Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

kvcache-ai/ktransformers

https://github.com/kvcache-ai/ktransformers · scanned 2026-07-23 19:43 UTC (4 days, 15 hours ago)

626 raw signals (0 security + 626 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 15 hours ago · v4 · 606 actionable findings from 1 signal source. 20 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
65.6
/100
Security checks
66
0 findings
System graph
66
100.0% cov · 606 findings
Critical
18
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: low × excluding tests × Reset all
Severity: Critical 18 High 143 Medium 272 Low 147 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 606 Crowd 0 Layer: Software 15 Frontend 6 Security 398 Hardware 6 Cicd 3 Quality 108 Dependencies 70
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 65.6/100 with 100.0% coverage. It contains 6625 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 626 findings — concentrated in security (398), quality (108), dependencies (70). Risk profile is high: 18 critical, 143 high, 280 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 147 of 606 actionable findings. 626 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low System graph quality Maintenance conf 1.00 312 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph security Semgrep conf 0.55 avoid bind to all interfaces — archive/kt-sft/ktransformers/sft/metrics_utils/misc.py:318
Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file. Rule: python.lang.security.audit.network.bind.avoid-bind-to-all-inte…
archive/kt-sft/ktransformers/sft/metrics_utils/misc.py:318 SecurityPythonNon production context
low System graph security Semgrep conf 0.55 avoid bind to all interfaces — archive/kt-sft/ktransformers/util/utils.py:101
Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file. Rule: python.lang.security.audit.network.bind.avoid-bind-to-all-inte…
archive/kt-sft/ktransformers/util/utils.py:101 SecurityPythonNon production context
low System graph security Semgrep conf 0.55 avoid bind to all interfaces — archive/ktransformers/util/utils.py:161
Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file. Rule: python.lang.security.audit.network.bind.avoid-bind-to-all-inte…
archive/ktransformers/util/utils.py:161 SecurityPythonNon production context
low System graph security Trivy conf 1.00 CVE-2024-42459: elliptic 6.5.5 — archive/kt-sft/ktransformers/website/package-lock.json
elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended. Package: elliptic …
VulnCve 2024 42459
low System graph security Trivy conf 1.00 CVE-2024-42459: elliptic 6.5.5 — archive/ktransformers/website/package-lock.json
elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended. Package: elliptic …
VulnCve 2024 42459
low System graph security Trivy conf 1.00 CVE-2024-42460: elliptic 6.5.5 — archive/kt-sft/ktransformers/website/package-lock.json
elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. Package: elliptic Installed: 6.5.5 Fixed in: 6.5.7 Severity…
VulnCve 2024 42460
low System graph security Trivy conf 1.00 CVE-2024-42460: elliptic 6.5.5 — archive/ktransformers/website/package-lock.json
elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. Package: elliptic Installed: 6.5.5 Fixed in: 6.5.7 Severity…
VulnCve 2024 42460
low System graph security Trivy conf 1.00 CVE-2024-42461: elliptic 6.5.5 — archive/kt-sft/ktransformers/website/package-lock.json
elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. Package: elliptic Installed: 6.5.5 Fixed in: 6.5.7 Severity: LOW Fix…
VulnCve 2024 42461
low System graph security Trivy conf 1.00 CVE-2024-42461: elliptic 6.5.5 — archive/ktransformers/website/package-lock.json
elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. Package: elliptic Installed: 6.5.5 Fixed in: 6.5.7 Severity: LOW Fix…
VulnCve 2024 42461
low System graph security Trivy conf 1.00 CVE-2024-43796: express 4.19.2 — archive/kt-sft/ktransformers/website/package-lock.json
express: Improper Input Handling in Express Redirects Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0. Package: express Installed…
VulnCve 2024 43796
low System graph security Trivy conf 1.00 CVE-2024-43796: express 4.19.2 — archive/ktransformers/website/package-lock.json
express: Improper Input Handling in Express Redirects Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0. Package: express Installed…
VulnCve 2024 43796
low System graph security Trivy conf 1.00 CVE-2024-43799: send 0.18.0 — archive/kt-sft/ktransformers/website/package-lock.json
send: Code Execution Vulnerability in Send Library Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0. Package: send Installed: 0.18.0 Fixed in…
VulnCve 2024 43799
low System graph security Trivy conf 1.00 CVE-2024-43799: send 0.18.0 — archive/ktransformers/website/package-lock.json
send: Code Execution Vulnerability in Send Library Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0. Package: send Installed: 0.18.0 Fixed in…
VulnCve 2024 43799
low System graph security Trivy conf 1.00 CVE-2024-43800: serve-static 1.15.0 — archive/kt-sft/ktransformers/website/package-lock.json
serve-static: Improper Sanitization in serve-static serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. Package: serve-static Installed: 1.15.0 Fixed in: 1.1…
VulnCve 2024 43800
low System graph security Trivy conf 1.00 CVE-2024-43800: serve-static 1.15.0 — archive/ktransformers/website/package-lock.json
serve-static: Improper Sanitization in serve-static serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. Package: serve-static Installed: 1.15.0 Fixed in: 1.1…
VulnCve 2024 43800
low System graph security Trivy conf 1.00 CVE-2024-47764: cookie 0.6.0 — archive/kt-sft/ktransformers/website/package-lock.json
cookie: cookie accepts cookie name, path, and domain with out of bounds characters cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path a…
VulnCve 2024 47764
low System graph security Trivy conf 1.00 CVE-2024-47764: cookie 0.6.0 — archive/ktransformers/website/package-lock.json
cookie: cookie accepts cookie name, path, and domain with out of bounds characters cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path a…
VulnCve 2024 47764
low System graph security Trivy conf 1.00 CVE-2024-48948: elliptic 6.5.5 — archive/kt-sft/ktransformers/website/package-lock.json
elliptic: ECDSA signature verification error may reject legitimate transactions The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base poi…
VulnCve 2024 48948
low System graph security Trivy conf 1.00 CVE-2024-48948: elliptic 6.5.5 — archive/ktransformers/website/package-lock.json
elliptic: ECDSA signature verification error may reject legitimate transactions The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base poi…
VulnCve 2024 48948
low System graph security Trivy conf 1.00 CVE-2024-48949: elliptic 6.5.5 — archive/kt-sft/ktransformers/website/package-lock.json
elliptic: Missing Validation in Elliptic's EDDSA Signature Verification The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation. Package: elliptic Installed: 6.5.5 Fixed in: 6.5.6 Seve…
VulnCve 2024 48949
low System graph security Trivy conf 1.00 CVE-2024-48949: elliptic 6.5.5 — archive/ktransformers/website/package-lock.json
elliptic: Missing Validation in Elliptic's EDDSA Signature Verification The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation. Package: elliptic Installed: 6.5.5 Fixed in: 6.5.6 Seve…
VulnCve 2024 48949
low System graph security Trivy conf 1.00 CVE-2024-9506: vue 2.7.16 — archive/kt-sft/ktransformers/website/package-lock.json
vue: Regular Expression Denial of Service (ReDoS) Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. Package: vue Installed: 2.7.16 Fixed in: 3.0.0-alpha.0 Severity: LOW Fix: Upgrade vue to 3.0.0-alpha.0
VulnCve 2024 9506
low System graph security Trivy conf 1.00 CVE-2024-9506: vue 2.7.16 — archive/ktransformers/website/package-lock.json
vue: Regular Expression Denial of Service (ReDoS) Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. Package: vue Installed: 2.7.16 Fixed in: 3.0.0-alpha.0 Severity: LOW Fix: Upgrade vue to 3.0.0-alpha.0
VulnCve 2024 9506
low System graph security Trivy conf 1.00 CVE-2025-14505: elliptic 6.5.5 — archive/kt-sft/ktransformers/website/package-lock.json
elliptic: Key handling flaws in Elliptic The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, whi…
VulnCve 2025 14505
low System graph security Trivy conf 1.00 CVE-2025-14505: elliptic 6.5.5 — archive/ktransformers/website/package-lock.json
elliptic: Key handling flaws in Elliptic The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, whi…
VulnCve 2025 14505
low System graph security Trivy conf 1.00 CVE-2025-3000: torch 2.9.1 — kt-kernel/requirements.txt
A vulnerability classified as critical has been found in PyTorch 2.6.0 ... A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exp…
VulnCve 2025 3000
low System graph security Trivy conf 1.00 CVE-2025-3001: torch 2.9.1 — kt-kernel/requirements.txt
A vulnerability classified as critical was found in PyTorch 2.6.0. Thi ... A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit…
VulnCve 2025 3001
low System graph security Trivy conf 1.00 CVE-2025-54798: tmp 0.0.33 — archive/kt-sft/ktransformers/website/package-lock.json
tmp: tmp Symbolic Link Write Vulnerability tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4. Package: tmp Installed: 0.0.33 Fix…
VulnCve 2025 54798
low System graph security Trivy conf 1.00 CVE-2025-54798: tmp 0.0.33 — archive/ktransformers/website/package-lock.json
tmp: tmp Symbolic Link Write Vulnerability tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4. Package: tmp Installed: 0.0.33 Fix…
VulnCve 2025 54798
low System graph security Trivy conf 1.00 CVE-2025-5889: brace-expansion 1.1.11 — archive/kt-sft/ktransformers/website/package-lock.json
brace-expansion: juliangruber brace-expansion index.js expand redos A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient …
VulnCve 2025 5889
low System graph security Trivy conf 1.00 CVE-2025-5889: brace-expansion 1.1.11 — archive/ktransformers/website/package-lock.json
brace-expansion: juliangruber brace-expansion index.js expand redos A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient …
VulnCve 2025 5889
low System graph security Trivy conf 1.00 CVE-2025-5889: brace-expansion 2.0.1 — archive/kt-sft/ktransformers/website/package-lock.json
brace-expansion: juliangruber brace-expansion index.js expand redos A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient …
VulnCve 2025 5889
low System graph security Trivy conf 1.00 CVE-2025-5889: brace-expansion 2.0.1 — archive/ktransformers/website/package-lock.json
brace-expansion: juliangruber brace-expansion index.js expand redos A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient …
VulnCve 2025 5889
low System graph security Trivy conf 1.00 CVE-2025-68157: webpack 5.91.0 — archive/kt-sft/ktransformers/website/package-lock.json
webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-valida…
VulnCve 2025 68157
low System graph security Trivy conf 1.00 CVE-2025-68157: webpack 5.91.0 — archive/ktransformers/website/package-lock.json
webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-valida…
VulnCve 2025 68157
low System graph security Trivy conf 1.00 CVE-2025-68458: webpack 5.91.0 — archive/kt-sft/ktransformers/website/package-lock.json
webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resource…
VulnCve 2025 68458
low System graph security Trivy conf 1.00 CVE-2025-68458: webpack 5.91.0 — archive/ktransformers/website/package-lock.json
webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resource…
VulnCve 2025 68458
low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 1.20.2 — archive/kt-sft/ktransformers/website/package-lock.json
body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…
VulnCve 2026 12590
low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 1.20.2 — archive/ktransformers/website/package-lock.json
body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…
VulnCve 2026 12590
low System graph security Trivy conf 1.00 CVE-2026-2391: qs 6.11.0 — archive/kt-sft/ktransformers/website/package-lock.json
qs: qs's arrayLimit bypass in comma parsing allows denial of service ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit …
VulnCve 2026 2391
low System graph security Trivy conf 1.00 CVE-2026-2391: qs 6.11.0 — archive/ktransformers/website/package-lock.json
qs: qs's arrayLimit bypass in comma parsing allows denial of service ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit …
VulnCve 2026 2391
low System graph security Trivy conf 1.00 CVE-2026-2391: qs 6.12.1 — archive/kt-sft/ktransformers/website/package-lock.json
qs: qs's arrayLimit bypass in comma parsing allows denial of service ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit …
VulnCve 2026 2391
low System graph security Trivy conf 1.00 CVE-2026-2391: qs 6.12.1 — archive/ktransformers/website/package-lock.json
qs: qs's arrayLimit bypass in comma parsing allows denial of service ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit …
VulnCve 2026 2391
low System graph security Trivy conf 1.00 CVE-2026-42040: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Incorrect null byte handling can lead to data integrity issues Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses th…
VulnCve 2026 42040
low System graph security Trivy conf 1.00 CVE-2026-42040: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Incorrect null byte handling can lead to data integrity issues Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses th…
VulnCve 2026 42040
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.24.5 — archive/kt-sft/ktransformers/website/package-lock.json
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.24.5 — archive/ktransformers/website/package-lock.json
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — archive/kt-sft/ktransformers/website/src/assets/iconfont/iconfont.js:1
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
archive/kt-sft/ktransformers/website/src/assets/iconfont/iconfont.js:1 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — archive/kt-sft/ktransformers/website/src/components/chat/index.vue:339
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
archive/kt-sft/ktransformers/website/src/components/chat/index.vue:339 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — archive/kt-sft/ktransformers/website/src/views/home.vue:367
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
archive/kt-sft/ktransformers/website/src/views/home.vue:367 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — archive/ktransformers/website/src/assets/iconfont/iconfont.js:1
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
archive/ktransformers/website/src/assets/iconfont/iconfont.js:1 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — archive/ktransformers/website/src/components/chat/index.vue:339
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
archive/ktransformers/website/src/components/chat/index.vue:339 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — archive/ktransformers/website/src/views/home.vue:367
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
archive/ktransformers/website/src/views/home.vue:367 Fq console leak
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 1393 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency axios-extensions is a major version behind
`axios-extensions` is pinned at `3.1.6` in `archive/kt-sft/ktransformers/website/package.json` while the latest release on the npm registry is `4.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide…
archive/kt-sft/ktransformers/website/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency vue-router is a major version behind
`vue-router` is pinned at `4.0.3` in `archive/kt-sft/ktransformers/website/package.json` while the latest release on the npm registry is `5.2.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and u…
archive/kt-sft/ktransformers/website/package.json FreshnessOutdated
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: docker.1ms.run/nvidia/cuda:${CUDA_VERSION}-cudnn-devel-ubuntu24.04
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
docker/Dockerfile:2 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 3 occurrences Docker base image is tag-pinned but not digest-pinned: pytorch/pytorch:2.5.1-cuda12.1-cudnn9-devel
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
3 files, 3 locations
archive/.devcontainer/Dockerfile:1
archive/Dockerfile:1
archive/kt-sft/Dockerfile:1
containersPinned dependencies
low System graph security Trivy conf 1.00 DS-0014: RUN using 'wget' and 'curl' — docker/Dockerfile
RUN using 'wget' and 'curl' Shouldn't use both curl and wget Rule: DS-0014 Severity: LOW Target: docker/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — archive/.devcontainer/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: archive/.devcontainer/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — archive/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: archive/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — archive/Dockerfile.xpu
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: archive/Dockerfile.xpu
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — archive/kt-sft/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: archive/kt-sft/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — archive/kt-sft/Dockerfile.xpu
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: archive/kt-sft/Dockerfile.xpu
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — docker/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: docker/Dockerfile
Misconfig
low System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
3 files, 3 locations
.github/workflows/release-fake-tag.yml:21
.github/workflows/release-pypi.yml:36
.github/workflows/release-sglang-kt.yml:30
CI/CD securitySupply chainGithub actions
low System graph security security conf 1.00 Insecure pattern 'document_write' in archive/kt-sft/ktransformers/website/src/assets/iconfont/iconfont.js:1
Found a known-risky pattern (document_write). Review and replace if possible.
archive/kt-sft/ktransformers/website/src/assets/iconfont/iconfont.js:1 Document write
low System graph security security conf 1.00 Insecure pattern 'document_write' in archive/ktransformers/website/src/assets/iconfont/iconfont.js:1
Found a known-risky pattern (document_write). Review and replace if possible.
archive/ktransformers/website/src/assets/iconfont/iconfont.js:1 Document write
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same substantial AST body hash: archive/setup.py:80:get_musa_bare_metal_version, archive/kt-sft/setup.py:105:get_musa_bare_metal_version This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 4 places
Functions with the same substantial AST body hash: archive/setup.py:304:colored, archive/setup.py:337:colored, archive/kt-sft/setup.py:323:colored, archive/kt-sft/setup.py:356:colored This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene).…
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_deep_copy` in kt-kernel/python/cli/config/settings.py:95
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `custom_modeling_deepseek_v2` in archive/kt-sft/ktransformers/server/backend/interfaces/balance_serve.py:24
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `custom_modeling_deepseek_v2` in archive/kt-sft/ktransformers/server/balance_serve/inference/model_runner.py:29
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `custom_modeling_deepseek_v2` in archive/ktransformers/server/backend/interfaces/balance_serve.py:25
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `custom_modeling_deepseek_v2` in archive/ktransformers/server/balance_serve/inference/model_runner.py:34
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `deepseek_v2` in archive/kt-sft/ktransformers/configs/model_config/configuration_deepseek.py:112
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `deepseek_v2` in archive/kt-sft/ktransformers/models/configuration_deepseek.py:110
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `deepseek_v2` in archive/ktransformers/models/configuration_deepseek.py:110
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `env_backup` in kt-kernel/setup.py:302
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in archive/kt-sft/ktransformers/server/schemas/assistants/assistants.py:164
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in archive/ktransformers/server/schemas/assistants/assistants.py:164
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `moe_analysis_v2` in kt-kernel/python/cli/utils/analyze_moe_model.py:67
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: check_24
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/marlin_utils.py:127
low System graph software Dead code conf 1.00 Possibly dead Python function: compute_max_diff
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/marlin_utils.py:218
low System graph software Dead code conf 1.00 Possibly dead Python function: dequantize_weights
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/quant_utils.py:40
low System graph software Dead code conf 1.00 Possibly dead Python function: gptq_pack
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/quant_utils.py:153
low System graph software Dead code conf 1.00 Possibly dead Python function: gptq_unpack
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/quant_utils.py:176
low System graph software Dead code conf 1.00 Possibly dead Python function: is_marlin_supported
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/marlin_utils.py:31
low System graph software Dead code conf 1.00 Possibly dead Python function: marlin_24_quantize
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/marlin_utils.py:177
low System graph software Dead code conf 1.00 3 occurrences Possibly dead Python function: prepare_inputs_for_generation
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
3 files, 3 locations
archive/kt-sft/ktransformers/models/modeling_deepseek.py:1777
archive/kt-sft/ktransformers/models/modeling_deepseek_v3.py:1735
archive/kt-sft/ktransformers/models/modeling_llama.py:1377
low System graph software Dead code conf 1.00 Possibly dead Python function: preprocess_function
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/withoutKT_PEFT.py:21
low System graph software Dead code conf 1.00 Possibly dead Python function: save_model
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/withoutKT_PEFT.py:134
low System graph software Dead code conf 1.00 3 occurrences Possibly dead Python function: set_decoder
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
3 files, 3 locations
archive/kt-sft/ktransformers/models/modeling_deepseek.py:1669
archive/kt-sft/ktransformers/models/modeling_deepseek_v3.py:1628
archive/kt-sft/ktransformers/models/modeling_llama.py:1261
low System graph software Dead code conf 1.00 3 occurrences Possibly dead Python function: set_input_embeddings
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
3 files, 3 locations
archive/kt-sft/ktransformers/models/modeling_deepseek.py:1895
archive/kt-sft/ktransformers/models/modeling_deepseek_v3.py:1840
archive/kt-sft/ktransformers/models/modeling_llama.py:1689
low System graph software Dead code conf 1.00 3 occurrences Possibly dead Python function: set_output_embeddings
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
3 files, 3 locations
archive/kt-sft/ktransformers/models/modeling_deepseek.py:1666
archive/kt-sft/ktransformers/models/modeling_deepseek_v3.py:1625
archive/kt-sft/ktransformers/models/modeling_llama.py:1258
low System graph software Dead code conf 1.00 Possibly dead Python function: sparse_semi_structured_to_dense_cutlass
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/csrc/custom_marlin/utils/format24.py:184
low System graph software Dead code conf 1.00 Possibly dead Python function: write_to_file
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
archive/kt-sft/ktransformers/local_chat.py:56
low System graph quality Integrity conf 1.00 Stub function `_cumulate_input_tokens` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/server/balance_serve/inference/sampling/penaltylib/penalizers/frequency_penalty.py:53
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `_cumulate_input_tokens` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/server/balance_serve/inference/sampling/penaltylib/penalizers/min_new_tokens.py:81
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `_cumulate_input_tokens` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/server/balance_serve/inference/sampling/penaltylib/penalizers/presence_penalty.py:53
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `_cumulate_input_tokens` (body is just `pass`/`return`) — archive/ktransformers/server/balance_serve/inference/sampling/penaltylib/penalizers/frequency_penalty.py:53
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `_cumulate_input_tokens` (body is just `pass`/`return`) — archive/ktransformers/server/balance_serve/inference/sampling/penaltylib/penalizers/min_new_tokens.py:81
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `_cumulate_input_tokens` (body is just `pass`/`return`) — archive/ktransformers/server/balance_serve/inference/sampling/penaltylib/penalizers/presence_penalty.py:53
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `forward` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/operators/experts.py:77
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `forward` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/operators/gate.py:32
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `forward` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/operators/linear.py:80
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `forward` (body is just `pass`/`return`) — archive/ktransformers/operators/experts.py:77
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `forward` (body is just `pass`/`return`) — archive/ktransformers/operators/gate.py:32
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `forward` (body is just `pass`/`return`) — archive/ktransformers/operators/linear.py:89
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `get_interface` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/server/backend/interfaces/exllamav2.py:18
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `get_interface` (body is just `pass`/`return`) — archive/ktransformers/server/backend/interfaces/exllamav2.py:18
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `inplace_all_reduce_fake` (body is just `pass`/`return`) — archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/parallel_state.py:108
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `inplace_all_reduce_fake` (body is just `pass`/`return`) — archive/ktransformers/server/balance_serve/inference/distributed/parallel_state.py:108
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `load` (body is just `pass`/`return`) — archive/ktransformers/operators/ascend/ascend_linear.py:102
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/models/modeling_deepseek.py (1996 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/models/modeling_deepseek_v3.py (1941 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/models/modeling_llama.py (1745 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/models/modeling_mixtral.py (1735 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/models/modeling_qwen2_moe.py (1766 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/models/modeling_qwen3_moe.py (1472 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/operators/attention.py (1083 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/operators/experts.py (2310 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/operators/models.py (1756 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/sft/metrics_utils/constants.py (3464 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/sft/peft_utils/lora_layer.py (1161 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/kt-sft/ktransformers/sft/peft_utils/peft_model.py (1920 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_deepseek.py (1992 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_deepseek_v3.py (1955 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_llama.py (1744 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_mixtral.py (1734 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_qwen2_moe.py (1765 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_qwen3_moe.py (1471 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_qwen3_next.py (1286 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/models/modeling_smallthinker.py (1235 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/operators/ascend/ascend_attention.py (1263 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/operators/experts.py (2096 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: archive/ktransformers/operators/models.py (1395 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/bench/compare_moe_performance.py (1370 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/examples/modeling_deepseek_v3.py (1937 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/python/cli/commands/model.py (2810 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/python/cli/i18n.py (1345 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/python/utils/loader.py (1349 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/scripts/convert_cpu_weights.py (1236 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: kt-kernel/scripts/convert_cpu_weights_ds4.py (1396 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/core 7.24.5: GHSA-4x5r-pxfx-6jf8
OSV.dev reports `@babel/core` at version `7.24.5` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356). Note: `@babel/core` is a transitive dependency — pulled in by another package, not declared directly in a manifest. @bab…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 4x5r pxfx 6jf8
low System graph dependencies dependencies conf 0.70 Vulnerable dependency webpack 5.91.0: GHSA-38r7-794h-5758
OSV.dev reports `webpack` at version `5.91.0` (declared in `archive/kt-sft/ktransformers/website/package.json`) is affected by GHSA-38r7-794h-5758 (aka CVE-2025-68157). Note: `5.91.0` is the declared floor of a range — the installed version may be newer. webpack buildHttp HttpUriPlugin allowedUris…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 38r7 794h 5758
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/5a2dcb17-955a-4003-a052-52b5eb857cff/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/5a2dcb17-955a-4003-a052-52b5eb857cff/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.