 (higher by 18)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 18 hours ago · v2 · 132 actionable findings from 2 signal sources. 46 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
80.5
/100
Security checks
91
70 findings
System graph
70
100.0% cov · 62 findings
Critical
1
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 95.0 0.20 19.00
documentation_score 65.0 0.15 9.75
practices_score 91.0 0.15 13.65
code_quality 80.0 0.10 8.00
Overall 1.00 88.2
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 1 High 39 Medium 11 Low 50 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 70 System graph 62 Crowd 0 Layer: Quality 21 Security 40 Cicd 11 Software 37 Api 1 Frontend 14 Network 3 Hardware 5
Scan summary Quality grade A- (88/100). Dimensions: security 100, maintainability 85. 116 findings (46 security). 140,521 lines analyzed.

Showing 101 of 132 actionable findings. 178 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks security Crypto conf 1.00 [SEC039] Plaintext-equivalent password hash — unsalted single-pass digest: Single-pass digest of a password is cryptographically strong as a hash, but is rainbow-table-attackable when used for passwords: there's no salt and no key-stretching. Attackers with the hash database can crack 90%+ of common passwords offline in hours. CWE-916 (use of password hash without computational effort).
Use a purpose-built password hash: - Python: passlib.hash.argon2.hash(password) - Python: bcrypt.hashpw(password.encode(), bcrypt.gensalt()) - Python: hashlib.pbkdf2_hmac('sha256', password, salt, 600000) - PHP: password_hash($password, PASSWORD_ARGON2ID) - Node.js: argon2.hash(password) …
app/Http/Controllers/UserController.php:87
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{build_id}/dynamic_analysis/{file_id}.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:123
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{build_id}/files.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:142
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{build_id}/instrumentation.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:138
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{build_id}/targets.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:135
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{build_id}/tests.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:92
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{id}.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:76
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{id}/configure.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:84
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{id}/dynamic_analysis.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:115
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{id}/notes.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:107
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /builds/{id}/update.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
routes/web.php:99
high Security checks software dependencies conf 0.90 ✓ Repobility 4 occurrences [MINED118] Dockerfile FROM `php:8.3-apache-trixie` not pinned by digest: `FROM php:8.3-apache-trixie` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Replace with: `FROM php:8.3-apache-trixie@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).
lines 13, 135, 244, 247
Dockerfile:13, 135, 244, 247 (4 hits)
high Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.
Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
app/Console/Commands/ValidateXml.php:43
low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lo…
2 files, 4 locations
.github/workflows/ci.yml:29, 69 (2 hits)
.github/workflows/release.yml:12, 35 (2 hits)
CI/CD securitySupply chainGitHub Actions
high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value
Never prefill secret fields with stored values. Show a masked status such as configured/not configured, require explicit rotation to replace the value, and return the raw key only once at creation time.
resources/js/vue/components/ProfilePage.vue:102
high System graph security security conf 1.00 Insecure pattern 'eval_used' in resources/js/angular/jquery.tablesorter.js:625
Found a known-risky pattern (eval_used). Review and replace if possible.
resources/js/angular/jquery.tablesorter.js:625 Eval used
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 8.5% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes.
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /administration.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:318
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /authtokens/manage.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:320
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /manageBuildGroup.php.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:279
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /manageOverview.php.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:230
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /manageProjectRoles.php.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:305
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /manageSubProject.php.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:264
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /monitor.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:322
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /monitor.php.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:323
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /projects/{project_id}/settings.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:185
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /projects/{projectId}/invitations/{invitationId}.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
routes/web.php:313
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /unclaimSite.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
graphql/schema.graphql:100
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /subscribeProject.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/web.php:302
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/filterdata.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:22
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/getSubProjectDependencies.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:26
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/overview.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:40
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/testDetails.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:18
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/testOverview.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:44
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/timeline.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:42
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /v1/viewSubProjects.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/api.php:24
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /subscribeProject.php.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
routes/web.php:303
medium Security checks quality Quality conf 1.00 [SEC105] Cookie missing HttpOnly/Secure flag: Session cookie missing HttpOnly (allows JS reads), Secure (transmitted over plain HTTP), or SameSite (CSRF). Each on its own is a finding.
Always set HttpOnly=true, Secure=true (in production), SameSite=Lax or Strict. For Express: `res.cookie(name, val, { httpOnly: true, secure: true, sameSite: 'lax' })`.
config/session.php:168
high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER
Add a non-root USER in the final runtime stage after files and permissions are prepared.
Dockerfile:255 CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.76 2 occurrences Dockerfile copies broad context with incomplete .dockerignore
Tighten .dockerignore or replace COPY . with explicit COPY statements.
lines 124, 210
Dockerfile:124, 210 (2 hits)
CI/CD securitycontainers
medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy
Add a Content-Security-Policy header through the web framework or hosting config. For static apps, add a CSP meta tag that restricts default-src, script-src, connect-src, img-src, and frame-ancestors.
index.html
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.
.well-known/security.txt
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: cdash-${BASE_IMAGE}-intermediate
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:223 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: cdash-${BASE_IMAGE}-non-root-intermediate
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:254 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: registry.access.redhat.com/ubi9/php-83
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:135 containersPinned dependencies
medium System graph network Security conf 1.00 Privileged port 1001 in use
Port 1001 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
Dockerfile Ports
medium System graph network Security conf 1.00 Privileged port 389 in use
Port 389 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
docker/docker-compose.dev.yml Ports
medium System graph network Security conf 1.00 Privileged port 636 in use
Port 636 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
docker/docker-compose.dev.yml Ports
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases.
.dockerignore CI/CD securitycontainers
low Security checks security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
Add regression tests for anonymous denial, cross-user object denial, admin role limits, and super_admin-only behavior.
high Security checks cicd CI/CD security conf 0.56 Compose service does not declare a runtime user
Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.
docker/docker-compose.yml:2 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.62 Compose service lacks no-new-privileges hardening
Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.
docker/docker-compose.yml:2 CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.72 2 occurrences Dockerfile installs recommended OS packages
Add `--no-install-recommends` and explicitly list only packages the image needs.
lines 18, 65
Dockerfile:18, 65 (2 hits)
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.72 Dockerfile keeps pip download cache
Use `pip install --no-cache-dir ...` in container builds.
Dockerfile:176 CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.74 2 occurrences Dockerfile leaves apt package indexes in the image layer
End the apt install layer with `rm -rf /var/lib/apt/lists/*`.
lines 18, 65
Dockerfile:18, 65 (2 hits)
CI/CD securitycontainers
low Security checks quality Quality conf 0.60 30 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
12 files, 25 locations
app/Http/Submission/Handlers/CoverageJUnitHandler.php:1, 3, 42 (3 hits)
app/Http/Submission/Handlers/DynamicAnalysisHandler.php:1, 3, 47 (3 hits)
app/Http/Submission/Handlers/JavaJSONTarHandler.php:1, 3, 34 (3 hits)
app/Http/Submission/Handlers/NoteHandler.php:1, 3, 28 (3 hits)
app/Http/Submission/Handlers/ConfigureHandler.php:1, 57 (2 hits)
app/Http/Submission/Handlers/CoverageHandler.php:1, 3 (2 hits)
app/Http/Submission/Handlers/CoverageLogHandler.php:1, 71 (2 hits)
app/Http/Submission/Handlers/JSCoverTarHandler.php:1, 37 (2 hits)
duplicationquality
low Security checks quality Quality conf 0.64 Public docs site has no llms.txt
Add llms.txt with the product summary, canonical docs, API endpoints, security guidance, and preferred CLI workflow for AI agents.
llms.txt
low Security checks quality Quality conf 0.50 Public web app has no humans.txt
Add humans.txt with team ownership, contact URL, key documentation links, and the last-updated date.
humans.txt
low Security checks quality Quality conf 0.72 Public web app has no sitemap
Add sitemap.xml, a sitemap index, or a framework-native sitemap route and reference it from robots.txt.
sitemap.xml
low Security checks quality Quality conf 0.74 robots.txt does not advertise a sitemap
Add `Sitemap: https://your-domain.example/sitemap.xml` to robots.txt.
public/robots.txt
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: php:8.3-apache-trixie
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:13 containersPinned dependencies
low System graph software Dead code candidate conf 1.00 File has no detected symbols: babel.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: cypress.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: jest.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: postcss.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: resources/js/angular/jquery-init.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: resources/js/angular/jquery.metadata.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: resources/js/angular/legacy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: resources/js/angular/tabNavigation.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: resources/js/vue/app.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: resources/js/vue/components/shared/Utils.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tailwind.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/__mocks__/fileMock.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/component/code-box.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/component/coverage-viewer.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/component/data-table.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/component/date-time-selector.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/component/filter-row.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/component/loading-indicator.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/calendar.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/colorblind.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/daterange.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/expected-build.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/filter-labels.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/manage-overview.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/manage-sub-project.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/remove-build.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/sub-project-group-order.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/tests.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/e2e/view-sub-projects.cy.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/support/commands.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/support/component.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/cypress/support/e2e.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/Spec/repository-integrations.spec.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: webpack.mix.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `filter_to_copy` in resources/js/angular/controllers/filters.js:252
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — resources/js/angular/jquery.tablesorter.js:147
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — resources/js/vue/components/BuildSummary.vue:1110
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — resources/js/vue/components/shared/ApiLoader.js:56
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/30adc7cd-7ced-4acc-9d9b-e67ccf1d6f52/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/30adc7cd-7ced-4acc-9d9b-e67ccf1d6f52/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.