← Back to scan
File as GitHub Issue repo: usememos/memos

Push this scan report to usememos/memos

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Async function without await — fire-and-forget Promise (AI mistake)

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… web/src/hooks/useMemoFilters.ts:90
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… web/src/contexts/MemoFilterContext.tsx:38
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… web/src/components/MemoEditor/utils/der…:14
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… web/src/components/MemoContent/utils.ts:23
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … web/src/components/MemoEditor/hooks/use…:24
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … web/src/components/MemoEditor/hooks/use…:19
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … store/cache/cache.go:104
HIGH MINED012 [MINED012] Curl Pipe Bash: curl ... | sh / bash — runs unverified network code. scripts/install.sh:27
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. server/auth/token.go:222
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. server/auth/authenticator.go:154
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. internal/storage/s3/s3.go:105
HIGH MINED033 [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows pa… server/router/api/v1/connect_intercepto…:179
HIGH MINED033 [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows pa… internal/scheduler/middleware.go:30
HIGH MINED033 [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows pa… internal/cron/chain.go:46
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… internal/httpgetter/image.go:21
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… internal/httpgetter/html_meta.go:40
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… internal/ai/stt/openai/openai.go:39
HIGH DKR001 Docker final stage runs as root scripts/Dockerfile:43
HIGH MINED115 Action `actions/download-artifact` pinned to mutable ref `@v7` .github/workflows/build-canary-image.yml:127
HIGH MINED115 Action `actions/upload-artifact` pinned to mutable ref `@v6` .github/workflows/build-canary-image.yml:112
HIGH MINED115 Action `actions/download-artifact` pinned to mutable ref `@v7` .github/workflows/build-canary-image.yml:67
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/build-canary-image.yml:64
HIGH MINED115 Action `actions/upload-artifact` pinned to mutable ref `@v6` .github/workflows/build-canary-image.yml:45
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v5` .github/workflows/build-canary-image.yml:33
HIGH MINED115 Action `actions/setup-node` pinned to mutable ref `@v6` .github/workflows/build-canary-image.yml:23
HIGH MINED115 Action `pnpm/action-setup` pinned to mutable ref `@v4.2.0` .github/workflows/build-canary-image.yml:19
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/build-canary-image.yml:18
HIGH MINED115 Action `codecov/codecov-action` pinned to mutable ref `@v5` .github/workflows/backend-tests.yml:87
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/backend-tests.yml:58
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/backend-tests.yml:55
HIGH MINED115 Action `golangci/golangci-lint-action` pinned to mutable ref `@v9` .github/workflows/backend-tests.yml:41
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/backend-tests.yml:29
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/backend-tests.yml:26
HIGH MINED115 Action `actions/setup-node` pinned to mutable ref `@v6` .github/workflows/frontend-tests.yml:64
HIGH MINED115 Action `pnpm/action-setup` pinned to mutable ref `@v4.2.0` .github/workflows/frontend-tests.yml:59
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/frontend-tests.yml:56
HIGH MINED115 Action `actions/setup-node` pinned to mutable ref `@v6` .github/workflows/frontend-tests.yml:33
HIGH MINED115 Action `pnpm/action-setup` pinned to mutable ref `@v4.2.0` .github/workflows/frontend-tests.yml:28
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/frontend-tests.yml:25
HIGH MINED115 Action `bufbuild/buf-lint-action` pinned to mutable ref `@v1` .github/workflows/proto-linter.yml:31
HIGH MINED115 Action `bufbuild/buf-setup-action` pinned to mutable ref `@v1` .github/workflows/proto-linter.yml:26
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/proto-linter.yml:21
HIGH MINED115 Action `googleapis/release-please-action` pinned to mutable ref `@v4` .github/workflows/release-please.yml:32
HIGH MINED118 Dockerfile FROM `alpine:3.21` not pinned by digest scripts/Dockerfile:29
HIGH GO-2026-5039 stdlib: GO-2026-5039 go.mod
HIGH GO-2026-5038 stdlib: GO-2026-5038 go.mod
HIGH GO-2026-5037 stdlib: GO-2026-5037 go.mod
HIGH GO-2026-4986 stdlib: GO-2026-4986 go.mod
HIGH GO-2026-4982 stdlib: GO-2026-4982 go.mod
HIGH GO-2026-4981 stdlib: GO-2026-4981 go.mod
HIGH GO-2026-4980 stdlib: GO-2026-4980 go.mod
HIGH GO-2026-4977 stdlib: GO-2026-4977 go.mod
HIGH GO-2026-4976 stdlib: GO-2026-4976 go.mod
HIGH GO-2026-4971 stdlib: GO-2026-4971 go.mod
HIGH GO-2026-4918 stdlib: GO-2026-4918 go.mod
HIGH GO-2026-5024 golang.org/x/sys: GO-2026-5024 go.mod
HIGH GO-2026-5030 golang.org/x/net: GO-2026-5030 go.mod
HIGH GO-2026-5029 golang.org/x/net: GO-2026-5029 go.mod
HIGH GO-2026-5028 golang.org/x/net: GO-2026-5028 go.mod
HIGH GO-2026-5027 golang.org/x/net: GO-2026-5027 go.mod
HIGH GO-2026-5026 golang.org/x/net: GO-2026-5026 go.mod
HIGH GO-2026-5025 golang.org/x/net: GO-2026-5025 go.mod
HIGH GO-2026-5032 golang.org/x/image: GO-2026-5032 go.mod
HIGH GO-2026-5031 golang.org/x/image: GO-2026-5031 go.mod
HIGH GO-2026-5033 golang.org/x/crypto: GO-2026-5033 go.mod
HIGH GO-2026-5023 golang.org/x/crypto: GO-2026-5023 go.mod
HIGH GO-2026-5021 golang.org/x/crypto: GO-2026-5021 go.mod
HIGH GO-2026-5020 golang.org/x/crypto: GO-2026-5020 go.mod
HIGH GO-2026-5019 golang.org/x/crypto: GO-2026-5019 go.mod
HIGH GO-2026-5018 golang.org/x/crypto: GO-2026-5018 go.mod
HIGH GO-2026-5017 golang.org/x/crypto: GO-2026-5017 go.mod
HIGH GO-2026-5016 golang.org/x/crypto: GO-2026-5016 go.mod
HIGH GO-2026-5015 golang.org/x/crypto: GO-2026-5015 go.mod
HIGH GO-2026-5014 golang.org/x/crypto: GO-2026-5014 go.mod
HIGH GO-2026-5013 golang.org/x/crypto: GO-2026-5013 go.mod
HIGH GO-2026-5006 golang.org/x/crypto: GO-2026-5006 go.mod
HIGH GO-2026-5005 golang.org/x/crypto: GO-2026-5005 go.mod
HIGH JRN009 Secret-like setting is echoed into a password input value web/src/pages/SignUp.tsx:119
HIGH JRN009 Secret-like setting is echoed into a password input value web/src/components/Settings/AISection.t…:513
HIGH JRN009 Secret-like setting is echoed into a password input value web/src/components/PasswordSignInForm.t…:96
HIGH JRN009 Secret-like setting is echoed into a password input value web/src/components/CreateUserDialog.tsx:106
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… server/router/fileserver/fileserver.go:123
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… web/src/pages/SignIn.tsx:63
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… web/src/components/Settings/LinkedIdent…:116
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … web/src/components/MemoEditor/utils/der…:14
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … web/src/components/MemoContent/utils.ts:23
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… web/src/components/map/LocationPicker.t…:145
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… web/src/components/LearnMore.tsx:19
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… web/src/components/AttachmentIcon.tsx:38
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… server/server.go:116
MED SEC012 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation all… server/runner/memopayload/runner.go:80
MED SEC012 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation all… server/router/api/v1/memo_mention_helpe…:32
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED GHSA-w5hq-g745-h8pq uuid: GHSA-w5hq-g745-h8pq web/pnpm-lock.yaml
MED GHSA-xcj9-5m2h-648r mermaid: GHSA-xcj9-5m2h-648r web/pnpm-lock.yaml
MED GHSA-ghcm-xqfw-q4vr mermaid: GHSA-ghcm-xqfw-q4vr web/pnpm-lock.yaml
MED GHSA-87f9-hvmw-gh4p mermaid: GHSA-87f9-hvmw-gh4p web/pnpm-lock.yaml
MED GHSA-6m6c-36f7-fhxh mermaid: GHSA-6m6c-36f7-fhxh web/pnpm-lock.yaml
MED DKR018 Database dump or local database file is included in Docker build context .dockerignore
MED JRN002 Browser storage is used for session token material web/src/auth-state.ts:112
MED JRN002 Browser storage is used for session token material web/src/auth-state.ts:84
MED JRN002 Browser storage is used for session token material web/src/auth-state.ts:55
MED AGT007 localStorage write failures are swallowed silently web/src/utils/theme.ts:94
MED AGT007 localStorage write failures are swallowed silently web/src/utils/i18n.ts:19
MED AGT007 localStorage write failures are swallowed silently web/src/hooks/useLocalStorage.ts:35
MED DKR014 Dockerfile copies broad context with incomplete .dockerignore scripts/Dockerfile:13
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 19.6% of discovered … —
MED AGT015 Remote install command pipes network code directly to a shell README.md:69
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/api/v1/connect_intercepto…:50
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/api/v1/memo_service.go:614
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/api/v1/auth_service.go:622
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/api/v1/auth_service.go:415
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/api/v1/sse_handler.go:36
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/api/v1/sse_handler.go:27
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … server/router/fileserver/fileserver.go:694
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … store/attachment.go:290
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … store/attachment.go:186
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … store/attachment.go:145
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… server/router/frontend/frontend.go:138
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. server/server.go:110
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. server/router/api/v1/instance_stats.go:120
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. internal/ai/audio/webm.go:144
LOW DEPCUR-NPM npm package `terser` is minor version(s) behind (^5.47.1 -> 5.48.0) web/package.json
LOW DEPCUR-NPM npm package `tailwind-merge` is minor version(s) behind (^3.5.0 -> 3.6.0) web/package.json
LOW DEPCUR-NPM npm package `mermaid` is minor version(s) behind (^11.14.0 -> 11.15.0) web/package.json
LOW DEPCUR-NPM npm package `katex` is minor version(s) behind (^0.16.45 -> 0.17.0) web/package.json
LOW DEPCUR-NPM npm package `fuse.js` is minor version(s) behind (^7.3.0 -> 7.4.1) web/package.json
LOW DEPCUR-NPM npm package `@tanstack/react-query-devtools` is minor version(s) behind (^5.100.9 -> 5.10… web/package.json
LOW DEPCUR-NPM npm package `@tanstack/react-query` is minor version(s) behind (^5.100.9 -> 5.101.0) web/package.json
LOW GHSA-q7pp-wcgr-pffx github.com/disintegration/imaging: GHSA-q7pp-wcgr-pffx go.mod
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/memo_share.go:68
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/memo_share.go:26
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/memo_relation.go:98
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/memo_relation.go:2
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/memo.go:35
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/memo.go:2
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/instance_setting.go:35
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/instance_setting.go:13
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/inbox.go:95
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/inbox.go:2
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/idp.go:38
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/idp.go:27
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/attachment.go:145
LOW AIC003 Duplicated implementation block across source files store/db/sqlite/attachment.go:2
LOW AIC003 Duplicated implementation block across source files store/db/postgres/user_setting.go:38
LOW AIC003 Duplicated implementation block across source files store/db/postgres/user_identity.go:31
LOW AIC003 Duplicated implementation block across source files store/db/postgres/user_delete.go:2
LOW AIC003 Duplicated implementation block across source files store/db/postgres/user.go:62
LOW AIC003 Duplicated implementation block across source files store/db/postgres/reaction.go:43
LOW AIC003 Duplicated implementation block across source files store/db/postgres/memo_share.go:38
LOW AIC003 Duplicated implementation block across source files store/db/postgres/memo_relation.go:113
LOW AIC003 Duplicated implementation block across source files store/db/postgres/memo.go:126
LOW AIC003 Duplicated implementation block across source files store/db/postgres/instance_setting.go:35
LOW AIC003 Duplicated implementation block across source files store/db/postgres/inbox.go:2
LOW AIC003 Duplicated implementation block across source files store/db/postgres/idp.go:36
LOW AIC003 Duplicated implementation block across source files store/db/postgres/attachment.go:2
LOW AIC003 Duplicated implementation block across source files server/router/api/v1/shortcut_service.go:300
LOW AIC003 Duplicated implementation block across source files server/router/api/v1/reaction_service.go:12
LOW AIC003 Duplicated implementation block across source files server/router/api/v1/memo_share_service…:25
LOW AIC003 Duplicated implementation block across source files server/router/api/v1/memo_relation_serv…:13
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKC010 Compose service lacks no-new-privileges hardening scripts/compose.yaml:1
LOW DKC006 Compose service does not declare a runtime user scripts/compose.yaml:1
INFO MINED058 [MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escapi… web/src/components/MemoContent/MermaidB…:98
INFO MINED058 [MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escapi… web/src/components/MemoContent/CodeBloc…:151
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … web/src/components/MemoContent/markdown…:17
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … web/src/components/MemoActionMenu/memoS…:100
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … web/src/components/MemoActionMenu/MemoS…:78
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… web/src/components/Settings/MyAccountSe…:14
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… web/src/components/ChangeMemberPassword…:19
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… web/src/components/Skeleton.tsx:46
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… web/src/components/AttachmentLibrary/At…:26
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… web/src/components/ActivityCalendar/Mon…:25
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … web/src/components/ConfirmDialog/index.…:35
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … web/src/components/AttachmentIcon.tsx:57
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … web/src/auth-state.ts:72
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. internal/webhook/validate.go:32
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. internal/cron/parser.go:89
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. cmd/memos/main.go:132
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… internal/cron/cron.go:324
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… internal/ai/audiollm/gemini/gemini.go:63
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… cmd/memos/main.go:56
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… server/router/frontend/frontend.go:188
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… cmd/memos/main.go:190
INFO DEPCUR-NPM npm package `baseline-browser-mapping` is patch version(s) behind (^2.10.27 -> 2.10.33) web/package.json
INFO DEPCUR-NPM npm package `@vitejs/plugin-react` is patch version(s) behind (^6.0.1 -> 6.0.2) web/package.json
INFO DEPCUR-NPM npm package `@biomejs/biome` is patch version(s) behind (^2.4.14 -> 2.4.16) web/package.json
INFO DEPCUR-NPM npm package `@babel/plugin-transform-runtime` is patch version(s) behind (7.29.0 -> 7.29.… web/package.json
INFO DEPCUR-NPM npm package `@babel/core` is patch version(s) behind (7.29.0 -> 7.29.7) web/package.json
INFO DEPCUR-NPM npm package `dayjs` is patch version(s) behind (^1.11.20 -> 1.11.21) web/package.json
Reset to top 5 190 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `usememos/memos`

**Score: 62/100 (C)**  ·  193 findings  ·  scanned 2026-06-05 09:42 UTC  ·  123,259 LOC

| Severity | Count |
|---|---|
| CRITICAL | 0 |
| HIGH | 82 |
| MEDIUM | 36 |
| LOW | 45 |

📊 [Full filterable report](https://repobility.com/scan/3629e548-a242-47a9-bc2f-d17e4090d0d5/)  ·  ![scorecard](https://repobility.com/scan/3629e548-a242-47a9-bc2f-d17e4090d0d5/report.png?v=1780652545-s2)

### Top findings

1. **HIGH** `SEC040` — innerHTML XSS — template literal with server-supplied data
   `web/src/hooks/useMemoFilters.ts:90` · CWE-79 · A03:2021 Injection (XSS)
2. **HIGH** `SEC040` — innerHTML XSS — template literal with server-supplied data
   `web/src/contexts/MemoFilterContext.tsx:38` · CWE-79 · A03:2021 Injection (XSS)
3. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `web/src/components/MemoEditor/utils/deriveDefaultCreateTime.ts:14`
4. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `web/src/components/MemoContent/utils.ts:23`
5. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `web/src/components/MemoEditor/hooks/useBlobUrls.ts:24`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/3629e548-a242-47a9-bc2f-d17e4090d0d5/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 11 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'usememos/memos' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Filing guard overridden Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.