Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

Pumpkin-MC/Pumpkin

https://github.com/Pumpkin-MC/Pumpkin · scanned 2026-07-23 19:34 UTC (3 months ago)

45 raw signals (0 security + 45 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v7 · 43 actionable findings from 1 signal source. 2 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

70.0% cov · 43 findings

Severity distribution — click a segment to filter

Active filters: layer: dependencies × excluding tests × Reset all

Severity: Critical 0 High 0 Medium 10 Low 33 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 43 Crowd 0 Layer: Hardware 2 Cicd 3 Quality 34 Dependencies 4

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 89.6/100 with 70.0% coverage. It contains 2843 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 45 findings — concentrated in quality (34), cicd (5), dependencies (4). Risk profile is low: 0 critical, 0 high, 12 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 4 of 43 actionable findings. 45 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089

OSV.dev reports `atomic-polyfill` at version `1.0.3` (resolved in `Cargo.lock`) is affected by RUSTSEC-2023-0089. Note: `atomic-polyfill` is a transitive dependency — pulled in by another package, not declared directly in a manifest. atomic-polyfill is unmaintained Advisory: https://osv.dev/vulne…

Cargo.lock ScaOsvRustsec 2023 0089

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173

OSV.dev reports `proc-macro-error2` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0173. proc-macro-error2 is unmaintained Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0173 Fix: upgrade `proc-macro-error2` past the affected range per the advisory.

Cargo.toml ScaOsvRustsec 2026 0173

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency rsa 0.10.0-rc.18: RUSTSEC-2023-0071

OSV.dev reports `rsa` at version `0.10.0-rc.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2023-0071 (aka CVE-2023-49092). Marvin Attack: potential key recovery through timing sidechannels Aliases: CVE-2023-49092, GHSA-4grx-2x9w-596c, GHSA-c38w-74pg-36hr Advisory: https://osv.dev/vulnerabi…

Cargo.toml ScaOsvRustsec 2023 0071

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency wasmtime-wasi 45.0.2: RUSTSEC-2026-0188

OSV.dev reports `wasmtime-wasi` at version `45.0.2` (resolved in `pumpkin-protocol/fuzz/Cargo.lock`) is affected by RUSTSEC-2026-0188 (aka CVE-2026-58494). WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination Aliases: CVE-2026-58494, GHSA-4ch3-9j33-3pmj Advisory: https://o…

pumpkin-protocol/fuzz/Cargo.lock ScaOsvRustsec 2026 0188

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/37eeff43-6dda-4abd-9a98-2222b06e55ca/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/37eeff43-6dda-4abd-9a98-2222b06e55ca/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.