Push this scan report to clash-verge-rev/clash-verge-rev

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Issue title

## Code-quality scan: `clash-verge-rev/clash-verge-rev`

**Score: 80/100 (B+)**  ·  116 findings  ·  scanned 2026-06-05 05:07 UTC  ·  64,663 LOC

| Severity | Count |
|---|---|
| CRITICAL | 0 |
| HIGH | 49 |
| MEDIUM | 12 |
| LOW | 32 |

📊 [Full filterable report](https://repobility.com/scan/70d8c93a-fc81-4ae3-82eb-6ef2d0458c0b/)  ·  ![scorecard](https://repobility.com/scan/70d8c93a-fc81-4ae3-82eb-6ef2d0458c0b/report.png?v=1780636078-s2)

### Top findings

1. **HIGH** `MINED004` — Weak Crypto
   `src/utils/uri-parser/helpers.ts:314` · CWE-327 · ✓ Repobility
2. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `src/hooks/use-system-proxy-state.ts:76`
3. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `src/hooks/use-mihomo-ws-subscription.ts:325`
4. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `src/hooks/use-connection-data.ts:42`
5. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `src/utils/uri-parser/helpers.ts:8`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/70d8c93a-fc81-4ae3-82eb-6ef2d0458c0b/_