← Back to scan
File as GitHub Issue repo: wecode-ai/Wegent

Push this scan report to wecode-ai/Wegent

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Bare except continues silently: Bare `except:` (or `except Exception

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… shared/utils/crypto.py:175
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… shared/utils/placeholder.py:62
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… shared/telemetry/decorators.py:41
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… shared/telemetry/decorators.py:31
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/tools/mcp/client.…:304
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/tools/builtin/dat…:186
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/tools/builtin/fil…:186
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/tools/builtin/fil…:89
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/cli/commands/chat…:312
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/cli/commands/quer…:243
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/cli/commands/hist…:249
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/cli/utils/config_…:93
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/tools/knowledge_f…:124
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/storage/sqlite.py:537
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/storage/remote.py:418
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/storage/remote.py:396
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/llm_logging.py:77
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/llm_logging.py:147
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… chat_shell/chat_shell/llm_logging.py:115
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… knowledge_runtime/knowledge_runtime/ser…:440
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… knowledge_runtime/knowledge_runtime/cor…:41
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… shared/logger.py:166
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… shared/logger.py:50
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… executor/version.py:79
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … frontend/src/utils/pdf/renderers/math.ts:196
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … frontend/src/utils/pdf/markdown.ts:52
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … frontend/src/features/tasks/components/…:220
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/src/features/layout/GithubStar…:96
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/src/features/layout/FeedbackBu…:26
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/src/features/layout/DocsButton…:24
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. frontend/src/features/knowledge/documen…:63
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… wework/src/pages/LoginPage.tsx:54
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… frontend/src/features/login/components/…:260
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… frontend/src/apis/client.ts:80
MED SEC119 [SEC119] World-writable / world-readable file permissions: World-writable files let any l… executor/platform_compat/unix/permissio…:25
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/app/services/mcp_providers/prov…:92
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/app/services/execution/__init__…:152
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/app/services/chat/access/auth.py:64
MED SEC034 [SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge… backend/app/api/endpoints/internal/serv…:130
MED SEC034 [SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge… backend/app/api/endpoints/internal/conv…:216
MED SEC034 [SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge… backend/app/api/endpoints/internal/call…:134
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … backend/app/api/endpoints/admin/token_i…:63
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … backend/app/api/endpoints/admin/tasks.py:72
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … backend/app/api/endpoints/admin/api_key…:78
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/app/services/channels/telegram/…:155
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/app/api/endpoints/adapter/dify.…:80
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/app/api/dependencies.py:33
MED SEC139 [SEC139] AI-generated migration/route without companion test file: Route or migration tou… backend/app/api/endpoints/admin/tasks.py:23
MED SEC139 [SEC139] AI-generated migration/route without companion test file: Route or migration tou… backend/app/api/endpoints/admin/kind_ma…:165
MED SEC139 [SEC139] AI-generated migration/route without companion test file: Route or migration tou… backend/alembic/backup_conflicted_migra…:88
MED DKR003 Compose service `knowledge_runtime` image uses the latest tag docker-compose.yml:267
MED DKR003 Compose service `executor_manager` image uses the latest tag docker-compose.yml:202
MED DKR003 Compose service `chat_shell` image uses the latest tag docker-compose.yml:171
MED DKR003 Compose service `frontend` image uses the latest tag docker-compose.yml:136
MED DKR003 Compose service `backend` image uses the latest tag docker-compose.yml:69
MED DKR003 Dockerfile base image uses the latest tag frontend/e2e/fixtures/claudecode-execut…:1
MED DKR003 Dockerfile base image uses the latest tag docker/standalone/Dockerfile:42
MED DKR003 Dockerfile base image uses the latest tag docker/knowledge_runtime/Dockerfile:5
MED DKR003 Dockerfile base image uses the latest tag docker/knowledge_doc_converter/Dockerfi…:7
MED DKR003 Dockerfile base image uses the latest tag docker/executor_manager/Dockerfile:5
MED DKR003 Dockerfile base image uses the latest tag docker/executor/Dockerfile:27
MED DKR003 Dockerfile base image uses the latest tag docker/executor/Dockerfile:6
MED DKR003 Dockerfile base image uses the latest tag docker/chat_shell/Dockerfile:5
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKC016 App service does not wait for database health docker-compose.yml:202
MED JRN002 Browser storage is used for session token material wework/src/api/auth.ts:48
MED JRN002 Browser storage is used for session token material wework/src/api/auth.ts:40
MED JRN002 Browser storage is used for session token material wework/src/api/auth.ts:37
MED JRN002 Browser storage is used for session token material wework/src/api/attachments.ts:81
MED JRN002 Browser storage is used for session token material wework/src/api/attachments.ts:24
MED JRN002 Browser storage is used for session token material frontend/src/features/login/components/…:49
MED JRN002 Browser storage is used for session token material frontend/src/features/login/components/…:48
MED JRN002 Browser storage is used for session token material frontend/src/apis/user.ts:125
MED JRN002 Browser storage is used for session token material frontend/src/apis/user.ts:118
MED JRN002 Browser storage is used for session token material frontend/src/apis/user.ts:107
MED JRN002 Browser storage is used for session token material frontend/src/apis/user.ts:104
MED JRN002 Browser storage is used for session token material frontend/e2e/utils/auth.ts:109
MED DKR001 Docker final stage has no non-root USER frontend/e2e/fixtures/claudecode-execut…:1
MED DKR001 Docker final stage has no non-root USER docker/standalone/Dockerfile:89
MED DKR001 Docker final stage has no non-root USER docker/knowledge_runtime/Dockerfile:5
MED DKR001 Docker final stage has no non-root USER docker/knowledge_doc_converter/Dockerfi…:7
MED DKR001 Docker final stage has no non-root USER docker/executor_manager/Dockerfile:5
MED DKR001 Docker final stage has no non-root USER docker/executor/Dockerfile:27
MED DKR001 Docker final stage has no non-root USER docker/chat_shell/Dockerfile:5
MED DKR001 Docker final stage has no non-root USER docker/base/Dockerfile:5
MED DKR001 Docker final stage has no non-root USER docker/backend/Dockerfile:5
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:222
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:215
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:208
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:201
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:194
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:187
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:178
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:171
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:160
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:153
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:142
MED JRN003 Frontend API reference is not matched by discovered backend routes frontend/e2e/utils/api-client.ts:133
MED JRN003 Frontend API reference is not matched by discovered backend routes backend/init_data/skills/skill-creator/…:1044
MED JRN003 Frontend API reference is not matched by discovered backend routes backend/init_data/skills/skill-creator/…:1012
MED JRN003 Frontend API reference is not matched by discovered backend routes backend/init_data/skills/skill-creator/…:666
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 40.0% of discovered … —
MED WEB012 Service worker is present without a web app manifest manifest.json
MED AGT012 Agent control bridge may listen on a network interface without visible auth backend/app/services/url_metadata.py:41
MED AGT012 Agent control bridge may listen on a network interface without visible auth .github/workflows/test.yml:402
MED AGT012 Agent control bridge may listen on a network interface without visible auth .github/workflows/e2e-tests.yml:168
MED WEB015 Public web app has no Content Security Policy index.html
MED AGT015 Remote install command pipes network code directly to a shell backend/start.sh:267
MED AGT015 Remote install command pipes network code directly to a shell README_zh.md:160
MED AGT015 Remote install command pipes network code directly to a shell README.md:159
MED AGT015 Remote install command pipes network code directly to a shell .github/workflows/test.yml:44
MED AGT015 Remote install command pipes network code directly to a shell .github/workflows/lint.yml:35
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/otlp/traces/route.ts:38
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/wizard/test-prompt…:15
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/wizard/generate-fo…:18
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/subtasks/stream/su…:19
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/chat/resume-stream…:20
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/chat/streaming-con…:15
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/chat/stream/route.…:24
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/chat/cancel/route.…:14
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/runtime-config/route.ts:30
MED SEC005 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input. shared/utils/git_util.py:296
MED SEC005 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input. executor/agents/claude_code/git_operati…:135
LOW AIC003 Duplicated implementation block across source files backend/app/services/group_permission.py:12
LOW AIC003 Duplicated implementation block across source files backend/app/services/execution/agents/v…:208
LOW AIC003 Duplicated implementation block across source files backend/app/services/device_service.py:428
LOW AIC003 Duplicated implementation block across source files backend/app/services/device_service.py:375
LOW AIC003 Duplicated implementation block across source files backend/app/services/device_service.py:268
LOW AIC003 Duplicated implementation block across source files backend/app/services/device/local_provi…:220
LOW AIC003 Duplicated implementation block across source files backend/app/services/device/local_provi…:218
LOW AIC003 Duplicated implementation block across source files backend/app/services/device/cloud_provi…:28
LOW AIC003 Duplicated implementation block across source files backend/app/services/chat/storage/task_…:83
LOW AIC003 Duplicated implementation block across source files backend/app/services/chat/storage/db.py:240
LOW AIC003 Duplicated implementation block across source files backend/app/services/channels/telegram/…:58
LOW AIC003 Duplicated implementation block across source files backend/app/services/channels/telegram/…:48
LOW AIC003 Duplicated implementation block across source files backend/app/services/channels/telegram/…:180
LOW AIC003 Duplicated implementation block across source files backend/app/services/channels/telegram/…:7
LOW AIC003 Duplicated implementation block across source files backend/app/services/channels/emitter.py:45
LOW AIC003 Duplicated implementation block across source files backend/app/services/attachment/truncat…:18
LOW AIC003 Duplicated implementation block across source files backend/app/services/attachment/storage…:76
LOW AIC003 Duplicated implementation block across source files backend/app/services/adapters/task_kind…:286
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitlab_provider.…:239
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitlab_provider.…:38
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitlab_provider.…:37
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitlab_provider.…:36
LOW AIC003 Duplicated implementation block across source files backend/app/repository/github_provider.…:40
LOW AIC003 Duplicated implementation block across source files backend/app/repository/github_provider.…:39
LOW AIC003 Duplicated implementation block across source files backend/app/repository/github_provider.…:38
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitee_provider.py:39
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitee_provider.py:38
LOW AIC003 Duplicated implementation block across source files backend/app/repository/gitea_provider.py:38
LOW AIC003 Duplicated implementation block across source files backend/app/api/endpoints/users.py:528
LOW AIC003 Duplicated implementation block across source files backend/app/api/endpoints/adapter/subsc…:80
LOW WEB001 Public web app has no robots.txt robots.txt
LOW WEB002 Public web app has no sitemap sitemap.xml
LOW DKR012 Dockerfile keeps pip download cache frontend/e2e/fixtures/claudecode-execut…:8
LOW DKR012 Dockerfile keeps pip download cache docker/standalone/Dockerfile:119
LOW DKR012 Dockerfile keeps pip download cache docker/standalone/Dockerfile:111
LOW DKR012 Dockerfile keeps pip download cache docker/standalone/Dockerfile:108
LOW DKR012 Dockerfile keeps pip download cache docker/standalone/Dockerfile:105
LOW DKR012 Dockerfile keeps pip download cache docker/standalone/Dockerfile:102
LOW DKR012 Dockerfile keeps pip download cache docker/standalone/Dockerfile:72
LOW DKR012 Dockerfile keeps pip download cache docker/knowledge_runtime/Dockerfile:21
LOW DKR012 Dockerfile keeps pip download cache docker/knowledge_runtime/Dockerfile:16
LOW DKR012 Dockerfile keeps pip download cache docker/knowledge_runtime/Dockerfile:12
LOW DKR012 Dockerfile keeps pip download cache docker/knowledge_doc_converter/Dockerfi…:22
LOW DKR012 Dockerfile keeps pip download cache docker/knowledge_doc_converter/Dockerfi…:17
LOW DKR012 Dockerfile keeps pip download cache docker/knowledge_doc_converter/Dockerfi…:13
LOW DKR012 Dockerfile keeps pip download cache docker/executor_manager/Dockerfile:13
LOW DKR012 Dockerfile keeps pip download cache docker/executor/Dockerfile:54
LOW DKR012 Dockerfile keeps pip download cache docker/executor/Dockerfile:17
LOW DKR012 Dockerfile keeps pip download cache docker/executor/Dockerfile:14
LOW DKR012 Dockerfile keeps pip download cache docker/executor/Dockerfile:13
LOW DKR012 Dockerfile keeps pip download cache docker/chat_shell/Dockerfile:17
LOW DKR012 Dockerfile keeps pip download cache docker/chat_shell/Dockerfile:12
LOW DKR012 Dockerfile keeps pip download cache docker/base/Dockerfile:31
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKR012 Dockerfile keeps pip download cache docker/backend/Dockerfile:21
LOW WEB008 Public docs site has no llms.txt llms.txt
LOW DKC010 Compose service lacks no-new-privileges hardening telemetry/docker-compose.yml:77
LOW DKC010 Compose service lacks no-new-privileges hardening telemetry/docker-compose.yml:64
LOW DKC010 Compose service lacks no-new-privileges hardening telemetry/docker-compose.yml:49
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:307
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:267
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:202
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:171
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:136
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:69
LOW DKC017 Database password is wired through an environment variable placeholder docker-compose.yml:5
LOW DKC006 Compose service does not declare a runtime user telemetry/docker-compose.yml:77
LOW DKC006 Compose service does not declare a runtime user telemetry/docker-compose.yml:64
LOW DKC006 Compose service does not declare a runtime user telemetry/docker-compose.yml:49
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:307
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:267
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:202
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:171
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:136
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:69
LOW WEB011 Public web app has no humans.txt humans.txt
Reset to top 5 200 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `wecode-ai/Wegent`

**Score: 72/100 (A-)**  ·  465 findings  ·  scanned 2026-06-05 13:05 UTC  ·  757,882 LOC

| Severity | Count |
|---|---|
| CRITICAL | 23 |
| HIGH | 173 |
| MEDIUM | 124 |
| LOW | 79 |

📊 [Full filterable report](https://repobility.com/scan/7b2123d8-a9f1-4c2e-9d75-6c93ecc32986/)  ·  ![scorecard](https://repobility.com/scan/7b2123d8-a9f1-4c2e-9d75-6c93ecc32986/report.png?v=1780664758-s2)

### Top findings

1. **MEDIUM** `MINED111` — Bare except continues silently: Bare `except:` (or `except Exception
   `shared/utils/crypto.py:175` · ✓ Repobility
2. **MEDIUM** `MINED111` — Bare except continues silently: Bare `except:` (or `except Exception
   `shared/utils/placeholder.py:62` · ✓ Repobility
3. **MEDIUM** `MINED111` — Bare except continues silently: Bare `except:` (or `except Exception
   `shared/telemetry/decorators.py:41` · ✓ Repobility
4. **MEDIUM** `MINED111` — Bare except continues silently: Bare `except:` (or `except Exception
   `shared/telemetry/decorators.py:31` · ✓ Repobility
5. **MEDIUM** `MINED111` — Bare except continues silently: Bare `except:` (or `except Exception
   `chat_shell/chat_shell/tools/mcp/client.py:304` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/7b2123d8-a9f1-4c2e-9d75-6c93ecc32986/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 28 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'wecode-ai/Wegent' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.