Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
33 of your 56 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

microsoft/ML-For-Beginners

https://github.com/microsoft/ML-For-Beginners · scanned 2026-06-05 07:18 UTC (5 days, 22 hours ago) · 10 languages

52 findings 11/13 scanners ran 38th percentile · Python · tiny (<2K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

19 actionable findings from 1 signal source. 33 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

Combined
73.4
/100
Security checks
73
19 findings
System graph
—
—% cov · 0 findings
Critical
2
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 100.0 0.25 25.00
testing_score 0.0 0.20 0.00
documentation_score 67.0 0.15 10.05
practices_score 55.0 0.15 8.25
code_quality 80.0 0.10 8.00
Overall 1.00 60.3
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 1 Medium 4 Low 3 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 19 System graph 0 Crowd 0 Layer: Quality 14 Software 1 Security 2 Cicd 2

Showing 10 of 19 actionable findings. 52 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__.
Review and fix per the pattern semantics. See CWE-502 / for context.
3-Web-App/1-Web-App/solution/web-app/app.py:7
critical Security checks quality Quality conf 1.00 [SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marshal.load(s) execute arbitrary code on untrusted input. Ported from dlint DUO103 / DUO120 (BSD-3).
Use json, msgpack, or protobuf for untrusted data. If pickle is required, sign the payload with HMAC.
3-Web-App/1-Web-App/solution/web-app/app.py:7
high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences [MINED108] `self._df2tensors` used but never assigned in __init__: Method `subset_data` of class `TimeSeriesTensor` reads `self._df2tensors`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self._df2tensors = <default>` in __init__, or add a class-level default.
7 files, 25 locations
8-Reinforcement/1-QLearning/rlboard.py:112, 113, 123, 124, 169, 172, 179, 183, +5 more (14 hits)
8-Reinforcement/1-QLearning/solution/rlboard.py:112, 113, 123, 124, 169, 172 (6 hits)
7-TimeSeries/1-Introduction/solution/common/utils.py:145
7-TimeSeries/1-Introduction/working/common/utils.py:145
7-TimeSeries/2-ARIMA/solution/common/utils.py:145
7-TimeSeries/2-ARIMA/working/common/utils.py:145
7-TimeSeries/common/utils.py:147
medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
[MINED115] Action `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml` pinned to mutable ref `@v1.4.0`: `uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed…
2 files, 2 locations
.github/workflows/generator-generic-ossf-slsa3-publish.yml:63
.github/workflows/lock.yml:11
CI/CD securitySupply chainGitHub Actions
low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lo…
2 files, 2 locations
.github/workflows/generator-generic-ossf-slsa3-publish.yml:26
.github/workflows/stale.yml:21
CI/CD securitySupply chainGitHub Actions
medium Security checks quality Practices conf 1.00 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.
Add a .gitignore appropriate for your language/framework.
low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.
Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.
3-Web-App/1-Web-App/solution/web-app/app.py:7
medium Security checks security path traversal conf 1.00 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.
Validate extracted paths with os.path.realpath() and ensure they stay within the target directory.
7-TimeSeries/1-Introduction/solution/common/extract_data.py:17
medium Security checks quality Quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).
Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.
3-Web-App/1-Web-App/solution/web-app/app.py:32
low Security checks quality Quality conf 0.60 8 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
8 files, 8 locations
7-TimeSeries/1-Introduction/working/common/extract_data.py:1
7-TimeSeries/1-Introduction/working/common/utils.py:1
7-TimeSeries/2-ARIMA/solution/common/extract_data.py:1
7-TimeSeries/2-ARIMA/solution/common/utils.py:1
7-TimeSeries/2-ARIMA/working/common/extract_data.py:1
7-TimeSeries/2-ARIMA/working/common/utils.py:1
7-TimeSeries/common/utils.py:1
8-Reinforcement/1-QLearning/solution/rlboard.py:1
duplicationquality
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/376b2a43-5726-48d6-a401-647c50cf2472/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/376b2a43-5726-48d6-a401-647c50cf2472/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.