Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

DioxusLabs/dioxus

https://github.com/DioxusLabs/dioxus · scanned 2026-07-23 10:39 UTC (5 days, 6 hours ago)

68 raw signals (0 security + 68 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 6 hours ago · v5 · last Δ +8.7 (diff) · 67 actionable findings from 1 signal source. 1 repeated signal grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

90.0% cov · 67 findings

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 7 Medium 29 Low 23 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 67 Crowd 0 Layer: Frontend 9 Security 19 Hardware 5 Cicd 4 Quality 18 Dependencies 12

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 57.7/100 with 90.0% coverage. It contains 2839 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 68 findings — concentrated in security (19), quality (18), dependencies (12). Risk profile is high: 0 critical, 7 high, 30 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 59 of 67 actionable findings. 68 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph hardware Supply chain conf 1.00 Dockerfile pipes a remote installer into a shell

Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature.

examples/01-app-demos/hotdog/Dockerfile:13 containersRemote installer

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — .devcontainer/Dockerfile

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: .devcontainer/Dockerfile

Misconfig

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — examples/01-app-demos/hotdog/Dockerfile

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: examples/01-app-demos/hotdog/Dockerfile

Misconfig

high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — .devcontainer/Dockerfile

'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update -qq && apt-get install -y -qq libgdk3.0-cil libatk1.0-dev libcairo2-dev libpango1.0-dev libgdk-pixbuf2.0-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev libweb…

Misconfig

high System graph cicd CI/CD security conf 1.00 GitHub Action tracks a moving branch

crate-ci/typos@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/main.yml:72 CI/CD securitySupply chainGithub actions

high System graph cicd CI/CD security conf 1.00 GitHub Action tracks a moving branch

dtolnay/rust-toolchain@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/publish.yml:116 CI/CD securitySupply chainGithub actions

high System graph security security conf 1.00 Insecure pattern 'eval_used' in packages/desktop/src/launch.rs:64

Found a known-risky pattern (eval_used). Review and replace if possible.

packages/desktop/src/launch.rs:64 Eval used

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/interpreter/src/js/native.js:1

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/interpreter/src/ts/native.ts:170

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph hardware Security conf 1.00 Dockerfile runs as root: .devcontainer/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: examples/01-app-demos/hotdog/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph security Trivy conf 1.00 GHSA-wrw7-89jp-8q8g: glib 0.18.5 — Cargo.lock

Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable referenc…

VulnGhsa wrw7 89jp 8q8g

medium System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned

actions/cache@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

2 files, 2 locations

.github/workflows/main.yml:81

.github/workflows/publish.yml:73

CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/publish.yml CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/asset-resolver/src/native.rs:79

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/asset-resolver/src/native.rs:79 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/desktop/src/protocol.rs:135

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/desktop/src/protocol.rs:135 Cors wildcard

medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/cli/assets/web/dev.loading.html:364

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

packages/cli/assets/web/dev.loading.html:364 Direct innerhtml assignment

medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/common.js:1

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

packages/interpreter/src/js/common.js:1 Direct innerhtml assignment

medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/core.js:1

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

packages/interpreter/src/js/core.js:1 Direct innerhtml assignment

medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/js/set_attribute.js:1

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

packages/interpreter/src/js/set_attribute.js:1 Direct innerhtml assignment

medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/interpreter/src/ts/set_attribute.ts:64

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

packages/interpreter/src/ts/set_attribute.ts:64 Direct innerhtml assignment

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 153 placeholder/mock markers across 59 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

medium System graph security Secrets conf 0.58 Possible secret in packages/cli/src/bundler/macos.rs

Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager.

packages/cli/src/bundler/macos.rs:671 Password literal

medium System graph security Semgrep conf 1.00 unquoted attribute var — packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:25

Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…

SecurityHtml templates

medium System graph security Semgrep conf 1.00 unquoted attribute var — packages/cli/assets/android/gen/app/src/main/AndroidManifest.xml.hbs:26

SecurityHtml templates

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190

OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190. Unsoundness in `Error::downcast_mut()` Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190 Fix: upgrade `anyhow` past the affected range per the advisory.

Cargo.toml ScaOsvRustsec 2026 0190

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052

OSV.dev reports `async-std` at version `1.13.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0052. async-std has been discontinued Advisory: https://osv.dev/vulnerability/RUSTSEC-2025-0052 Fix: upgrade `async-std` past the affected range per the advisory.

Cargo.toml ScaOsvRustsec 2025 0052

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413

OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413. Note: `atk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. gtk-rs GTK3 bindings - no longer maintained Advisory: https://osv.dev/vulnerability/RU…

Cargo.lock ScaOsvRustsec 2024 0413

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416

OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416. Note: `atk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. gtk-rs GTK3 bindings - no longer maintained Advisory: https://osv.dev/vulnerab…

Cargo.lock ScaOsvRustsec 2024 0416

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089

OSV.dev reports `atomic-polyfill` at version `1.0.3` (resolved in `Cargo.lock`) is affected by RUSTSEC-2023-0089. Note: `atomic-polyfill` is a transitive dependency — pulled in by another package, not declared directly in a manifest. atomic-polyfill is unmaintained Advisory: https://osv.dev/vulne…

Cargo.lock ScaOsvRustsec 2023 0089

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency bytes 1.10.1: GHSA-434x-w66g-qw3r

OSV.dev reports `bytes` at version `1.10.1` (declared in `Cargo.toml`) is affected by GHSA-434x-w66g-qw3r (aka CVE-2026-25541). Note: `1.10.1` is the declared floor of a range — the installed version may be newer. bytes has integer overflow in BytesMut::reserve Aliases: CVE-2026-25541, GHSA-434x-…

Cargo.toml ScaOsvGhsa 434x w66g qw3r

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204

OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204. Note: `crossbeam-epoch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Invalid pointer dereference in `fmt::Pointer` impl for `Atomic`…

Cargo.lock ScaOsvRustsec 2026 0204

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j

OSV.dev reports `lru` at version `0.12.5` (resolved in `Cargo.lock`) is affected by GHSA-rhfx-m35p-ff5j. `IterMut` violates Stacked Borrows by invalidating internal pointer Aliases: GHSA-rhfx-m35p-ff5j, RUSTSEC-2026-0002 Advisory: https://osv.dev/vulnerability/GHSA-rhfx-m35p-ff5j Fix: upgrade `lr…

Cargo.lock ScaOsvGhsa rhfx m35p ff5j

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency memmap2 0.9.10: RUSTSEC-2026-0186

OSV.dev reports `memmap2` at version `0.9.10` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0186. Unchecked pointer offset in crate `memmap2` Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0186 Fix: upgrade `memmap2` past the affected range per the advisory.

Cargo.toml ScaOsvRustsec 2026 0186

low System graph quality Maintenance conf 1.00 158 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 19 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph dependencies dependencies conf 0.90 Dependency ansi-to-tui is a major version behind

`ansi-to-tui` is pinned at `7.0` in `packages/cli/Cargo.toml` while the latest release on the cargo registry is `8.0.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ansi-to-tui` to `…

packages/cli/Cargo.toml FreshnessOutdated

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: rust:1

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

examples/01-app-demos/hotdog/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: rustlang/rust:${VARIANT}

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

.devcontainer/Dockerfile:2 containersPinned dependencies

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — .devcontainer/Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: .devcontainer/Dockerfile

Misconfig

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — examples/01-app-demos/hotdog/Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: examples/01-app-demos/hotdog/Dockerfile

Misconfig

low System graph security Trivy conf 1.00 GHSA-rhfx-m35p-ff5j: lru 0.12.5 — Cargo.lock

`IterMut` violates Stacked Borrows by invalidating internal pointer Affected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the i…

VulnGhsa rhfx m35p ff5j

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — examples/10-integrations/pwa/public/sw.js:3

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — packages/playwright-tests/fullstack.spec.js:78

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — packages/playwright-tests/web-patch-fullstack.spec.js:107

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — packages/playwright-tests/web-patch.spec.js:96

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph quality Complexity conf 1.00 Very large file: packages/cli/src/config/manifest.rs (1790 lines)