Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

andrewkatson/pos

https://github.com/andrewkatson/pos · scanned 2026-06-17 01:33 UTC (1 month, 2 weeks ago)

72 raw signals (0 security + 72 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v2 · last Δ +0.3 (diff) · 55 actionable findings from 1 signal source. 17 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
77.0
/100
Security checks
77
0 findings
System graph
77
100.0% cov · 55 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 1 High 0 Medium 32 Low 14 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 55 Crowd 0 Layer: Software 11 Security 30 Cicd 2 Quality 12
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 77.0/100 with 100.0% coverage. It contains 1102 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 72 findings — concentrated in security (30), cicd (18), quality (13). Risk profile is high: 1 critical, 0 high, 37 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 47 of 55 actionable findings. 72 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Secrets conf 1.00 Possible secret in backend/tools/credentials.sh
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
backend/tools/credentials.sh:28
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security auth conf 1.00 Django view `comment_on_post` may be unauthenticated — backend/user_system/views.py:1073
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1073 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `delete_comment` may be unauthenticated — backend/user_system/views.py:1236
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1236 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `delete_post` may be unauthenticated — backend/user_system/views.py:803
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:803 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `delete_user` may be unauthenticated — backend/user_system/views.py:535
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:535 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `follow_user` may be unauthenticated — backend/user_system/views.py:1435
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1435 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_post_details` may be unauthenticated — backend/user_system/views.py:1043
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1043 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_posts_for_followed_users` may be unauthenticated — backend/user_system/views.py:965
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:965 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_posts_for_user` may be unauthenticated — backend/user_system/views.py:1002
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1002 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_posts_in_feed` may be unauthenticated — backend/user_system/views.py:931
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:931 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_profile_details` may be unauthenticated — backend/user_system/views.py:1515
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1515 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `get_users_matching_fragment` may be unauthenticated — backend/user_system/views.py:1400
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1400 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `health` may be unauthenticated — backend/pos_backend/views.py:4
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/pos_backend/views.py:4 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `like_comment` may be unauthenticated — backend/user_system/views.py:1156
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1156 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `like_post` may be unauthenticated — backend/user_system/views.py:869
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:869 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `make_post` may be unauthenticated — backend/user_system/views.py:751
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:751 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `ratelimited` may be unauthenticated — backend/pos_backend/views.py:9
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/pos_backend/views.py:9 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `reply_to_comment_thread` may be unauthenticated — backend/user_system/views.py:1113
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1113 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `report_comment` may be unauthenticated — backend/user_system/views.py:1272
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1272 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `report_post` may be unauthenticated — backend/user_system/views.py:823
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:823 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `request_reset` may be unauthenticated — backend/user_system/views.py:557
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:557 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `toggle_block` may be unauthenticated — backend/user_system/views.py:1482
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1482 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `unfollow_user` may be unauthenticated — backend/user_system/views.py:1460
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1460 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `unlike_comment` may be unauthenticated — backend/user_system/views.py:1196
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:1196 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `unlike_post` may be unauthenticated — backend/user_system/views.py:899
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:899 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `verify_identity` may be unauthenticated — backend/user_system/views.py:329
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:329 securityAuth django unauth view
medium System graph security auth conf 1.00 Django view `verify_reset` may be unauthenticated — backend/user_system/views.py:599
Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive — dismiss with reason `by_design`.
backend/user_system/views.py:599 securityAuth django unauth view
medium System graph quality Integrity conf 1.00 2 occurrences Frontend route `/post/:postId` has no Link/navigate to it — website/src/pages/ProfilePage.test.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
2 occurrences
repo-level (2 hits)
Orphan pageWiring
medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Action is tag-pinned rather than SHA-pinned
gradle/actions/setup-gradle@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 5 locations
.github/workflows/android-tests.yml:33, 60, 75, 80 (4 hits)
.github/workflows/ios-tests.yml:132
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in website/src/pages/LoginPage.tsx:28
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
website/src/pages/LoginPage.tsx:28 Local storage auth token
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in website/src/pages/RegisterPage.tsx:55
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
website/src/pages/RegisterPage.tsx:55 Local storage auth token
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in website/src/pages/ResetPasswordPage.tsx:55
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
website/src/pages/ResetPasswordPage.tsx:55 Local storage auth token
low System graph cicd CI/CD security conf 1.00 13 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
4 files, 13 locations
.github/workflows/ios-tests.yml:24, 42, 84, 90, 106, 120, 275 (7 hits)
.github/workflows/android-tests.yml:21, 26, 48, 53 (4 hits)
.github/workflows/backend-tests.yml:24
.github/workflows/website-tests.yml:27
CI/CD securitySupply chainGithub actions
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: backend/user_system/views.py:get_user_with_username_and_email, backend/user_system/views.py:get_user_with_username This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or docum…
duplicatesduplication
low System graph software Dead code conf 1.00 Possibly dead Python function: as_postgresql
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/feed_algorithm/feed_algorithm.py:19
low System graph software Dead code conf 1.00 Possibly dead Python function: as_sqlite
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/feed_algorithm/feed_algorithm.py:26
low System graph software Dead code conf 1.00 Possibly dead Python function: call_api
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/text_classifier.py:33
low System graph software Dead code conf 1.00 Possibly dead Python function: call_api
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/image_classifier.py:104
low System graph software Dead code conf 1.00 Possibly dead Python function: call_image_claude
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/classifier_utils.py:171
low System graph software Dead code conf 1.00 Possibly dead Python function: call_image_gemini
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/classifier_utils.py:164
low System graph software Dead code conf 1.00 Possibly dead Python function: call_image_openai
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/classifier_utils.py:189
low System graph software Dead code conf 1.00 Possibly dead Python function: call_text_claude
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/classifier_utils.py:134
low System graph software Dead code conf 1.00 Possibly dead Python function: call_text_gemini
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/classifier_utils.py:126
low System graph software Dead code conf 1.00 Possibly dead Python function: call_text_openai
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/classifiers/classifier_utils.py:146
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_password
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/user_system/utils.py:70
low System graph quality Complexity conf 1.00 Very large file: backend/user_system/views.py (1567 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/31585043-3a2e-487a-941b-d4ac1ea6dcda/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/31585043-3a2e-487a-941b-d4ac1ea6dcda/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.