Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

usestrix/strix

https://github.com/usestrix/strix · scanned 2026-07-23 19:43 UTC (4 days, 19 hours ago)

86 raw signals (0 security + 86 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 19 hours ago · v7 · last Δ +1.7 (diff) · 86 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
71.2
/100
Security checks
71
0 findings
System graph
71
100.0% cov · 86 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 6 Medium 33 Low 36 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 86 Crowd 0 Layer: Software 20 Api 1 Frontend 16 Security 15 Hardware 3 Cicd 1 Quality 13 Dependencies 17
Scan summary Repository scanned at 71.2/100 with 100.0% coverage. It contains 2266 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 86 findings — concentrated in software (20), dependencies (17), frontend (16). Risk profile is high: 0 critical, 6 high, 33 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 75 of 86 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def run_cli` — strix/interface/cli.py:166
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
strix/interface/cli.py:166 Sync io in asyncPerformance
high System graph hardware Supply chain conf 1.00 Dockerfile pipes a remote installer into a shell
Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature.
containers/Dockerfile:85 containersRemote installer
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — containers/Dockerfile
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get install -y wapiti' Rule: DS-0029 Severity: HIGH Target: containers/Dockerfile
Misconfig
high System graph security Secrets conf 0.72 Possible secret in strix/telemetry/posthog.py
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
strix/telemetry/posthog.py:21 Generic api key
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Alias…
strix/viewer/frontend/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-p9ff-h696-f583
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebS…
strix/viewer/frontend/package.json ScaOsvGhsa p9ff h696 f583
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — strix/viewer/frontend/src/components/live/tool-renderers/ToolCard.tsx:91
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
strix/viewer/frontend/src/components/live/tool-renderers/ToolCard.tsx:91 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — strix/viewer/frontend/src/components/vulnerability/CodeDiffBlock.tsx:105
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
strix/viewer/frontend/src/components/vulnerability/CodeDiffBlock.tsx:105 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — strix/viewer/frontend/src/components/vulnerability/MdCodeBlock.tsx:98
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
strix/viewer/frontend/src/components/vulnerability/MdCodeBlock.tsx:98 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx:66
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx:66 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — strix/viewer/static/assets/index-BNKUksp9.js:49
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
strix/viewer/static/assets/index-BNKUksp9.js:49 Fq dangerous html
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: kalilinux/kali-rolling:latest
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
containers/Dockerfile:6 containersPinned dependencies
medium System graph hardware Security conf 1.00 Dockerfile runs as root: containers/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 DS-0001: ':latest' tag used — containers/Dockerfile
':latest' tag used Specify a tag in the 'FROM' statement for image 'kalilinux/kali-rolling' Rule: DS-0001 Severity: MEDIUM Target: containers/Dockerfile
Misconfig
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — strix/interface/utils.py:1058
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
strix/interface/utils.py:1058 SecurityPython
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — strix/telemetry/posthog.py:45
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
strix/telemetry/posthog.py:45 SecurityPython
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — strix/telemetry/scarf.py:46
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
strix/telemetry/scarf.py:46 SecurityPython
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — strix/tools/proxy/caido_api.py:82
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
strix/tools/proxy/caido_api.py:82 SecurityPython
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — strix/viewer/auth.py:158
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
strix/viewer/auth.py:158 SecurityPython
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — strix/viewer/frontend/src/lib/cta.ts:32
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
strix/viewer/frontend/src/lib/cta.ts:32 runtime safetyRobustnessUnhandled promise
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/build-release.yml CI/CD securitySupply chainGithub actions
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in strix/viewer/frontend/src/components/live/tool-renderers/ToolCard.tsx:91
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
strix/viewer/frontend/src/components/live/tool-renderers/ToolCard.tsx:91 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in strix/viewer/frontend/src/components/vulnerability/CodeDiffBlock.tsx:105
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
strix/viewer/frontend/src/components/vulnerability/CodeDiffBlock.tsx:105 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in strix/viewer/frontend/src/components/vulnerability/MdCodeBlock.tsx:98
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
strix/viewer/frontend/src/components/vulnerability/MdCodeBlock.tsx:98 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx:66
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx:66 Dangerous innerhtml
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — strix/interface/utils.py:517
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
strix/interface/utils.py:517 runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 13 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Semgrep conf 0.70 react dangerouslysetinnerhtml — strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx:67
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx:67 SecurityReact
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency setuptools 82.0.1: GHSA-h35f-9h28-mq5c
OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by GHSA-h35f-9h28-mq5c (aka CVE-2026-59890). Note: `setuptools` is a transitive dependency — pulled in by another package, not declared directly in a manifest. setuptools: MANIFEST.in exclusion bypass in sdist via…
uv.lock ScaOsvGhsa h35f 9h28 mq5c
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-356w-63v5-8wf4
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite has an `server.fs.deny` bypass with an invalid `request-ta…
strix/viewer/frontend/package.json ScaOsvGhsa 356w 63v5 8wf4
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-4r4m-qw57-chr8
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite has a `server.fs.deny` bypassed for `inline` and `raw` wit…
strix/viewer/frontend/package.json ScaOsvGhsa 4r4m qw57 chr8
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` Hand…
strix/viewer/frontend/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-859w-5945-r5v3
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite's server.fs.deny bypassed with /. for files under project …
strix/viewer/frontend/package.json ScaOsvGhsa 859w 5945 r5v3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-93m4-6634-74q7
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. vite allows server.fs.deny bypass via backslash on Windows Ali…
strix/viewer/frontend/package.json ScaOsvGhsa 93m4 6634 74q7
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling on …
strix/viewer/frontend/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-vg6x-rcgg-rjx6
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-vg6x-rcgg-rjx6 (aka CVE-2025-24010). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Websites were able to send any requests to the development serv…
strix/viewer/frontend/package.json ScaOsvGhsa vg6x rcgg rjx6
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-x574-m823-4x7w
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-x574-m823-4x7w (aka CVE-2025-30208). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite bypasses server.fs.deny when using ?raw?? Aliases: CVE-20…
strix/viewer/frontend/package.json ScaOsvGhsa x574 m823 4x7w
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-xcj6-pq6g-qj4x
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-xcj6-pq6g-qj4x (aka CVE-2025-31486). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite allows server.fs.deny to be bypassed with .svg or relative…
strix/viewer/frontend/package.json ScaOsvGhsa xcj6 pq6g qj4x
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — strix/viewer/static/assets/index-BNKUksp9.js:427
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
strix/viewer/static/assets/index-BNKUksp9.js:427 Fq console leak
low System graph dependencies dependencies conf 0.90 Dependency @dagrejs/dagre is a major version behind
`@dagrejs/dagre` is pinned at `2.0.4` in `strix/viewer/frontend/package.json` while the latest release on the npm registry is `3.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@da…
strix/viewer/frontend/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency diff is a major version behind
`diff` is pinned at `8.0.3` in `strix/viewer/frontend/package.json` while the latest release on the npm registry is `9.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0…
strix/viewer/frontend/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency lucide-react is a major version behind
`lucide-react` is pinned at `0.563.0` in `strix/viewer/frontend/package.json` while the latest release on the npm registry is `1.26.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `lu…
strix/viewer/frontend/package.json FreshnessOutdated
low System graph security Trivy conf 1.00 DS-0014: RUN using 'wget' and 'curl' — containers/Dockerfile
RUN using 'wget' and 'curl' Shouldn't use both curl and wget Rule: DS-0014 Severity: LOW Target: containers/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — containers/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: containers/Dockerfile
Misconfig
low System graph quality Tests conf 1.00 Low test-to-source ratio
33 tests / 147 src (ratio 0.22).
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_link_or_copy` in strix/runtime/local_dir_staging.py:62
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `highlighted_old` in strix/interface/tui/renderers/filesystem_renderer.py:152
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `node_to_copy` in strix/interface/tui/app.py:1576
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `unstable_legacy` in strix/viewer/static/assets/index-BNKUksp9.js:48
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: action_open_viewer
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1835
low System graph software Dead code conf 1.00 Possibly dead Python function: action_request_quit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1744
low System graph software Dead code conf 1.00 Possibly dead Python function: action_stop_selected_agent
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1760
low System graph software Dead code conf 1.00 Possibly dead Python function: action_toggle_help
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1726
low System graph software Dead code conf 1.00 Possibly dead Python function: approve
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/agents/factory.py:139
low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_on_exit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/cli.py:122
low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_on_exit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:839
low System graph software Dead code conf 1.00 Possibly dead Python function: compose
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:853
low System graph software Dead code conf 1.00 Possibly dead Python function: configure
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/agents/factory.py:270
low System graph software Dead code conf 1.00 Possibly dead Python function: display_vulnerability
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/cli.py:104
low System graph software Dead code conf 1.00 Possibly dead Python function: do_GET
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/server.py:147
low System graph software Dead code conf 1.00 Possibly dead Python function: do_POST
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/server.py:164
low System graph software Dead code conf 1.00 Possibly dead Python function: draw
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/report_pdf.py:117
low System graph software Dead code conf 1.00 Possibly dead Python function: invoke
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/agents/factory.py:238
low System graph software Dead code conf 1.00 Possibly dead Python function: log_message
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/server.py:144
low System graph software Dead code conf 1.00 Possibly dead Python function: register_tool_renderer
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/renderers/registry.py:24
low System graph software Dead code conf 1.00 Possibly dead Python function: scan_target
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1457
low System graph software Dead code conf 1.00 Possibly dead Python function: update_status
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/cli.py:162
low System graph software Dead code conf 1.00 Possibly dead Python function: watch_selected_agent_id
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1444
low System graph software Dead code conf 1.00 Possibly dead Python function: watch_show_splash
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:857
low System graph quality Integrity conf 1.00 Stub function `render` (body is just `pass`/`return`) — strix/interface/tui/renderers/base_renderer.py:13
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Complexity conf 1.00 Very large file: strix/interface/tui/app.py (2027 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: strix/interface/utils.py (1580 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-g4jq-h2w9-997c
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite middleware may serve files starting with the same name wit…
strix/viewer/frontend/package.json ScaOsvGhsa g4jq h2w9 997c
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-jqfw-vq24-v9c3
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite's `server.fs` settings were not applied to HTML files Ali…
strix/viewer/frontend/package.json ScaOsvGhsa jqfw vq24 v9c3
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/7e003d23-ee4a-46ef-8c80-6fa19a07ded0/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/7e003d23-ee4a-46ef-8c80-6fa19a07ded0/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.