Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
177 of your 427 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.65s · analysis 77.32s · 12.8 MB · GitHub API rate-limit (preflight)

dragonflydb/dragonfly

https://github.com/dragonflydb/dragonfly · scanned 2026-06-16 04:22 UTC (2 months ago) · 10 languages

419 raw signals (416 security + 3 graph) 80th percentile · C · large (100-500K LoC) System graph score 85 (lower by 14)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months ago · v1 · 190 actionable findings from 2 signal sources. 229 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
73.4
/100
Security checks
62
187 findings
System graph
85
55.6% cov · 3 findings
Critical
4
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 30.0 0.25 7.50
testing_score 100.0 0.20 20.00
documentation_score 95.0 0.15 14.25
practices_score 79.0 0.15 11.85
code_quality 44.5 0.10 4.45
Overall 1.00 70.8
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 4 High 86 Medium 18 Low 25 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 187 System graph 3 Crowd 0 Layer: Software 106 Cicd 17 Security 8 Quality 59
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 84.9/100 with 55.6% coverage. It contains 22 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 3 findings — concentrated in quality (2), security (1). Risk profile is low: 0 critical, 0 high, 3 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 107 of 190 actionable findings. 419 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks security secrets conf 0.95 4 occurrences Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks detected a committed secret or credential pattern.
2 files, 4 locations
tests/fakeredis/test/test_mixins/test_set_commands.py:425, 426, 427 (3 hits)
contrib/charts/dragonfly/ci/tls-values.golden.yaml:80
critical Security checks security secrets conf 0.95 3 occurrences Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
Gitleaks detected a committed secret or credential pattern.
3 files, 3 locations
contrib/charts/dragonfly/ci/tls-values.golden.yaml:36
contrib/charts/dragonfly/ci/tls-values.yaml:20
contrib/charts/dragonfly/values.yaml:133
high Security checks quality Quality conf 1.00 ✓ Repobility Missing import: `queue` used but not imported
The file uses `queue.something(...)` but never imports `queue`. This raises NameError at runtime the first time the line executes.
tools/defrag_db.py:49
critical Security checks security secrets conf 0.95 Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments
Gitleaks detected a committed secret or credential pattern.
contrib/charts/dragonfly/ci/extraenv-and-passwordSecret-values.yaml:3
critical Security checks security secrets conf 0.95 Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments
Gitleaks detected a committed secret or credential pattern.
contrib/charts/dragonfly/ci/extraenv-values.yaml:6
high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences `self.stacktrace` used but never assigned in __init__
Method `_wait_for_server` of class `DflyInstance` reads `self.stacktrace`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
2 files, 25 locations
tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py:197, 201, 203, 204, 205, 239, 253, 254, +8 more (19 hits)
tests/dragonfly/instance.py:218, 219, 220, 222, 266, 267 (6 hits)
high Security checks cicd CI/CD security conf 0.90 Compose service bind-mounts a sensitive host path
Mounting broad host paths exposes host files to the container and can turn app compromise into host compromise.
tools/local/monitoring/docker-compose.yml:54 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.92 Compose service explicitly runs as root
A root container process increases impact if the service is compromised.
tools/local/monitoring/docker-compose.yml:14 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.90 2 occurrences Compose service joins the host PID namespace
Sharing host namespaces reduces isolation and can expose host processes, networking, or IPC resources.
lines 42, 90
tools/local/monitoring/docker-compose.yml:42, 90 (2 hits)
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.84 Database service publishes a host port
Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports.
tools/local/monitoring/docker-compose.yml:106 CI/CD securitycontainers
high Security checks software dependencies conf 0.90 ✓ Repobility 16 occurrences Dockerfile FROM `node:18.7.0` not pinned by digest
`FROM node:18.7.0` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
10 files, 16 locations
tools/packaging/Dockerfile.alpine-dev:2, 3, 30 (3 hits)
tools/packaging/Dockerfile.distroless-dev:2, 32 (2 hits)
tools/packaging/Dockerfile.distroless-prod:2, 25 (2 hits)
tools/packaging/Dockerfile.ubuntu-dev:2, 16 (2 hits)
tools/packaging/Dockerfile.ubuntu-prod:2, 13 (2 hits)
tests/integration/ioredis.Dockerfile:2
tests/integration/jedis.Dockerfile:2
tests/integration/node-redis.Dockerfile:2
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2025-4116
Potential denial of service in golang.org/x/crypto/ssh/agent
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2025-4134
Unbounded memory consumption in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2025-4135
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5005
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5006
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5013
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5014
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5015
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5016
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5017
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5018
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5019
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5020
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5021
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5023
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5033
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-4440
Quadratic parsing complexity in golang.org/x/net/html
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-4441
Infinite parsing loop in golang.org/x/net
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-4918
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-5025
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-5026
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-5027
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-5028
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-5029
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 golang.org/x/net: GO-2026-5030
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 3 occurrences golang.org/x/sys: GO-2026-5024
Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences pre-commit hook `https://github.com/pre-commit/pre-commit-hooks` pinned to mutable rev `v4.3.0`
`.pre-commit-config.yaml` references `https://github.com/pre-commit/pre-commit-hooks` at `rev: v4.3.0`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine.
lines 28, 35, 41
.pre-commit-config.yaml:28, 35, 41 (3 hits)
high Security checks software dependencies conf 0.88 stdlib: GO-2025-3503
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
tools/replay/go.mod
high Security checks software dependencies conf 0.88 stdlib: GO-2025-3563
Request smuggling due to acceptance of invalid chunked data in net/http
tools/replay/go.mod
high Security checks software dependencies conf 0.88 stdlib: GO-2025-3749
Usage of ExtKeyUsageAny disables policy validation in crypto/x509
tools/replay/go.mod
high Security checks software dependencies conf 0.88 stdlib: GO-2025-3750
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
tools/replay/go.mod
high Security checks software dependencies conf 0.88 stdlib: GO-2025-3751
Sensitive headers not cleared on cross-origin redirect in net/http
tools/replay/go.mod
high Security checks software dependencies conf 0.88 2 occurrences stdlib: GO-2025-3849
Incorrect results returned from Rows.Scan in database/sql
2 files, 2 locations
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 stdlib: GO-2025-3955
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
contrib/charts/dragonfly/go.mod
high Security checks software dependencies conf 0.88 2 occurrences stdlib: GO-2025-3956
Unexpected paths returned from LookPath in os/exec
2 files, 2 locations
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4006
Excessive CPU consumption in ParseAddress in net/mail
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4007
Quadratic complexity when checking name constraints in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4008
ALPN negotiation error contains attacker controlled information in crypto/tls
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4009
Quadratic complexity when parsing some invalid inputs in encoding/pem
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4010
Insufficient validation of bracketed IPv6 hostnames in net/url
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4011
Parsing DER payload can cause memory exhaustion in encoding/asn1
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4012
Lack of limit when parsing cookies can cause memory exhaustion in net/http
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4013
Panic when validating certificates with DSA public keys in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4014
Unbounded allocation when parsing GNU sparse map in archive/tar
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4015
Excessive CPU consumption in Reader.ReadResponse in net/textproto
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4155
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2025-4175
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4337
Unexpected session resumption in crypto/tls
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4340
Handshake messages may be processed at the incorrect encryption level in crypto/tls
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4341
Memory exhaustion in query parameter parsing in net/url
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4342
Excessive CPU consumption when building archive index in archive/zip
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 stdlib: GO-2026-4403
Improper access to parent directory of root in os
tools/replay/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4602
FileInfo can escape from a Root in os
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4603
URLs in meta content attribute actions are not escaped in html/template
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4864
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4865
JsBraceDepth Context Tracking Bugs (XSS) in html/template
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4869
Unbounded allocation for old GNU sparse in archive/tar
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4870
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4918
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4946
Inefficient policy validation in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4947
Unexpected work during chain building in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4971
Panic in Dial and LookupPort when handling NUL byte on Windows in net
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4976
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4977
Quadratic string concatenation in consumePhrase in net/mail
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4980
Escaper bypass leads to XSS in html/template
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4981
Crash when handling long CNAME response in net
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4982
Bypass of meta content URL escaping causes XSS in html/template
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-4986
Quadratic string concatentation in consumeComment in net/mail
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-5037
Inefficient candidate hostname parsing in crypto/x509
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-5038
Quadratic complexity in WordDecoder.DecodeHeader in mime
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.88 3 occurrences stdlib: GO-2026-5039
Arbitrary inputs are included in errors without any escaping in net/textproto
3 files, 3 locations
contrib/charts/dragonfly/go.mod
tools/replay/go.mod
tools/vector-benches/go.mod
high Security checks software dependencies conf 0.90 ✓ Repobility 17 occurrences Workflow container/services image `ghcr.io/dragonflydb/dragonfly:latest` unpinned
`container/services image: ghcr.io/dragonflydb/dragonfly:latest` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.
11 files, 17 locations
.github/workflows/release.yml:36, 68, 70, 144 (4 hits)
.github/workflows/benchmark.yml:29, 43 (2 hits)
.github/workflows/mastodon-ruby-tests.yml:16, 29 (2 hits)
.github/workflows/package-install.yml:16, 30 (2 hits)
.github/workflows/bullmq-tests.yml:22
.github/workflows/ci.yml:288
.github/workflows/daily-builds.yml:25
.github/workflows/docker-dev-release.yml:13
low Security checks quality Error handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
fuzz/replay_crash.py:36
low Security checks quality Error handling conf 0.55 ✓ Repobility 4 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
3 files, 4 locations
tools/pubsub/celery-test.py:234, 311 (2 hits)
fuzz/generate_targeted_seeds.py:275
tests/dragonfly/conftest.py:325
Error handlingquality
medium Security checks cicd CI/CD security conf 0.94 Compose service `renderer` image uses the latest tag
The latest tag is mutable and can change without a code review, producing different images from the same source.
tools/local/monitoring/docker-compose.yml:117 CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.86 Database dump or local database file is included in Docker build context
Database exports and local database files can contain production data, credentials, or large binary payloads that slow Docker builds and can be copied into images by broad COPY instructions.
.dockerignore CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.74 Database service has no persistent data volume
Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state.
tools/local/monitoring/docker-compose.yml:106 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.82 3 occurrences Docker final stage has no non-root USER
Docker images run as root unless the image or Dockerfile switches to a non-root user.
3 files, 3 locations
tools/packaging/Dockerfile.alpine-dev:31
tools/packaging/Dockerfile.ubuntu-dev:17
tools/packaging/Dockerfile.ubuntu-prod:13
CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned
Action `codecov/codecov-action` pinned to mutable ref `@v7` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.
4 files, 4 locations
.github/workflows/cov.yml:122
.github/workflows/epoll-regression-tests.yml:51
.github/workflows/regression-tests.yml:52
.github/workflows/test-fakeredis.yml:92
CI/CD securitySupply chainGitHub Actions
medium Security checks software dependencies conf 0.88 2 occurrences idna: GHSA-65pc-fj4g-8rjx
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
2 files, 2 locations
tests/dragonfly/requirements.txt
tools/requirements.txt
medium Security checks software dependencies conf 0.90 Python package `aiofiles` is 3 major version(s) behind (22.1.0 -> 25.1.0)
`aiofiles==22.1.0` is 3 major version(s) behind the latest stable release on PyPI (25.1.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
tools/requirements.txt:9
medium Security checks software dependencies conf 0.90 Python package `async_timeout` is 1 major version(s) behind (4.0.2 -> 5.0.1)
`async_timeout==4.0.2` is 1 major version(s) behind the latest stable release on PyPI (5.0.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
tools/requirements.txt:2
medium Security checks software dependencies conf 0.90 Python package `redis` is 4 major version(s) behind (4.4.4 -> 8.0.0)
`redis==4.4.4` is 4 major version(s) behind the latest stable release on PyPI (8.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
tools/requirements.txt:6
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
AGENTS.md VerificationAgents md
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
.dockerignore exists but does not cover common secret or VCS patterns.
.dockerignore CI/CD securitycontainers
low Security checks software Race condition conf 1.00 [SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason.
Use `os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)` for atomic create-only. Use `tempfile.NamedTemporaryFile()` (not `mktemp`). For locking, use `fcntl.flock`.
tools/packaging/osrepos/scripts/fetch-releases.py:82
high Security checks cicd CI/CD security conf 0.56 6 occurrences Compose service does not declare a runtime user
If the image does not define USER internally, this service may run as root.
2 files, 6 locations
tools/local/monitoring/docker-compose.yml:21, 42, 54, 90, 117 (5 hits)
contrib/docker/docker-compose.yml:1
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.62 7 occurrences Compose service lacks no-new-privileges hardening
no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.
2 files, 7 locations
tools/local/monitoring/docker-compose.yml:21, 42, 54, 71, 90, 117 (6 hits)
contrib/docker/docker-compose.yml:1
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.72 Database service has no healthcheck
Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy.
tools/local/monitoring/docker-compose.yml:106 CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 21 occurrences GitHub Action is tag-pinned rather than SHA-pinned
Action `actions/checkout` pinned to mutable ref `@v6` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.
5 files, 21 locations
.github/workflows/test-fakeredis.yml:30, 77, 85, 111, 118, 122, 134, 139 (8 hits)
.github/workflows/cov.yml:35, 55, 100, 107, 128 (5 hits)
.github/workflows/epoll-regression-tests.yml:33, 70, 79 (3 hits)
.github/workflows/regression-tests.yml:33, 68, 77 (3 hits)
.github/workflows/daily-builds.yml:37, 78 (2 hits)
CI/CD securitySupply chainGitHub Actions
low Security checks quality Quality conf 0.68 Multiple AI-agent scaffold marker files are present
Repositories with several agent instruction, progress, or completion marker files are often generated scaffolds. They are not automatically wrong, but they deserve a reachability and ownership review before users treat the code as production-ready.
.cursorrules:1
low Security checks software dependencies conf 0.90 Python package `aiocsv` is minor version(s) behind (1.2.3 -> 1.4.1)
`aiocsv==1.2.3` is minor version(s) behind the latest stable release on PyPI (1.4.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
tools/requirements.txt:8
low Security checks cicd CI/CD security conf 0.35 ✓ Repobility 3 occurrences Workflow references repository secrets in a pull_request workflow
Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.
2 files, 3 locations
.github/workflows/ci.yml:182, 183 (2 hits)
.github/workflows/fuzz-pr.yml:137
CI/CD securityworkflow secretsGitHub Actions
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/66c5c07a-e421-4e9d-b37d-1731633618b7/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/66c5c07a-e421-4e9d-b37d-1731633618b7/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.