moinulmoin/voicetypr

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

48 of your 187 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 1.7s · analysis 37.97s · 3.7 MB · GitHub API rate-limit (preflight)

https://github.com/moinulmoin/voicetypr · scanned 2026-06-06 00:11 UTC (4 days, 2 hours ago) · 10 languages

362 raw signals (170 security + 192 graph) 49th percentile · Typescript · medium (20-100K LoC) System graph score 62 (higher by 6)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 2 hours ago · v2 · 187 actionable findings from 2 signal sources. 79 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 58 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	33.1	0.25	8.28
`testing_score`	92.0	0.20	18.40
`documentation_score`	71.7	0.15	10.76
`practices_score`	80.0	0.15	12.00
`code_quality`	64.8	0.10	6.48
Overall		1.00	68.7

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 5 High 61 Medium 28 Low 66 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 129 System graph 58 Crowd 0 Layer: Quality 21 Security 12 Software 129 Cicd 4 Api 1 Frontend 20

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B- (69/100). Dimensions: security 33, maintainability 85. 170 findings (113 security). 52,501 lines analyzed.

Showing 159 of 187 actionable findings. 266 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks software dependencies conf 0.88 handlebars: GHSA-2w6w-674q-4c4q

Handlebars.js has JavaScript Injection via AST Type Confusion

pnpm-lock.yaml

critical Security checks software dependencies conf 0.88 vitest: GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

pnpm-lock.yaml

low Security checks cicd CI/CD security conf 0.35 ✓ Repobility Workflow references repository secrets in a pull_request workflow

Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.

.github/workflows/claude-code-review.yml:38 CI/CD securityworkflow secretsGitHub Actions

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in .github/workflows/release.yml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 438, 443

.github/workflows/release.yml:438, 443 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in scripts/release-separate.sh

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

scripts/release-separate.sh:124

high Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

src-tauri/src/audio/normalizer.rs:26

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

src-tauri/src/audio/converter.rs:34

high Security checks software dependencies conf 0.88 atk-sys: RUSTSEC-2024-0416

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 atk: RUSTSEC-2024-0413

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 bytes: RUSTSEC-2026-0007

Integer overflow in `BytesMut::reserve`

src-tauri/Cargo.lock

high Security checks security auth conf 0.78 Consent is collected in UI without visible backend audit persistence

A frontend journey appears to ask for consent to share identity/KYC/biometric data, but backend code does not show a consent audit model with scope, purpose, legal text version, timestamp, IP, or user-agent evidence.

src/components/tabs/OverviewTab.tsx:269

high Security checks software dependencies conf 0.88 derivative: RUSTSEC-2024-0388

`derivative` is unmaintained; consider using an alternative

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 dotenv: RUSTSEC-2021-0141

dotenv is Unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 flatted: GHSA-25h7-pfq9-p65f

flatted vulnerable to unbounded recursion DoS in parse() revive phase

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 flatted: GHSA-rf6f-7fwh-wjgh

Prototype Pollution via parse() in NodeJS flatted

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 fxhash: RUSTSEC-2025-0057

fxhash - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gdk-sys: RUSTSEC-2024-0418

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gdk: RUSTSEC-2024-0412

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gdkwayland-sys: RUSTSEC-2024-0411

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gdkx11-sys: RUSTSEC-2024-0414

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gdkx11: RUSTSEC-2024-0417

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 31 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 31 locations

.github/workflows/release.yml:37, 76, 81, 187, 201, 206, 303, 320, +2 more (14 hits)

.github/workflows/ci.yml:19, 22, 56, 59, 92, 107, 110, 194 (13 hits)

.github/workflows/claude-code-review.yml:30 (2 hits)

.github/workflows/claude.yml:29 (2 hits)

CI/CD securitySupply chainGitHub Actions

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 29 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `pnpm/action-setup` pinned to mutable ref `@v3` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 29 locations

.github/workflows/release.yml:86, 91, 96, 211, 216, 221, 330, 335, +2 more (13 hits)

.github/workflows/ci.yml:27, 64, 69, 115, 124, 129 (12 hits)

.github/workflows/claude-code-review.yml:36 (2 hits)

.github/workflows/claude.yml:35 (2 hits)

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 glib: RUSTSEC-2024-0429

Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gtk-sys: RUSTSEC-2024-0420

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gtk3-macros: RUSTSEC-2024-0419

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 gtk: RUSTSEC-2024-0415

gtk-rs GTK3 bindings - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 handlebars: GHSA-3mfm-83xf-c92r

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 handlebars: GHSA-9cx6-37pm-9jff

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 handlebars: GHSA-xhpv-hc6g-r9c6

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 handlebars: GHSA-xjpj-3mr7-gcpf

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 lodash: GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 minimatch: GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 minimatch: GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 minimatch: GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 openssl: GHSA-8c75-8mhr-p7r9

rust-openssl has incorrect bounds assertion in aes key wrap

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-ghm9-cr32-g9qj

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-hppc-g8h3-xhp3

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-pqf5-4pqq-29f5

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-xp3w-r5p5-63rr

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 paste: RUSTSEC-2024-0436

paste - no longer maintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 proc-macro-error: RUSTSEC-2024-0370

proc-macro-error is unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 quinn-proto: RUSTSEC-2026-0037

Denial of service in Quinn endpoints

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 rand: RUSTSEC-2026-0097

Rand is unsound with a custom logger using `rand::rng()`

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 rkyv: RUSTSEC-2026-0001

Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 rollup: GHSA-mw96-cpmx-2vgc

Rollup 4 has Arbitrary File Write via Path Traversal

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0049

CRLs not considered authoritative by Distribution Point due to faulty matching logic

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0098

Name constraints for URI names were incorrectly accepted

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0099

Name constraints were accepted for certificates asserting a wildcard name

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0104

Reachable panic in certificate revocation list parsing

src-tauri/Cargo.lock

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/components/OpenAICompatConfigModal.tsx:142

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/components/ApiKeyModal.tsx:110

high Security checks software dependencies conf 0.88 tar: GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-83g3-92jg-28cx

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-8qq5-rm4j-mr97

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-9ppj-qmqm-q256

node-tar Symlink Path Traversal via Drive-Relative Linkpath

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-qffp-2rhf-9h96

tar has Hardlink Path Traversal via Drive-Relative Linkpath

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-r6q2-hw4h-h46w

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: RUSTSEC-2026-0067

`unpack_in` can chmod arbitrary directories by following symlinks

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 tar: RUSTSEC-2026-0068

tar-rs incorrectly ignores PAX size headers if header size is nonzero

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 time: RUSTSEC-2026-0009

Denial of Service via Stack Exhaustion

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 unic-char-property: RUSTSEC-2025-0081

`unic-char-property` is unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 unic-char-range: RUSTSEC-2025-0075

`unic-char-range` is unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 unic-common: RUSTSEC-2025-0080

`unic-common` is unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 unic-ucd-ident: RUSTSEC-2025-0100

`unic-ucd-ident` is unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 unic-ucd-version: RUSTSEC-2025-0098

`unic-ucd-version` is unmaintained

src-tauri/Cargo.lock

high Security checks software dependencies conf 0.88 vite: GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 @conventional-changelog/git-client: GHSA-vh25-5764-9wcr

@conventional-changelog/git-client has Argument Injection vulnerability

pnpm-lock.yaml

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

medium Security checks software dependencies conf 0.88 ajv: GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 handlebars: GHSA-2qvq-rjwj-gvw9

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 handlebars: GHSA-7rx3-28cr-v5wh

Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 lodash: GHSA-f23m-r3pf-42rh

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 lodash: GHSA-xxjr-mmjv-4gpg

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

pnpm-lock.yaml

medium Security checks software dependencies conf 0.90 npm package `@eslint/js` is 1 major version(s) behind (^9.39.1 -> 10.0.1)

`@eslint/js` is pinned/resolved at ^9.39.1 but the latest stable release on the npm registry is 10.0.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `@types/react-dom` is 1 major version(s) behind (^18.3.1 -> 19.2.3)

`@types/react-dom` is pinned/resolved at ^18.3.1 but the latest stable release on the npm registry is 19.2.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `@vitejs/plugin-react` is 2 major version(s) behind (^4.3.4 -> 6.0.2)

`@vitejs/plugin-react` is pinned/resolved at ^4.3.4 but the latest stable release on the npm registry is 6.0.2 (2 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rai…

package.json

medium Security checks software dependencies conf 0.90 npm package `@vitest/ui` is 1 major version(s) behind (^3.2.4 -> 4.1.8)

`@vitest/ui` is pinned/resolved at ^3.2.4 but the latest stable release on the npm registry is 4.1.8 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `jsdom` is 3 major version(s) behind (^26.1.0 -> 29.1.1)

`jsdom` is pinned/resolved at ^26.1.0 but the latest stable release on the npm registry is 29.1.1 (3 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.88 openssl: GHSA-phqj-4mhp-q6mq

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

src-tauri/Cargo.lock

medium Security checks software dependencies conf 0.88 openssl: GHSA-xv59-967r-8726

rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding

src-tauri/Cargo.lock

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

pnpm-lock.yaml

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 tar: GHSA-3pv8-6f4r-ffg2

tar has a PAX header desynchronization issue

src-tauri/Cargo.lock

medium Security checks software dependencies conf 0.88 tauri: GHSA-7gmj-67g7-phm9

Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands

src-tauri/Cargo.lock

medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 vite: GHSA-93m4-6634-74q7

vite allows server.fs.deny bypass via backslash on Windows

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

pnpm-lock.yaml

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/hooks/useProviderModels.test.ts:66

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

3 files, 3 locations

.github/workflows/claude-code-review.yml

.github/workflows/claude.yml

.github/workflows/release.yml

CI/CD securitySupply chainGithub actions

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

auth

low Security checks quality Quality conf 0.60 8 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

7 files, 8 locations

src-tauri/src/ai/openai.rs:79, 167 (2 hits)

src-tauri/src/ai/gemini.rs:21

src/components/MicrophoneSelection.tsx:1

src/components/sections/ModelsSection.tsx:293

src/components/tabs/TabContainer.tsx:25

src/components/ui/combobox.tsx:5

src/hooks/useMicrophonePermission.ts:46

duplicationquality

low Security checks software dependencies conf 0.88 handlebars: GHSA-442j-39wm-28r2

Handlebars.js has a Property Access Validation Bypass in container.lookup

pnpm-lock.yaml

low Security checks software dependencies conf 0.90 npm package `@tauri-apps/api` is minor version(s) behind (^2 -> 2.11.0)

`@tauri-apps/api` is pinned/resolved at ^2 but the latest stable release on the npm registry is 2.11.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `@tauri-apps/cli` is minor version(s) behind (^2 -> 2.11.2)

`@tauri-apps/cli` is pinned/resolved at ^2 but the latest stable release on the npm registry is 2.11.2 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `@tauri-apps/plugin-dialog` is minor version(s) behind (^2.3.0 -> 2.7.1)

`@tauri-apps/plugin-dialog` is pinned/resolved at ^2.3.0 but the latest stable release on the npm registry is 2.7.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs …

package.json

low Security checks software dependencies conf 0.90 npm package `@tauri-apps/plugin-updater` is minor version(s) behind (^2.9.0 -> 2.10.1)

`@tauri-apps/plugin-updater` is pinned/resolved at ^2.9.0 but the latest stable release on the npm registry is 2.10.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PR…

package.json

low Security checks software dependencies conf 0.90 npm package `@testing-library/jest-dom` is minor version(s) behind (^6.6.3 -> 6.9.1)

`@testing-library/jest-dom` is pinned/resolved at ^6.6.3 but the latest stable release on the npm registry is 6.9.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs …

package.json

low Security checks software dependencies conf 0.90 npm package `react-error-boundary` is minor version(s) behind (^6.0.0 -> 6.1.2)

`react-error-boundary` is pinned/resolved at ^6.0.0 but the latest stable release on the npm registry is 6.1.2 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `tailwind-merge` is minor version(s) behind (^3.3.1 -> 3.6.0)

`tailwind-merge` is pinned/resolved at ^3.3.1 but the latest stable release on the npm registry is 3.6.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `tw-animate-css` is minor version(s) behind (^1.3.5 -> 1.4.0)

`tw-animate-css` is pinned/resolved at ^1.3.5 but the latest stable release on the npm registry is 1.4.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.88 openssl: GHSA-xmgf-hq76-4vx2

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

src-tauri/Cargo.lock

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt

low Security checks quality Quality conf 0.74 Public web app has no robots.txt

Public websites should publish a robots.txt file so crawlers and AI agents can discover crawl rules and sitemap locations without guessing.

robots.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml

low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/components/__tests__/ApiKeyModal.test.tsx