Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

xr843/fojin

https://github.com/xr843/fojin.git · scanned 2026-05-16 02:11 UTC (2 weeks, 6 days ago) · 10 languages

382 findings (202 legacy + 180 scanner) 46th percentile · Python · medium (20-100K LoC) Scanner says 64 (lower by 15)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 weeks, 6 days ago · v1 · 194 findings from 1 source. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
47.4
/100
Repobility
31
194 legacy
9-layer
64
100.0% cov · 0 gaps
Critical
26
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-17-v4 calibration-aware
Component Sub-score Weight Contribution
structure_score 40.0 0.15 6.00
security_score 3.0 0.25 0.75
testing_score 47.0 0.20 9.40
documentation_score 98.0 0.15 14.70
practices_score 85.0 0.15 12.75
code_quality 56.5 0.10 5.65
Overall 1.00 49.3
Calibrated penalty buckets (security_score): web: 1.6 · agent: 3.5 · docker: 40.2 · threat: 67.0
Severity distribution — click a segment to filter
Active filters: severity: critical × excluding tests × Reset all
Severity: Critical 26 High 136 Medium 26 Low 3 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 194 9-layer 0 Crowd 0 Layer: Quality 42 Software 8 Security 128 Cicd 16
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 64.0/100 with 100.0% coverage. It contains 3326 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 0 findings. Risk profile is low: 0 critical, 0 high, 0 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 26 of 194 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Legacy cicd docker conf 0.96 Compose service contains a literal secret environment value
Literal secrets in Compose files are committed to source and exposed through container inspection.
docker-compose.yml:129 dockerlegacy
critical Legacy cicd docker conf 0.96 Compose service contains a literal secret environment value
Literal secrets in Compose files are committed to source and exposed through container inspection.
docker-compose.yml:68 dockerlegacy
critical Legacy cicd docker conf 0.96 Compose service contains a literal secret environment value
Literal secrets in Compose files are committed to source and exposed through container inspection.
docker-compose.yml:7 dockerlegacy
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0041_reassign_international_source_regions.py:41 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0030_deactivate_unreachable_sources.py:70 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0030_deactivate_unreachable_sources.py:54 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0019_add_source_access_type.py:44 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0074_deactivate_jbf_and_reorder_zojoji.py:37 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0049_fix_down_and_moved_source_urls.py:44 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0049_fix_down_and_moved_source_urls.py:37 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:217 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:210 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:203 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:194 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:187 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:180 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0044_deduplicate_and_fix_data_quality.py:169 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0043_cleanup_candidate_sources.py:133 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0043_cleanup_candidate_sources.py:126 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0046_audit_cleanup_and_new_entries.py:213 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0046_audit_cleanup_and_new_entries.py:120 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0046_audit_cleanup_and_new_entries.py:109 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0048_fix_https_only_and_stale_urls.py:46 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0048_fix_https_only_and_stale_urls.py:39 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0042_set_null_region_sources.py:43 injectionlegacy sql-string-concat · CWE-89 · A03:2021
critical Legacy security injection conf 0.85 SQL Injection — string-concat or f-string into execute()
cursor.execute(f"... {user_input} ...") — SQL injection.
backend/alembic/versions/0042_set_null_region_sources.py:34 injectionlegacy sql-string-concat · CWE-89 · A03:2021
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/42747e40-840f-4f7f-95d6-8422159cbe2e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/42747e40-840f-4f7f-95d6-8422159cbe2e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.