CRIT
MINED107
Missing import: `platform` used but not imported
backend/app/services/zep_graph_memory_u…:273
CRIT
GHSA-gm8q-m8mv-jj5m
unstructured: GHSA-gm8q-m8mv-jj5m
backend/uv.lock
CRIT
GHSA-7p94-766c-hgjp
nltk: GHSA-7p94-766c-hgjp
backend/uv.lock
HIGH
MINED001
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e…
backend/app/utils/file_parser.py:32
HIGH
MINED001
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e…
backend/app/services/simulation_ipc.py:168
HIGH
SEC128
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call …
backend/app/models/project.py:262
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_parallel_simulation…:412
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_parallel_simulation…:407
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_parallel_simulation…:376
HIGH
MINED108
`self._get_interview_result` used but never assigned in __init__
backend/scripts/run_parallel_simulation…:338
HIGH
MINED108
`self._get_env_and_graph` used but never assigned in __init__
backend/scripts/run_parallel_simulation…:324
HIGH
MINED108
`self._get_active_agents_for_round` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:640
HIGH
MINED108
`self._get_db_path` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:585
HIGH
MINED108
`self._get_profile_path` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:573
HIGH
MINED108
`self._create_model` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:569
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:381
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:377
HIGH
MINED108
`self.handle_batch_interview` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:369
HIGH
MINED108
`self.handle_interview` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:361
HIGH
MINED108
`self.poll_command` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:350
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:297
HIGH
MINED108
`self._get_interview_result` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:284
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:275
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:287
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:245
HIGH
MINED108
`self.send_response` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:238
HIGH
MINED108
`self._get_interview_result` used but never assigned in __init__
backend/scripts/run_twitter_simulation.…:236
HIGH
MINED108
`self.log` used but never assigned in __init__
backend/scripts/action_logger.py:196
HIGH
MINED108
`self.log` used but never assigned in __init__
backend/scripts/action_logger.py:193
HIGH
MINED108
`self.log` used but never assigned in __init__
backend/scripts/action_logger.py:190
HIGH
MINED108
`self.log` used but never assigned in __init__
backend/scripts/action_logger.py:187
HIGH
MINED115
Action `actions/checkout` pinned to mutable ref `@v4`
.github/workflows/docker-image.yml:17
HIGH
MINED118
Dockerfile FROM `python:3.11` not pinned by digest
Dockerfile:1
HIGH
GHSA-v2wj-q39q-566r
vite: GHSA-v2wj-q39q-566r
frontend/package-lock.json
HIGH
GHSA-p9ff-h696-f583
vite: GHSA-p9ff-h696-f583
frontend/package-lock.json
HIGH
GHSA-q8qp-cvcw-x6jj
axios: GHSA-q8qp-cvcw-x6jj
frontend/package-lock.json
HIGH
GHSA-pf86-5x62-jrwf
axios: GHSA-pf86-5x62-jrwf
frontend/package-lock.json
HIGH
GHSA-p92q-9vqr-4j8v
axios: GHSA-p92q-9vqr-4j8v
frontend/package-lock.json
HIGH
GHSA-j5f8-grm9-p9fc
axios: GHSA-j5f8-grm9-p9fc
frontend/package-lock.json
HIGH
GHSA-hfxv-24rg-xrqf
axios: GHSA-hfxv-24rg-xrqf
frontend/package-lock.json
HIGH
GHSA-777c-7fjr-54vf
axios: GHSA-777c-7fjr-54vf
frontend/package-lock.json
HIGH
GHSA-6chq-wfr3-2hj9
axios: GHSA-6chq-wfr3-2hj9
frontend/package-lock.json
HIGH
GHSA-pjwm-pj3p-43mv
axios: GHSA-pjwm-pj3p-43mv
frontend/package-lock.json
HIGH
GHSA-3g43-6gmg-66jw
axios: GHSA-3g43-6gmg-66jw
frontend/package-lock.json
HIGH
GHSA-35jp-ww65-95wh
axios: GHSA-35jp-ww65-95wh
frontend/package-lock.json
HIGH
GHSA-38jv-5279-wg99
urllib3: GHSA-38jv-5279-wg99
backend/uv.lock
HIGH
PYSEC-2026-142
urllib3: PYSEC-2026-142
backend/uv.lock
HIGH
PYSEC-2026-141
urllib3: PYSEC-2026-141
backend/uv.lock
HIGH
PYSEC-2025-217
transformers: PYSEC-2025-217
backend/uv.lock
HIGH
GHSA-fqwm-6jpj-5wxc
tornado: GHSA-fqwm-6jpj-5wxc
backend/uv.lock
HIGH
PYSEC-2026-140
tornado: PYSEC-2026-140
backend/uv.lock
HIGH
PYSEC-2026-139
torch: PYSEC-2026-139
backend/uv.lock
HIGH
PYSEC-2026-161
starlette: PYSEC-2026-161
backend/uv.lock
HIGH
GHSA-wp53-j4wj-2cfg
python-multipart: GHSA-wp53-j4wj-2cfg
backend/uv.lock
HIGH
GHSA-pp6c-gr5w-3c5g
python-multipart: GHSA-pp6c-gr5w-3c5g
backend/uv.lock
HIGH
PYSEC-2026-179
pyjwt: PYSEC-2026-179
backend/uv.lock
HIGH
PYSEC-2026-178
pyjwt: PYSEC-2026-178
backend/uv.lock
HIGH
PYSEC-2026-177
pyjwt: PYSEC-2026-177
backend/uv.lock
HIGH
PYSEC-2026-176
pyjwt: PYSEC-2026-176
backend/uv.lock
HIGH
PYSEC-2026-175
pyjwt: PYSEC-2026-175
backend/uv.lock
HIGH
PYSEC-2026-120
pyjwt: PYSEC-2026-120
backend/uv.lock
HIGH
PYSEC-2025-183
pyjwt: PYSEC-2025-183
backend/uv.lock
HIGH
GHSA-whj4-6x5x-4v2j
pillow: GHSA-whj4-6x5x-4v2j
backend/uv.lock
HIGH
GHSA-pwv6-vv43-88gr
pillow: GHSA-pwv6-vv43-88gr
backend/uv.lock
HIGH
GHSA-cfh3-3jmp-rvhc
pillow: GHSA-cfh3-3jmp-rvhc
backend/uv.lock
HIGH
PYSEC-2026-165
pillow: PYSEC-2026-165
backend/uv.lock
HIGH
GHSA-jm6w-m3j8-898g
nltk: GHSA-jm6w-m3j8-898g
backend/uv.lock
HIGH
GHSA-469j-vmhf-r6v7
nltk: GHSA-469j-vmhf-r6v7
backend/uv.lock
HIGH
PYSEC-2026-99
nltk: PYSEC-2026-99
backend/uv.lock
HIGH
PYSEC-2026-98
nltk: PYSEC-2026-98
backend/uv.lock
HIGH
PYSEC-2026-97
nltk: PYSEC-2026-97
backend/uv.lock
HIGH
GHSA-xm59-rqc7-hhvf
nbconvert: GHSA-xm59-rqc7-hhvf
backend/uv.lock
HIGH
GHSA-8mp2-v27r-99xp
mistune: GHSA-8mp2-v27r-99xp
backend/uv.lock
HIGH
PYSEC-2026-168
mistune: PYSEC-2026-168
backend/uv.lock
HIGH
PYSEC-2026-87
lxml: PYSEC-2026-87
backend/uv.lock
HIGH
GHSA-r6ph-v2qm-q3c2
cryptography: GHSA-r6ph-v2qm-q3c2
backend/uv.lock
HIGH
PYSEC-2026-36
cryptography: PYSEC-2026-36
backend/uv.lock
HIGH
PYSEC-2026-35
cryptography: PYSEC-2026-35
backend/uv.lock
MED
ERR001
[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even…
backend/app/utils/file_parser.py:42
MED
SEC034
[SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge…
backend/app/__init__.py:55
MED
MINED111
Bare except continues silently
backend/app/services/simulation_runner.…:1168
MED
MINED111
Bare except continues silently
backend/app/services/simulation_runner.…:803
MED
MINED111
Bare except continues silently
backend/app/services/simulation_runner.…:1156
MED
MINED111
Bare except continues silently
backend/app/services/simulation_config_…:524
MED
MINED111
Bare except continues silently
backend/scripts/run_reddit_simulation.py:615
MED
MINED111
Bare except continues silently
backend/scripts/run_reddit_simulation.py:271
MED
MINED111
Bare except continues silently
backend/scripts/run_reddit_simulation.py:682
MED
MINED111
Bare except continues silently
backend/scripts/run_reddit_simulation.py:338
MED
MINED111
Bare except continues silently
backend/scripts/run_reddit_simulation.py:294
MED
MINED111
Bare except continues silently
backend/scripts/run_reddit_simulation.py:242
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:492
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:465
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:503
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:476
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:1629
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:555
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:342
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:852
MED
MINED111
Bare except continues silently
backend/scripts/run_parallel_simulation…:743
MED
MINED111
Bare except continues silently
backend/scripts/run_twitter_simulation.…:622
MED
MINED111
Bare except continues silently
backend/scripts/run_twitter_simulation.…:271
MED
MINED111
Bare except continues silently
backend/scripts/run_twitter_simulation.…:694
MED
MINED111
Bare except continues silently
backend/scripts/run_twitter_simulation.…:338
MED
MINED111
Bare except continues silently
backend/scripts/run_twitter_simulation.…:294
MED
MINED111
Bare except continues silently
backend/scripts/run_twitter_simulation.…:242
MED
DKR003
Compose service `mirofish` image uses the latest tag
docker-compose.yml:1
MED
DEPCUR-GHA
GitHub Action `actions/checkout@v4` is 2 major version(s) behind (latest v6.0.3)
.github/workflows/docker-image.yml:17
MED
DEPCUR-NPM
npm package `vue-router` is 1 major version(s) behind (4.6.3 -> 5.1.0)
frontend/package.json
MED
DEPCUR-NPM
npm package `concurrently` is 1 major version(s) behind (9.2.1 -> 10.0.3)
package.json
MED
GHSA-4w7w-66w2-5vf9
vite: GHSA-4w7w-66w2-5vf9
frontend/package-lock.json
MED
GHSA-qx2v-qp2m-jg93
postcss: GHSA-qx2v-qp2m-jg93
frontend/package-lock.json
MED
GHSA-r4q5-vmmm-2653
follow-redirects: GHSA-r4q5-vmmm-2653
frontend/package-lock.json
MED
GHSA-xx6v-rp6x-q39c
axios: GHSA-xx6v-rp6x-q39c
frontend/package-lock.json
MED
GHSA-w9j2-pvgh-6h63
axios: GHSA-w9j2-pvgh-6h63
frontend/package-lock.json
MED
GHSA-vf2m-468p-8v99
axios: GHSA-vf2m-468p-8v99
frontend/package-lock.json
MED
GHSA-m7pr-hjqh-92cm
axios: GHSA-m7pr-hjqh-92cm
frontend/package-lock.json
MED
GHSA-fvcv-3m26-pcqx
axios: GHSA-fvcv-3m26-pcqx
frontend/package-lock.json
MED
GHSA-898c-q2cr-xwhg
axios: GHSA-898c-q2cr-xwhg
frontend/package-lock.json
MED
GHSA-62hf-57xw-28j9
axios: GHSA-62hf-57xw-28j9
frontend/package-lock.json
MED
GHSA-5c9x-8gcm-mpgx
axios: GHSA-5c9x-8gcm-mpgx
frontend/package-lock.json
MED
GHSA-445q-vr5w-6q77
axios: GHSA-445q-vr5w-6q77
frontend/package-lock.json
MED
GHSA-3w6x-2g7m-8v23
axios: GHSA-3w6x-2g7m-8v23
frontend/package-lock.json
MED
GHSA-87hc-h4r5-73f7
werkzeug: GHSA-87hc-h4r5-73f7
backend/uv.lock
MED
GHSA-29vq-49wr-vm6x
werkzeug: GHSA-29vq-49wr-vm6x
backend/uv.lock
MED
GHSA-597g-3phw-6986
virtualenv: GHSA-597g-3phw-6986
backend/uv.lock
MED
GHSA-32r8-54hf-c9p3
unstructured: GHSA-32r8-54hf-c9p3
backend/uv.lock
MED
GHSA-69w3-r845-3855
transformers: GHSA-69w3-r845-3855
backend/uv.lock
MED
GHSA-78cv-mqj4-43f7
tornado: GHSA-78cv-mqj4-43f7
backend/uv.lock
MED
GHSA-gc5v-m9x4-r6x2
requests: GHSA-gc5v-m9x4-r6x2
backend/uv.lock
MED
GHSA-mj87-hwqh-73pj
python-multipart: GHSA-mj87-hwqh-73pj
backend/uv.lock
MED
GHSA-mf9w-mj56-hr94
python-dotenv: GHSA-mf9w-mj56-hr94
backend/uv.lock
MED
GHSA-6w46-j5rx-g56g
pytest: GHSA-6w46-j5rx-g56g
backend/uv.lock
MED
GHSA-x7hp-r3qg-r3cj
pypdf: GHSA-x7hp-r3qg-r3cj
backend/uv.lock
MED
GHSA-x284-j5p8-9c5p
pypdf: GHSA-x284-j5p8-9c5p
backend/uv.lock
MED
GHSA-wgvp-vg3v-2xq3
pypdf: GHSA-wgvp-vg3v-2xq3
backend/uv.lock
MED
GHSA-qpxp-75px-xjcp
pypdf: GHSA-qpxp-75px-xjcp
backend/uv.lock
MED
GHSA-jj6c-8h6c-hppx
pypdf: GHSA-jj6c-8h6c-hppx
backend/uv.lock
MED
GHSA-hqmh-ppp3-xvm7
pypdf: GHSA-hqmh-ppp3-xvm7
backend/uv.lock
MED
GHSA-f2v5-7jq9-h8cg
pypdf: GHSA-f2v5-7jq9-h8cg
backend/uv.lock
MED
GHSA-9mvc-8737-8j8h
pypdf: GHSA-9mvc-8737-8j8h
backend/uv.lock
MED
GHSA-9m86-7pmv-2852
pypdf: GHSA-9m86-7pmv-2852
backend/uv.lock
MED
GHSA-996q-pr4m-cvgq
pypdf: GHSA-996q-pr4m-cvgq
backend/uv.lock
MED
GHSA-87mj-5ggw-8qc3
pypdf: GHSA-87mj-5ggw-8qc3
backend/uv.lock
MED
GHSA-7gw9-cf7v-778f
pypdf: GHSA-7gw9-cf7v-778f
backend/uv.lock
MED
GHSA-4pxv-j86v-mhcw
pypdf: GHSA-4pxv-j86v-mhcw
backend/uv.lock
MED
GHSA-3crg-w4f6-42mx
pypdf: GHSA-3crg-w4f6-42mx
backend/uv.lock
MED
GHSA-2q4j-m29v-hq73
pypdf: GHSA-2q4j-m29v-hq73
backend/uv.lock
MED
GHSA-r73j-pqj5-w3x7
pillow: GHSA-r73j-pqj5-w3x7
backend/uv.lock
MED
GHSA-rf74-v2fm-23pw
nltk: GHSA-rf74-v2fm-23pw
backend/uv.lock
MED
GHSA-gfwx-w7gr-fvh7
nltk: GHSA-gfwx-w7gr-fvh7
backend/uv.lock
MED
GHSA-7jqv-fw35-gmx9
nbconvert: GHSA-7jqv-fw35-gmx9
backend/uv.lock
MED
GHSA-4c99-qj7h-p3vg
nbconvert: GHSA-4c99-qj7h-p3vg
backend/uv.lock
MED
GHSA-v87v-83h2-53w7
mistune: GHSA-v87v-83h2-53w7
backend/uv.lock
MED
GHSA-8g87-j6q8-g93x
mistune: GHSA-8g87-j6q8-g93x
backend/uv.lock
MED
GHSA-428g-f7cq-pgp5
marshmallow: GHSA-428g-f7cq-pgp5
backend/uv.lock
MED
GHSA-65pc-fj4g-8rjx
idna: GHSA-65pc-fj4g-8rjx
backend/uv.lock
MED
GHSA-qmgc-5h2g-mvrw
filelock: GHSA-qmgc-5h2g-mvrw
backend/uv.lock
MED
GHSA-mf9w-mj56-hr94
python-dotenv: GHSA-mf9w-mj56-hr94
backend/requirements.txt
MED
GHSA-mr82-8j83-vxmv
pydantic: GHSA-mr82-8j83-vxmv
backend/requirements.txt
MED
DKR001
Docker final stage has no non-root USER
Dockerfile:1
MED
DKR014
Dockerfile copies broad context with incomplete .dockerignore
Dockerfile:24
MED
CORE_LARGE_FILES
Average file size is 700 lines (recommend <300)
—
LOW
COMP001
[COMP001] High cognitive complexity: Function `poll_commands` has cognitive complexity 8 …
backend/app/services/simulation_ipc.py:332
LOW
COMP001
[COMP001] High cognitive complexity: Function `send_command` has cognitive complexity 10 …
backend/app/services/simulation_ipc.py:117
LOW
COMP001
[COMP001] High cognitive complexity: Function `update_task` has cognitive complexity 13 (…
backend/app/models/task.py:108
LOW
DEPCUR-NPM
npm package `vue-i18n` is minor version(s) behind (11.3.0 -> 11.4.4)
frontend/package.json
LOW
DEPCUR-NPM
npm package `axios` is minor version(s) behind (1.14.0 -> 1.17.0)
frontend/package.json
LOW
DEPCUR-PY
Python package `zep-cloud` is minor version(s) behind (3.13.0 -> 3.23.0)
backend/requirements.txt:17
LOW
GHSA-xhjh-pmcv-23jw
axios: GHSA-xhjh-pmcv-23jw
frontend/package-lock.json
LOW
GHSA-4xc4-762w-m6cg
pypdf: GHSA-4xc4-762w-m6cg
backend/uv.lock
LOW
GHSA-4f6g-68pf-7vhv
pypdf: GHSA-4f6g-68pf-7vhv
backend/uv.lock
LOW
GHSA-2rw7-x74f-jg35
pypdf: GHSA-2rw7-x74f-jg35
backend/uv.lock
LOW
GHSA-5239-wwwm-4pmq
pygments: GHSA-5239-wwwm-4pmq
backend/uv.lock
LOW
GHSA-68rp-wp8r-4726
flask: GHSA-68rp-wp8r-4726
backend/uv.lock
LOW
GHSA-68rp-wp8r-4726
flask: GHSA-68rp-wp8r-4726
backend/requirements.txt
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationView.vue:322
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationView.vue:80
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationView.vue:51
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationView.vue:1
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationRunView.vue:340
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationRunView.vue:85
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/SimulationRunView.vue:1
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/ReportView.vue:1
LOW
AIC003
Duplicated implementation block across source files
frontend/src/views/MainView.vue:1
LOW
AIC003
Duplicated implementation block across source files
backend/scripts/run_twitter_simulation.…:19
LOW
DKR008
.dockerignore misses sensitive defaults
.dockerignore
LOW
DKC010
Compose service lacks no-new-privileges hardening
docker-compose.yml:1
LOW
DKC006
Compose service does not declare a runtime user
docker-compose.yml:1
INFO
MINED044
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger …
frontend/src/api/index.js:20
INFO
MINED050
[MINED050] Stub Only Function: Function declared but body is just pass, return None, rais…
backend/app/utils/retry.py:39
INFO
MINED050
[MINED050] Stub Only Function: Function declared but body is just pass, return None, rais…
backend/app/utils/file_parser.py:33
INFO
MINED050
[MINED050] Stub Only Function: Function declared but body is just pass, return None, rais…
backend/app/services/simulation_ipc.py:169
INFO
MINED062
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.
backend/app/services/simulation_ipc.py:40
INFO
MINED062
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.
backend/app/models/task.py:24
INFO
MINED062
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.
backend/app/models/project.py:26
INFO
MINED065
[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o…
backend/app/__init__.py:43
INFO
DEPCUR-NPM
npm package `@vitejs/plugin-vue` is patch version(s) behind (6.0.2 -> 6.0.7)
frontend/package.json
INFO
DEPCUR-PY
Python package `camel-ai` is patch version(s) behind (0.2.78 -> 0.2.90)
backend/requirements.txt:22