Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
43 of your 193 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.24s · analysis 19.06s · 2.4 MB · GitHub preflight 418ms

fatedier/frp

https://github.com/fatedier/frp · scanned 2026-06-05 05:50 UTC (3 hours, 2 minutes ago) · 10 languages

251 findings (183 legacy + 68 scanner) 44th percentile · Go · medium (20-100K LoC) Scanner says 75 (lower by 4)

File as issue Image v2 schema
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 hours, 2 minutes ago · v2 · 217 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
72.3
/100
Repobility
70
183 legacy
9-layer
75
88.9% cov · 34 gaps
Critical
2
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 53.0 0.25 13.25
testing_score 85.0 0.20 17.00
documentation_score 63.0 0.15 9.45
practices_score 85.0 0.15 12.75
code_quality 60.7 0.10 6.07
Overall 1.00 71.3
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 106 Medium 28 Low 52 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 183 9-layer 34 Crowd 0 Layer: Software 130 Security 3 Quality 71 Api 1 Network 1 Cicd 11
Scan summary Repository scanned at 74.9/100 with 88.9% coverage. It contains 745 nodes across 14 cross-layer flows, written primarily in mixed languages. Engine surfaced 34 findings — concentrated in software (18), cicd (11), quality (2). Risk profile is high: 1 critical, 0 high, 11 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 183 of 217 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Legacy security credential_exposure conf 0.95 Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks detected a committed secret or credential pattern.
README.md:676 credential_exposurelegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).
Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.
pkg/util/util/util.go:18 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic.
Review and fix per the pattern semantics. See CWE-755 / for context.
pkg/util/net/udp.go:71 qualitylegacy
high Legacy quality quality conf 1.00 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables certificate verification — MITM risk. Ported from gosec G402 (Apache-2.0).
Remove the option. If self-signed certs are required, pin via RootCAs.
pkg/plugin/client/https2https.go:45 qualitylegacy
high Legacy quality quality conf 1.00 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables certificate verification — MITM risk. Ported from gosec G402 (Apache-2.0).
Remove the option. If self-signed certs are required, pin via RootCAs.
pkg/plugin/client/http2https.go:45 qualitylegacy
high Legacy quality quality conf 1.00 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name allows command injection. Ported from gosec G204 (Apache-2.0).
Use a constant command name and validate args via a whitelist.
pkg/config/v1/value_source.go:143 qualitylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/goreleaser.yml:11 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/build-and-push-image.yml:22 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/golangci-lint.yml:17 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-go` pinned to mutable ref `@v6`
`uses: actions/setup-go@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/goreleaser.yml:16 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-go` pinned to mutable ref `@v6`
`uses: actions/setup-go@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/golangci-lint.yml:18 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-node` pinned to mutable ref `@v6`
`uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/goreleaser.yml:19 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-node` pinned to mutable ref `@v6`
`uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/golangci-lint.yml:22 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/stale` pinned to mutable ref `@v10`
`uses: actions/stale@v10` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/stale.yml:22 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `golangci/golangci-lint-action` pinned to mutable ref `@v9`
`uses: golangci/golangci-lint-action@v9` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/golangci-lint.yml:32 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `goreleaser/goreleaser-action` pinned to mutable ref `@v7`
`uses: goreleaser/goreleaser-action@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/goreleaser.yml:33 dependencylegacy
high Legacy software dependency conf 0.88 github.com/go-jose/go-jose/v4: GO-2026-4945
Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
go.mod dependencylegacy
high Legacy software dependency conf 0.88 github.com/pion/dtls/v3: GO-2026-4479
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls
go.mod dependencylegacy
high Legacy software dependency conf 0.88 github.com/quic-go/quic-go: GO-2025-4233
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
go.mod dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility go.mod replaces `github.com/hashicorp/yamux` — redirects to fork `github.com/fatedier/yamux`
`replace github.com/hashicorp/yamux => github.com/fatedier/yamux` overrides the canonical dependency with a different source (redirects to fork `github.com/fatedier/yamux`). Local-path replaces are fine for monorepos but in published modules they can hide malicious forks from anyone who only audits…
go.mod:84 dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5005
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5006
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5013
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5014
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5015
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5016
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5017
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5018
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5019
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5020
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5021
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5023
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/crypto: GO-2026-5033
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-4918
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-5025
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-5026
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-5027
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-5028
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-5029
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/net: GO-2026-5030
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
go.mod dependencylegacy
high Legacy software dependency conf 0.88 golang.org/x/sys: GO-2026-5024
Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-3955
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4006
Excessive CPU consumption in ParseAddress in net/mail
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4007
Quadratic complexity when checking name constraints in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4008
ALPN negotiation error contains attacker controlled information in crypto/tls
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4009
Quadratic complexity when parsing some invalid inputs in encoding/pem
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4010
Insufficient validation of bracketed IPv6 hostnames in net/url
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4011
Parsing DER payload can cause memory exhaustion in encoding/asn1
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4012
Lack of limit when parsing cookies can cause memory exhaustion in net/http
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4013
Panic when validating certificates with DSA public keys in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4014
Unbounded allocation when parsing GNU sparse map in archive/tar
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4015
Excessive CPU consumption in Reader.ReadResponse in net/textproto
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4155
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2025-4175
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4337
Unexpected session resumption in crypto/tls
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4340
Handshake messages may be processed at the incorrect encryption level in crypto/tls
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4341
Memory exhaustion in query parameter parsing in net/url
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4342
Excessive CPU consumption when building archive index in archive/zip
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4602
FileInfo can escape from a Root in os
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4603
URLs in meta content attribute actions are not escaped in html/template
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4864
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4865
JsBraceDepth Context Tracking Bugs (XSS) in html/template
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4869
Unbounded allocation for old GNU sparse in archive/tar
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4870
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4918
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4946
Inefficient policy validation in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4947
Unexpected work during chain building in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4971
Panic in Dial and LookupPort when handling NUL byte on Windows in net
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4976
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4977
Quadratic string concatenation in consumePhrase in net/mail
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4980
Escaper bypass leads to XSS in html/template
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4981
Crash when handling long CNAME response in net
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4982
Bypass of meta content URL escaping causes XSS in html/template
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-4986
Quadratic string concatentation in consumeComment in net/mail
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-5037
Inefficient candidate hostname parsing in crypto/x509
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-5038
Quadratic complexity in WordDecoder.DecodeHeader in mime
go.mod dependencylegacy
high Legacy software dependency conf 0.88 stdlib: GO-2026-5039
Arbitrary inputs are included in errors without any escaping in net/textproto
go.mod dependencylegacy
medium Legacy security crypto conf 1.00 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks.
Enable SSL verification. Use verify=True (default) for requests. Pin certificates if needed.
pkg/transport/tls.go:149 cryptolegacy
medium Legacy quality quality conf 1.00 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).
Construct `&http.Server{Addr: ..., ReadHeaderTimeout: 5*time.Second, ReadTimeout: 10*time.Second, WriteTimeout: 30*time.Second}`.
pkg/plugin/client/internal/httpsserver/server.go:37 qualitylegacy
medium Legacy quality quality conf 1.00 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).
Construct `&http.Server{Addr: ..., ReadHeaderTimeout: 5*time.Second, ReadTimeout: 10*time.Second, WriteTimeout: 30*time.Second}`.
pkg/plugin/client/http_proxy.go:59 qualitylegacy
medium Legacy quality quality conf 1.00 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).
Construct `&http.Server{Addr: ..., ReadHeaderTimeout: 5*time.Second, ReadTimeout: 10*time.Second, WriteTimeout: 30*time.Second}`.
pkg/plugin/client/http_common.go:66 qualitylegacy
medium Legacy quality quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).
Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.
hack/run-e2e.sh:14 qualitylegacy
medium Legacy quality quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).
Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.
hack/run-e2e-compatibility.sh:15 qualitylegacy
medium Legacy software dependency conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2
brace-expansion: Large numeric range defeats documented `max` DoS protection
web/package-lock.json dependencylegacy
medium Legacy software dependency conf 0.88 github.com/Azure/go-ntlmssp: GHSA-pjcq-xvwq-hhpj
go-ntlmssp NTLM challenges can panic on malformed payloads
go.mod dependencylegacy
medium Legacy software dependency conf 0.88 github.com/quic-go/quic-go: GHSA-vvgj-x9jq-8cj9
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
go.mod dependencylegacy
medium Legacy software dependency conf 0.90 npm package `eslint-plugin-vue` is 1 major version(s) behind (9.33.0 -> 10.9.2)
`eslint-plugin-vue` is pinned/resolved at 9.33.0 but the latest stable release on the npm registry is 10.9.2 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `eslint-plugin-vue` is 1 major version(s) behind (9.33.0 -> 10.9.2)
`eslint-plugin-vue` is pinned/resolved at 9.33.0 but the latest stable release on the npm registry is 10.9.2 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `unplugin-auto-import` is 21 major version(s) behind (0.17.8 -> 21.0.0)
`unplugin-auto-import` is pinned/resolved at 0.17.8 but the latest stable release on the npm registry is 21.0.0 (21 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs r…
web/frpc/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `unplugin-auto-import` is 21 major version(s) behind (0.17.8 -> 21.0.0)
`unplugin-auto-import` is pinned/resolved at 0.17.8 but the latest stable release on the npm registry is 21.0.0 (21 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs r…
web/frps/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `unplugin-vue-components` is 32 major version(s) behind (0.26.0 -> 32.1.0)
`unplugin-vue-components` is pinned/resolved at 0.26.0 but the latest stable release on the npm registry is 32.1.0 (32 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PR…
web/frpc/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `unplugin-vue-components` is 32 major version(s) behind (0.26.0 -> 32.1.0)
`unplugin-vue-components` is pinned/resolved at 0.26.0 but the latest stable release on the npm registry is 32.1.0 (32 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PR…
web/frps/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `vue-router` is 1 major version(s) behind (4.6.4 -> 5.1.0)
`vue-router` is pinned/resolved at 4.6.4 but the latest stable release on the npm registry is 5.1.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
medium Legacy software dependency conf 0.90 npm package `vue-router` is 1 major version(s) behind (4.6.4 -> 5.1.0)
`vue-router` is pinned/resolved at 4.6.4 but the latest stable release on the npm registry is 5.1.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/frpc/src/api/http.ts:19
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
integrityfragile-runtimerobustness
medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/frps/src/api/http.ts:34
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
integrityfragile-runtimerobustness
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
golangci/golangci-lint-action@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/golangci-lint.yml:32 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
docker/setup-qemu-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:27 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
docker/setup-buildx-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:30 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:41 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:47 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
docker/build-push-action@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:64 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
docker/build-push-action@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:75 supply-chaingithub-actionspinned-dependencies
medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
goreleaser/goreleaser-action@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/goreleaser.yml:33 supply-chaingithub-actionspinned-dependencies
low Legacy quality error_handling conf 1.00 [ERR003] Ignored Error (Go): Ignoring error return values.
Handle the error or use errcheck linter.
client/proxy/proxy_wrapper.go:187 error_handlinglegacy
low Legacy quality error_handling conf 1.00 [ERR003] Ignored Error (Go): Ignoring error return values.
Handle the error or use errcheck linter.
client/health/health.go:179 error_handlinglegacy
low Legacy quality error_handling conf 1.00 [ERR003] Ignored Error (Go): Ignoring error return values.
Handle the error or use errcheck linter.
client/control_session.go:58 error_handlinglegacy
low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p
Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.
cmd/frpc/sub/proxy.go:52 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frps/src/views/Proxies.vue:81 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frps/src/views/ClientDetail.vue:285 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frps/src/utils/format.ts:1 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frps/src/api/http.ts:22 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frps/src/App.vue:20 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frps/eslint.config.js:1 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/views/VisitorList.vue:281 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/views/VisitorList.vue:231 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/views/VisitorList.vue:162 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/views/VisitorEdit.vue:8 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/views/VisitorDetail.vue:33 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/views/ProxyList.vue:323 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/visitor-form/VisitorXtcpSection.vue:27 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/visitor-form/VisitorXtcpSection.vue:22 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/visitor-form/VisitorTransportSection.vue:7 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/visitor-form/VisitorBaseSection.vue:8 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyTransportSection.vue:15 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyTransportSection.vue:14 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyRemoteSection.vue:23 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyNatSection.vue:5 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyMetadataSection.vue:5 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyLoadBalanceSection.vue:7 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyHttpSection.vue:8 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/proxy-form/ProxyHealthSection.vue:18 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
web/frpc/src/components/StatusPills.vue:64 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
cmd/frps/verify.go:2 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.
client/http/model/visitor_definition.go:68 qualitylegacy
low Legacy software dependency conf 0.90 GitHub Action `actions/setup-go@v6` is minor version(s) behind (latest v6.4.0)
`uses: actions/setup-go@v6` is minor version(s) behind the latest published release v6.4.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.
.github/workflows/goreleaser.yml:16 dependencylegacy
low Legacy software dependency conf 0.90 GitHub Action `actions/setup-go@v6` is minor version(s) behind (latest v6.4.0)
`uses: actions/setup-go@v6` is minor version(s) behind the latest published release v6.4.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.
.github/workflows/golangci-lint.yml:18 dependencylegacy
low Legacy software dependency conf 0.90 GitHub Action `actions/setup-node@v6` is minor version(s) behind (latest v6.4.0)
`uses: actions/setup-node@v6` is minor version(s) behind the latest published release v6.4.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.
.github/workflows/goreleaser.yml:19 dependencylegacy
low Legacy software dependency conf 0.90 GitHub Action `actions/setup-node@v6` is minor version(s) behind (latest v6.4.0)
`uses: actions/setup-node@v6` is minor version(s) behind the latest published release v6.4.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.
.github/workflows/golangci-lint.yml:22 dependencylegacy
low Legacy software dependency conf 0.90 GitHub Action `actions/stale@v10` is minor version(s) behind (latest v10.3.0)
`uses: actions/stale@v10` is minor version(s) behind the latest published release v10.3.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.
.github/workflows/stale.yml:22 dependencylegacy
low Legacy software dependency conf 0.90 GitHub Action `golangci/golangci-lint-action@v9` is minor version(s) behind (latest v9.2.1)
`uses: golangci/golangci-lint-action@v9` is minor version(s) behind the latest published release v9.2.1. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no covera…
.github/workflows/golangci-lint.yml:32 dependencylegacy
low Legacy software dependency conf 0.90 GitHub Action `goreleaser/goreleaser-action@v7` is minor version(s) behind (latest v7.2.2)
`uses: goreleaser/goreleaser-action@v7` is minor version(s) behind the latest published release v7.2.2. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverag…
.github/workflows/goreleaser.yml:33 dependencylegacy
low Legacy software dependency conf 0.90 npm package `@vue/eslint-config-typescript` is minor version(s) behind (14.7.0 -> 14.8.0)
`@vue/eslint-config-typescript` is pinned/resolved at 14.7.0 but the latest stable release on the npm registry is 14.8.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update…
web/frpc/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `@vue/eslint-config-typescript` is minor version(s) behind (14.7.0 -> 14.8.0)
`@vue/eslint-config-typescript` is pinned/resolved at 14.7.0 but the latest stable release on the npm registry is 14.8.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update…
web/frps/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `@vue/tsconfig` is minor version(s) behind (0.8.1 -> 0.9.1)
`@vue/tsconfig` is pinned/resolved at 0.8.1 but the latest stable release on the npm registry is 0.9.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `@vue/tsconfig` is minor version(s) behind (0.8.1 -> 0.9.1)
`@vue/tsconfig` is pinned/resolved at 0.8.1 but the latest stable release on the npm registry is 0.9.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `@vueuse/core` is minor version(s) behind (14.2.1 -> 14.3.0)
`@vueuse/core` is pinned/resolved at 14.2.1 but the latest stable release on the npm registry is 14.3.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `@vueuse/core` is minor version(s) behind (14.2.1 -> 14.3.0)
`@vueuse/core` is pinned/resolved at 14.2.1 but the latest stable release on the npm registry is 14.3.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `element-plus` is minor version(s) behind (2.13.5 -> 2.14.1)
`element-plus` is pinned/resolved at 2.13.5 but the latest stable release on the npm registry is 2.14.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `element-plus` is minor version(s) behind (2.13.5 -> 2.14.1)
`element-plus` is pinned/resolved at 2.13.5 but the latest stable release on the npm registry is 2.14.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `sass` is minor version(s) behind (1.98.0 -> 1.100.0)
`sass` is pinned/resolved at 1.98.0 but the latest stable release on the npm registry is 1.100.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `sass` is minor version(s) behind (1.98.0 -> 1.100.0)
`sass` is pinned/resolved at 1.98.0 but the latest stable release on the npm registry is 1.100.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `terser` is minor version(s) behind (5.46.1 -> 5.48.0)
`terser` is pinned/resolved at 5.46.1 but the latest stable release on the npm registry is 5.48.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frpc/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `terser` is minor version(s) behind (5.46.1 -> 5.48.0)
`terser` is pinned/resolved at 5.46.1 but the latest stable release on the npm registry is 5.48.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
low Legacy software dependency conf 0.90 npm package `vue-tsc` is minor version(s) behind (3.2.6 -> 3.3.3)
`vue-tsc` is pinned/resolved at 3.2.6 but the latest stable release on the npm registry is 3.3.3 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
web/frps/package.json dependencylegacy
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/auto-imports.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/components.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/env.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/eslint.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/src/main.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/src/svg.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/src/types/constants.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/src/types/proxy-status.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frpc/src/types/proxy-store.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/auto-imports.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/components.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/env.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/eslint.config.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/src/main.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/src/svg.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/src/types/client.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/src/types/proxy.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/frps/src/types/server.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/build-and-push-image.yml:22 supply-chaingithub-actionspinned-dependencies
low 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/goreleaser.yml:11 supply-chaingithub-actionspinned-dependencies
low 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/setup-go@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/goreleaser.yml:16 supply-chaingithub-actionspinned-dependencies
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
pkg/sdk/client/client.go:36 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
pkg/plugin/server/http.go:53 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
client/health/health.go:70 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.
Review and fix per the pattern semantics. See CWE-476 / for context.
web/frpc/src/api/http.ts:51 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.
Review and fix per the pattern semantics. See CWE-704 / for context.
web/frpc/src/stores/proxy.ts:82 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.
Review and fix per the pattern semantics. See CWE-704 / for context.
web/frpc/src/api/http.ts:55 qualitylegacy
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/63a5dcbb-05a2-49a9-ba26-bc3a6d948f74/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/63a5dcbb-05a2-49a9-ba26-bc3a6d948f74/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.