Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
31 of your 89 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.
Upstream (GitHub) caused delay on this scan — not Repobility.
  • GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
  • Clone from GitHub took 32.46s for a 63.7 MB repo slow.
  • Repobility's analysis ran in 15.55s after the clone landed.

neomjs/neo

https://github.com/neomjs/neo · scanned 2026-06-06 00:07 UTC (4 days, 2 hours ago) · 10 languages

153 raw signals (67 security + 86 graph) 11/13 scanners ran 97th percentile · Javascript · tiny (<2K LoC) System graph score 70 (higher by 16)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 2 hours ago · v2 · 53 actionable findings from 2 signal sources. 57 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
79.9
/100
Security checks
90
36 findings
System graph
70
88.9% cov · 17 findings
Critical
2
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 85.0 0.20 17.00
documentation_score 75.0 0.15 11.25
practices_score 78.0 0.15 11.70
code_quality 80.0 0.10 8.00
Overall 1.00 85.7
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 4 Medium 15 Low 7 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 36 System graph 17 Crowd 0 Layer: Security 9 Quality 23 Software 3 Cicd 4 Frontend 2 Network 7 Hardware 5
Scan summary Quality grade A- (86/100). Dimensions: security 100, maintainability 85. 67 findings (23 security). 102 lines analyzed.

Showing 28 of 53 actionable findings. 110 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED013] Password In Url: https://user:password@host — leaks creds via logs, referrer, error messages.
Review and fix per the pattern semantics. See CWE-200 / A07:2021 for context.
ai/demo-agents/dev.mjs:253
critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED035] Js New Function: new Function(...) compiles strings to functions.
Review and fix per the pattern semantics. See CWE-95 / for context.
src/code/executor/Neo.mjs:200
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED113] Express DELETE /document-delete has no auth: Express route DELETE /document-delete declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
Add an auth middleware: app.delete('/document-delete', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.
examples/form/field/fileupload/server.mjs:27
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED113] Express POST /file-upload-test has no auth: Express route POST /file-upload-test declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
Add an auth middleware: app.post('/file-upload-test', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.
examples/form/field/fileupload/server.mjs:9
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED113] Express POST /file-upload-test-fail has no auth: Express route POST /file-upload-test-fail declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
Add an auth middleware: app.post('/file-upload-test-fail', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.
examples/form/field/fileupload/server.mjs:17
high Security checks security secrets conf 1.00 [SEC018] AI-Agent Secret Retrieval Command: A command that prints or embeds credentials was committed. AI coding agents often add these commands while trying to help with setup or deployment, but they can leak live secrets through logs, shell history, CI output, or documentation.
Remove the command, use a secret manager or CI masked secret, and rotate any credential that may have been printed.
ai/mcp/server/github-workflow/services/GraphqlService.mjs:60
medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 6 occurrences GitHub Action is tag-pinned rather than SHA-pinned
[MINED115] Action `github/codeql-action/init` pinned to mutable ref `@v1`: `uses: github/codeql-action/init@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-ch…
lines 42, 43, 53, 54, 67, 68
.github/workflows/codeql-analysis.yml:42, 43, 53, 54, 67, 68 (6 hits)
CI/CD securitySupply chainGitHub Actions
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
low Security checks security Deserialization conf 1.00 3 occurrences [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.
Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.
3 files, 3 locations
ai/demo-agents/dev.mjs:96
ai/mcp/ToolService.mjs:98
ai/services.mjs:149
medium Security checks software Resource exhaustion conf 1.00 [SEC037] Uncontrolled Recursion — stack/depth exhaustion: Parsing arbitrary-depth user input (XML, JSON, YAML) without a depth limit, or recursive function over user-controlled structure. Attacker sends `{"a":{"a":{"a":...10000 levels...}}}` to blow the stack. Real CVEs: CVE-2019-16935 (Python xmlrpc), CVE-2020-25659 (PyYAML before 5.4). CWE-674/1325.
Use `defusedxml.ElementTree` instead of `xml.etree.ElementTree` — it rejects deeply-nested + billion-laughs payloads. For JSON: set a depth limit explicitly: import json data = json.loads(s) # then validate structure depth manually For YAML: always use `yaml.safe_load`. For recursive code over…
ai/demo-agents/dev.mjs:101
medium Security checks quality Quality conf 1.00 3 occurrences [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).
Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.
3 files, 3 locations
ai/mcp/client/mcp-cli.mjs:39
ai/mcp/server/github-workflow/mcp-server.mjs:24
ai/mcp/server/knowledge-base/mcp-server.mjs:24
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: alpine/git
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
ai/deploy/Dockerfile:14 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: source-${NEO_SOURCE}
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
ai/deploy/Dockerfile:31 containersPinned dependencies
medium System graph hardware Security conf 1.00 Dockerfile runs as root: ai/deploy/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/data-sync-pipeline.yml CI/CD securitySupply chainGithub actions
medium System graph network Security conf 1.00 Privileged port 10 in use
Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/github-workflow/openapi.yaml Ports
medium System graph network Security conf 1.00 Privileged port 12 in use
Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/github-workflow/openapi.yaml Ports
medium System graph network Security conf 1.00 Privileged port 13 in use
Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/memory-core/openapi.yaml Ports
medium System graph network Security conf 1.00 Privileged port 15 in use
Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/github-workflow/openapi.yaml Ports
medium System graph network Security conf 1.00 Privileged port 33 in use
Port 33 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/memory-core/openapi.yaml Ports
medium System graph network Security conf 1.00 Privileged port 48 in use
Port 48 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/github-workflow/openapi.yaml Ports
medium System graph network Security conf 1.00 Privileged port 49 in use
Port 49 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
ai/mcp/server/github-workflow/openapi.yaml Ports
low Security checks security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
Add regression tests for anonymous denial, cross-user object denial, admin role limits, and super_admin-only behavior.
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph hardware Supply chain conf 1.00 3 occurrences Docker base image is tag-pinned but not digest-pinned: node:24-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
lines 24, 32, 52
ai/deploy/Dockerfile:24, 32, 52 (3 hits)
containersPinned dependencies
low System graph cicd CI/CD security conf 1.00 29 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
12 files, 25 locations
.github/workflows/test.yml:29, 32, 61 (3 hits)
.github/workflows/check-retired-primitives.yml:26, 29 (2 hits)
.github/workflows/codeql-analysis.yml:38, 39 (2 hits)
.github/workflows/config-template-ssot-lint.yml:26, 29 (2 hits)
.github/workflows/data-sync-pipeline.yml:21, 24 (2 hits)
.github/workflows/devindex-pipeline.yml:20, 23 (2 hits)
.github/workflows/mcp-test-location-lint.yml:32, 35 (2 hits)
.github/workflows/npm-publish.yml:9, 11 (2 hits)
CI/CD securitySupply chainGitHub Actions
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
package.json CI/CD securitySupply chainNpm
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — test/playwright/e2e/custom-reporter.js:28
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/73cd45b8-1bb8-438f-a172-fc58bc1cfbb1/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/73cd45b8-1bb8-438f-a172-fc58bc1cfbb1/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.