← Back to scan
File as GitHub Issue repo: zts212653/clowder-ai

Push this scan report to zts212653/clowder-ai

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

`self._model_paths` used but never assigned in __init__

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED024 [MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk. packages/api/src/domains/cats/services/…:116
CRIT MINED024 [MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk. packages/api/src/domains/cats/services/…:96
CRIT MINED024 [MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk. packages/api/src/domains/cats/services/…:105
HIGH MINED108 [MINED108] `self._ensure_loaded` used but never assigned in __init__: Method `synthesize`… scripts/services/tts-api.py:323
HIGH MINED108 [MINED108] `self._model_paths` used but never assigned in __init__: Method `_ensure_loade… scripts/services/tts-api.py:311
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… scripts/services/whisper-api.py:143
HIGH SEC114 [SEC114] path.join / Path() on user-controlled segment without containment check: filepat… packages/mcp-server/src/utils/path-util…:21
HIGH SEC114 [SEC114] path.join / Path() on user-controlled segment without containment check: filepat… packages/mcp-server/src/tools/file-tool…:69
HIGH MINED012 [MINED012] Curl Pipe Bash: curl ... | sh / bash — runs unverified network code. packages/api/src/utils/cli-resolve.ts:172
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… packages/api/src/routes/authorization.ts:54
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… packages/api/src/routes/audio-proxy.ts:39
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… packages/api/src/routes/agent-hooks.ts:100
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). scripts/restore-chat-md-to-redis.mjs:179
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). packages/api/src/infrastructure/connect…:175
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… packages/api/src/infrastructure/harness…:208
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… packages/api/src/infrastructure/connect…:28
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… packages/api/src/domains/memory/RecallF…:87
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … packages/api/src/domains/limb/LimbPairi…:57
HIGH MINED027 [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — Re… packages/api/src/infrastructure/websock…:168
HIGH MINED027 [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — Re… packages/api/src/domains/health/Activit…:172
HIGH MINED027 [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — Re… packages/api/src/domains/cats/services/…:120
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… packages/api/src/domains/cats/services/…:38
HIGH SEC035 [SEC035] Unbounded Resource Allocation — DoS risk: Allocating resources (buffers, recursi… packages/api/src/domains/cats/services/…:140
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … packages/api/src/config/session-strateg…:69
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … packages/api/src/config/governance/skil…:59
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … desktop/main.js:129
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… packages/api/src/config/capabilities/ca…:83
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… desktop/scripts/sync-agent-hooks-offlin…:41
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… desktop/main.js:82
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… packages/api/src/domains/cats/services/…:25
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… packages/api/src/domains/cats/services/…:114
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… cat-cafe-skills/writing-skills/render-g…:25
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… packages/api/src/domains/cats/services/…:124
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… packages/api/src/domains/cats/services/…:237
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… cat-cafe-skills/writing-skills/render-g…:59
HIGH MINED115 [MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/u… .github/workflows/build-mac-dmg.yml:100
HIGH MINED115 [MINED115] Action `softprops/action-gh-release` pinned to mutable ref `@v2`: `uses: softp… .github/workflows/build-mac-dmg.yml:93
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/build-mac-dmg.yml:76
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/build-mac-dmg.yml:74
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/build-mac-dmg.yml:58
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/ci.yml:70
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/ci.yml:58
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/ci.yml:57
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/ci.yml:56
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/ci.yml:43
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/ci.yml:42
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/ci.yml:41
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/ci.yml:30
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/ci.yml:29
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/ci.yml:28
HIGH MINED115 [MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/u… .github/workflows/build-windows-desktop…:103
HIGH MINED115 [MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/u… .github/workflows/build-windows-desktop…:95
HIGH MINED115 [MINED115] Action `softprops/action-gh-release` pinned to mutable ref `@v2`: `uses: softp… .github/workflows/build-windows-desktop…:86
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/build-windows-desktop…:59
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/build-windows-desktop…:57
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/build-windows-desktop…:41
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/windows-smoke.yml:30
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/windows-smoke.yml:29
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/windows-smoke.yml:28
HIGH MINED122 [MINED122] package.json dep `eslint-plugin-cafe` pulled from URL/Git: `devDependencies.es… packages/web/package.json:1
HIGH JRN009 Secret-like setting is echoed into a password input value packages/web/src/components/hub-account…:81
HIGH JRN009 Secret-like setting is echoed into a password input value packages/web/src/components/WeComBotSet…:124
HIGH JRN009 Secret-like setting is echoed into a password input value packages/web/src/components/UnifiedAuth…:313
HIGH MINED113 [MINED113] Express POST /api/backlog/import-active-features has no auth: Express route PO… packages/api/src/routes/backlog.ts:327
HIGH MINED113 [MINED113] Express POST /api/backlog/items has no auth: Express route POST /api/backlog/i… packages/api/src/routes/backlog.ts:301
HIGH MINED113 [MINED113] Express POST /api/task-outcome/terminal-state has no auth: Express route POST … packages/api/src/routes/task-outcome.ts:99
HIGH MINED113 [MINED113] Express POST /api/task-outcome/a1 has no auth: Express route POST /api/task-ou… packages/api/src/routes/task-outcome.ts:89
HIGH MINED113 [MINED113] Express POST /api/task-outcome/magic-word has no auth: Express route POST /api… packages/api/src/routes/task-outcome.ts:79
HIGH MINED113 [MINED113] Express POST /api/task-outcome/cancel has no auth: Express route POST /api/tas… packages/api/src/routes/task-outcome.ts:69
HIGH MINED113 [MINED113] Express POST /api/threads/read/mark-all has no auth: Express route POST /api/t… packages/api/src/routes/threads.ts:683
HIGH MINED113 [MINED113] Express DELETE /api/threads/:id has no auth: Express route DELETE /api/threads… packages/api/src/routes/threads.ts:538
HIGH MINED113 [MINED113] Express PATCH /api/threads/:id has no auth: Express route PATCH /api/threads/:… packages/api/src/routes/threads.ts:461
HIGH MINED113 [MINED113] Express POST /api/threads has no auth: Express route POST /api/threads declare… packages/api/src/routes/threads.ts:253
HIGH MINED113 [MINED113] Express POST /api/callbacks/guide-control has no auth: Express route POST /api… packages/api/src/routes/callback-guide-…:188
HIGH MINED113 [MINED113] Express POST /api/callbacks/guide-resolve has no auth: Express route POST /api… packages/api/src/routes/callback-guide-…:164
HIGH MINED113 [MINED113] Express POST /api/callbacks/get-available-guides has no auth: Express route PO… packages/api/src/routes/callback-guide-…:161
HIGH MINED113 [MINED113] Express POST /api/callbacks/start-guide has no auth: Express route POST /api/c… packages/api/src/routes/callback-guide-…:136
HIGH MINED113 [MINED113] Express POST /api/callbacks/update-guide-state has no auth: Express route POST… packages/api/src/routes/callback-guide-…:101
HIGH MINED113 [MINED113] Express POST /api/memory/publish has no auth: Express route POST /api/memory/p… packages/api/src/routes/memory-publish.…:34
HIGH MINED113 [MINED113] Express POST /api/projects/mkdir has no auth: Express route POST /api/projects… packages/api/src/routes/projects-mkdir.…:17
HIGH MINED113 [MINED113] Express POST /api/sessions/sop-bookmark has no auth: Express route POST /api/s… packages/api/src/routes/session-hooks.ts:267
HIGH MINED113 [MINED113] Express POST /api/sessions/seal has no auth: Express route POST /api/sessions/… packages/api/src/routes/session-hooks.ts:81
HIGH MINED113 [MINED113] Express PUT /api/config/default-cat has no auth: Express route PUT /api/config… packages/api/src/routes/config.ts:419
HIGH MINED113 [MINED113] Express PATCH /api/config/env has no auth: Express route PATCH /api/config/env… packages/api/src/routes/config.ts:294
HIGH MINED113 [MINED113] Express PATCH /api/config/owner has no auth: Express route PATCH /api/config/o… packages/api/src/routes/config.ts:263
HIGH MINED113 [MINED113] Express PATCH /api/config/co-creator has no auth: Express route PATCH /api/con… packages/api/src/routes/config.ts:260
HIGH MINED113 [MINED113] Express PATCH /api/config has no auth: Express route PATCH /api/config declare… packages/api/src/routes/config.ts:162
HIGH MINED113 [MINED113] Express POST /api/cats has no auth: Express route POST /api/cats declared with… packages/api/src/routes/cats.ts:479
HIGH MINED112 [MINED112] FastAPI POST /v1/embeddings has no auth: Handler `create_embeddings` is regist… scripts/services/embed-api.py:128
HIGH MINED112 [MINED112] FastAPI POST /v1/text/refine has no auth: Handler `refine` is registered with … scripts/services/llm-postprocess-api.py:141
HIGH MINED112 [MINED112] FastAPI POST /v1/audio/transcriptions has no auth: Handler `transcribe` is reg… scripts/services/qwen3-asr-api.py:96
HIGH MINED112 [MINED112] FastAPI POST /v1/audio/transcriptions has no auth: Handler `transcribe` is reg… scripts/services/whisper-api.py:82
HIGH MINED112 [MINED112] FastAPI POST /v1/audio/speech has no auth: Handler `synthesize_endpoint` is re… scripts/services/tts-api.py:481
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… packages/mcp-server/src/tools/hub-actio…:73
HIGH JRN004 Consent is collected in UI without visible backend audit persistence packages/api/src/routes/connector-hub.ts:720
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… scripts/services/whisper-api.py:143
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … packages/api/src/routes/callback-bootca…:236
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … packages/api/src/routes/callback-bootca…:236
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … packages/api/src/infrastructure/connect…:220
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. packages/api/src/domains/cats/services/…:70
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. packages/api/src/domains/cats/services/…:207
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. packages/api/src/domains/cats/services/…:195
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … packages/api/src/domains/cats/services/…:114
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … cat-cafe-skills/writing-skills/render-g…:25
MED MINED124 [MINED124] requirements.txt: `3. 状态栏在 kickoff 时默认 `[ ]`，完成后在 quality-gate 阶段改为 `[x]`。` ha… cat-cafe-skills/refs/requirements-check…:31
MED MINED124 [MINED124] requirements.txt: `2. “验证方式”必须可执行：测试名/截图/录屏/人工步骤至少一种。` has no version pin: Unp… cat-cafe-skills/refs/requirements-check…:30
MED MINED124 [MINED124] requirements.txt: `1. “需求点”优先用铲屎官原话，必要时可补一句工程化转述。` has no version pin: Unpinne… cat-cafe-skills/refs/requirements-check…:29
MED MINED124 [MINED124] requirements.txt: ````` has no version pin: Unpinned pip requirement means eve… cat-cafe-skills/refs/requirements-check…:25
MED MINED124 [MINED124] requirements.txt: `| R3 | “...” | AC-3 | test / screenshot / manual | [ ] |` h… cat-cafe-skills/refs/requirements-check…:19
MED MINED124 [MINED124] requirements.txt: `| R2 | “...” | AC-2 | test / screenshot / manual | [ ] |` h… cat-cafe-skills/refs/requirements-check…:18
MED MINED124 [MINED124] requirements.txt: `| R1 | “...” | AC-1 | test / screenshot / manual | [ ] |` h… cat-cafe-skills/refs/requirements-check…:17
MED MINED124 [MINED124] requirements.txt: `|----|---------------------------|---------|----------|----… cat-cafe-skills/refs/requirements-check…:16
MED MINED124 [MINED124] requirements.txt: `| ID | 需求点（铲屎官原话/转述） | AC 编号 | 验证方式 | 状态 |` has no version … cat-cafe-skills/refs/requirements-check…:15
MED MINED124 [MINED124] requirements.txt: ````markdown` has no version pin: Unpinned pip requirement m… cat-cafe-skills/refs/requirements-check…:12
MED MINED124 [MINED124] requirements.txt: `> 用途：在 kickoff/spec 阶段把需求点结构化，避免 AC 漏项。` has no version pin… cat-cafe-skills/refs/requirements-check…:3
MED AGT016 Codex session log reader may expose prompts or tool-call content packages/api/src/domains/cats/services/…:2
MED AGT016 Codex session log reader may expose prompts or tool-call content packages/api/src/domains/cats/services/…:6
MED AGT016 Codex session log reader may expose prompts or tool-call content desktop/service-manager.js:186
MED SEC005 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input. packages/mcp-server/src/tools/shell-too…:204
LOW COMP001 [COMP001] High cognitive complexity: Function `transcribe` has cognitive complexity 9 (So… scripts/services/whisper-api.py:82
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/memory/Summary…:21
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/memory/Generic…:6
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/memory/Generic…:5
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/memory/FlatSca…:133
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/memory/FlatSca…:5
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:32
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:37
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:195
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:56
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:279
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:71
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:258
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:256
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:529
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:41
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:140
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:32
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:192
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:260
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:193
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:131
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:108
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:174
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:113
LOW AIC003 Duplicated implementation block across source files packages/api/src/domains/cats/services/…:499
LOW AIC003 Duplicated implementation block across source files packages/api/src/config/governance/skil…:67
LOW AIC009 Multiple AI-agent scaffold marker files are present AGENTS.md:1
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… scripts/services/whisper-api.py:144
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. scripts/services/qwen3-asr-api.py:3
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… scripts/services/tts-install.sh:77
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… scripts/services/install-template.sh:125
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… scripts/init-cafe.sh:37
INFO MINED074 [MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.exa… packages/web/src/components/hub-account…:78
INFO MINED058 [MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escapi… packages/web/src/components/MermaidDiag…:78
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… packages/web/src/components/ConnectorBu…:21
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… packages/web/src/app/story-export/page.…:132
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… packages/web/src/app/story-export/grep-…:128
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. packages/api/src/domains/preview/previe…:53
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… packages/api/src/domains/memory/SecretS…:24
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. packages/web/src/hooks/useGuideEngine.ts:87
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. packages/api/src/services/ImageExporter…:129
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. packages/api/src/domains/cats/services/…:237
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… packages/api/src/domains/packs/PackLoad…:31
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… packages/api/src/domains/cats/services/…:23
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… packages/api/src/domains/cats/services/…:48
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… packages/api/src/infrastructure/securit…:3
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… packages/api/src/domains/preview/previe…:4
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… packages/api/src/config/frontend-origin…:10
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … packages/api/src/config/credentials.ts:91
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … packages/api/src/config/cat-catalog-sto…:204
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … packages/api/src/config/capabilities/ca…:46
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … desktop/afterPack.js:24
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … cat-cafe-skills/writing-skills/render-g…:81
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … cat-cafe-skills/ttfund-skills/scripts/t…:53
Reset to top 5 174 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `zts212653/clowder-ai`

**Score: 71/100 (A-)**  ·  174 findings  ·  scanned 2026-06-05 19:55 UTC  ·  834,114 LOC

| Severity | Count |
|---|---|
| CRITICAL | 3 |
| HIGH | 92 |
| MEDIUM | 24 |
| LOW | 28 |

📊 [Full filterable report](https://repobility.com/scan/5b66fd59-9503-4ef3-990f-ff5ca22a2c7d/)  ·  ![scorecard](https://repobility.com/scan/5b66fd59-9503-4ef3-990f-ff5ca22a2c7d/report.png?v=1780689302-s2)

### Top findings

1. **CRITICAL** `MINED024` — Js Eval Usage
   `packages/api/src/domains/cats/services/stores/redis/RedisPendingRequestStore.ts:116` · CWE-95 · ✓ Repobility
2. **CRITICAL** `MINED024` — Js Eval Usage
   `packages/api/src/domains/cats/services/stores/redis/RedisCommunityIssueStore.ts:96` · CWE-95 · ✓ Repobility
3. **CRITICAL** `MINED024` — Js Eval Usage
   `packages/api/src/domains/cats/services/runtime-session/RedisRuntimeSessionStore.ts:105` · CWE-95 · ✓ Repobility
4. **HIGH** `MINED108` — `self._ensure_loaded` used but never assigned in __init__
   `scripts/services/tts-api.py:323` · ✓ Repobility
5. **HIGH** `MINED108` — `self._model_paths` used but never assigned in __init__
   `scripts/services/tts-api.py:311` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/5b66fd59-9503-4ef3-990f-ff5ca22a2c7d/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 23 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'zts212653/clowder-ai' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.