Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
101 of your 149 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

apache/superset

https://github.com/apache/superset · scanned 2026-06-05 07:58 UTC (5 days, 21 hours ago) · 10 languages

142 findings 11/13 scanners ran 78th percentile · Typescript · medium (20-100K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

68 actionable findings from 1 signal source. 74 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

Combined
80.2
/100
Security checks
80
68 findings
System graph
—
—% cov · 0 findings
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 100.0 0.25 25.00
testing_score 76.0 0.20 15.20
documentation_score 83.0 0.15 12.45
practices_score 79.0 0.15 11.85
code_quality 71.0 0.10 7.10
Overall 1.00 80.6
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 11 Medium 5 Low 6 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 68 System graph 0 Crowd 0 Layer: Quality 48 Security 7 Cicd 8 Software 5

Showing 22 of 68 actionable findings. 142 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED107] Missing import: `queue` used but not imported: The file uses `queue.something(...)` but never imports `queue`. This raises NameError at runtime the first time the line executes.
Add `import queue` at the top of the file.
scripts/benchmark_migration.py:83
low Security checks cicd CI/CD security conf 0.35 ✓ Repobility 9 occurrences Workflow references repository secrets in a pull_request workflow
Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.
3 files, 9 locations
.github/workflows/docker.yml:69, 70, 83, 84, 156, 157 (6 hits)
.github/workflows/check-python-deps.yml:51, 52 (2 hits)
.github/workflows/superset-e2e.yml:154
CI/CD securityworkflow secretsGitHub Actions
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection.
Review and fix per the pattern semantics. See CWE-78 / for context.
scripts/cypress_run.py:81
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection.
Review and fix per the pattern semantics. See CWE-78 / for context.
scripts/check-env.py:50
high Security checks quality Quality conf 1.00 ✓ Repobility 14 occurrences [MINED108] `self._fetch_github_pr` used but never assigned in __init__: Method `_get_github_login` of class `GitChangeLog` reads `self._fetch_github_pr`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self._fetch_github_pr = <default>` in __init__, or add a class-level default.
lines 115, 136, 138, 145, 197, 205, 206, 220, +5 more
RELEASING/changelog.py:115, 136, 138, 145, 197, 205, 206, 220, +5 more (14 hits)
high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences [MINED118] Dockerfile FROM `python:3.11.13-trixie` not pinned by digest: `FROM python:3.11.13-trixie` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Replace with: `FROM python:3.11.13-trixie@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).
2 files, 3 locations
superset-websocket/Dockerfile:15, 23 (2 hits)
.devcontainer/Dockerfile:2
high Security checks software dependencies conf 0.90 ✓ Repobility 18 occurrences [MINED126] Workflow container/services image `postgres:17-alpine` unpinned: `container/services image: postgres:17-alpine` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.
Replace with `postgres:17-alpine@sha256:<digest>`. Re-pin via Dependabot Docker scope.
5 files, 18 locations
.github/workflows/superset-python-integrationtest.yml:51, 64, 141, 150, 200 (5 hits)
.github/workflows/superset-python-presto-hive.yml:52, 61, 70, 116, 125 (5 hits)
.github/workflows/superset-e2e.yml:85, 92, 195, 202 (4 hits)
.github/workflows/superset-app-cli.yml:30, 39 (2 hits)
.github/workflows/superset-playwright.yml:71, 78 (2 hits)
high Security checks cicd CI/CD security conf 0.92 Dockerfile copies the entire context without .dockerignore
Create .dockerignore before using broad context copies, or copy only the required files and directories.
superset-websocket/Dockerfile:19 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.92 Dockerfile pipes a remote script into a shell
Download the artifact, verify its checksum or signature, pin the version, and then execute it.
.devcontainer/Dockerfile:16 CI/CD securitycontainers
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
medium Security checks quality Practices conf 1.00 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.
Add a .gitignore appropriate for your language/framework.
low Security checks security Injection conf 0.50 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.
Use subprocess with shell=False and a list of args. Never eval user input.
scripts/cypress_run.py:81
low Security checks security Injection conf 0.50 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.
Use subprocess with shell=False and a list of args. Never eval user input.
scripts/check-env.py:50
low Security checks quality Error handling conf 0.55 ✓ Repobility 5 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
2 files, 5 locations
superset-extensions-cli/src/superset_extensions_cli/cli.py:310, 454, 489, 605 (4 hits)
setup.py:35
Error handlingquality
high Security checks security auth conf 0.82 7 occurrences Browser storage is used for session token material
Prefer httpOnly, Secure, SameSite cookies or short-lived in-memory tokens. Avoid persistent browser storage for access, refresh, ID, or partner session tokens.
lines 121, 151, 230, 314, 337, 372, 427
superset-frontend/cypress-base/cypress/support/e2e.ts:121, 151, 230, 314, 337, 372, 427 (7 hits)
medium Security checks cicd CI/CD security conf 0.90 Docker build context has no .dockerignore
Add .dockerignore with at least .git, .env, private keys, dependency folders, build outputs, and local databases.
.dockerignore CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER
Add a non-root USER in the final runtime stage after files and permissions are prepared.
.devcontainer/Dockerfile:2 CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.90 Dockerfile installs dependencies after copying the full source tree
Copy dependency manifests first, install dependencies in a cached layer, then copy the rest of the source tree.
superset-websocket/Dockerfile:21 CI/CD securitycontainers
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.
.well-known/security.txt
low Security checks cicd CI/CD security conf 0.72 Dockerfile installs recommended OS packages
Add `--no-install-recommends` and explicitly list only packages the image needs.
.devcontainer/Dockerfile:6 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.72 6 occurrences Dockerfile keeps pip download cache
Use `pip install --no-cache-dir ...` in container builds.
lines 172, 235, 263, 266, 276, 285
Dockerfile:172, 235, 263, 266, 276, 285 (6 hits)
CI/CD securitycontainers
low Security checks quality Quality conf 0.60 4 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
4 files, 4 locations
scripts/generate_frontend_ts_tasklist.js:2
superset-frontend/.eslintrc.minimal.js:5
superset-frontend/cypress-base/cypress/e2e/explore/visualizations/shared.helper.js:2
superset-frontend/packages/superset-ui-chart-controls/src/sections/timeComparison.tsx:101
duplicationquality
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/5d27214b-831a-4ed2-ab07-27c1fa98ec8e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/5d27214b-831a-4ed2-ab07-27c1fa98ec8e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.