Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

usestrix/strix

https://github.com/usestrix/strix · scanned 2026-07-23 19:43 UTC (3 months ago)

86 raw signals (0 security + 86 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v7 · last Δ +1.7 (diff) · 86 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
71.2
/100
Security checks
71
0 findings
System graph
71
100.0% cov · 86 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: low × excluding tests × Reset all
Severity: Critical 0 High 6 Medium 33 Low 36 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 86 Crowd 0 Layer: Software 20 Api 1 Frontend 16 Security 15 Hardware 3 Cicd 1 Quality 13 Dependencies 17
Scan summary Repository scanned at 71.2/100 with 100.0% coverage. It contains 2266 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 86 findings — concentrated in software (20), dependencies (17), frontend (16). Risk profile is high: 0 critical, 6 high, 33 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 36 of 86 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — strix/viewer/static/assets/index-BNKUksp9.js:427
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
strix/viewer/static/assets/index-BNKUksp9.js:427 Fq console leak
low System graph dependencies dependencies conf 0.90 Dependency @dagrejs/dagre is a major version behind
`@dagrejs/dagre` is pinned at `2.0.4` in `strix/viewer/frontend/package.json` while the latest release on the npm registry is `3.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@da…
strix/viewer/frontend/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency diff is a major version behind
`diff` is pinned at `8.0.3` in `strix/viewer/frontend/package.json` while the latest release on the npm registry is `9.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0…
strix/viewer/frontend/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency lucide-react is a major version behind
`lucide-react` is pinned at `0.563.0` in `strix/viewer/frontend/package.json` while the latest release on the npm registry is `1.26.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `lu…
strix/viewer/frontend/package.json FreshnessOutdated
low System graph security Trivy conf 1.00 DS-0014: RUN using 'wget' and 'curl' — containers/Dockerfile
RUN using 'wget' and 'curl' Shouldn't use both curl and wget Rule: DS-0014 Severity: LOW Target: containers/Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — containers/Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: containers/Dockerfile
Misconfig
low System graph quality Tests conf 1.00 Low test-to-source ratio
33 tests / 147 src (ratio 0.22).
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_link_or_copy` in strix/runtime/local_dir_staging.py:62
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `highlighted_old` in strix/interface/tui/renderers/filesystem_renderer.py:152
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `node_to_copy` in strix/interface/tui/app.py:1576
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `unstable_legacy` in strix/viewer/static/assets/index-BNKUksp9.js:48
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: action_open_viewer
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1835
low System graph software Dead code conf 1.00 Possibly dead Python function: action_request_quit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1744
low System graph software Dead code conf 1.00 Possibly dead Python function: action_stop_selected_agent
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1760
low System graph software Dead code conf 1.00 Possibly dead Python function: action_toggle_help
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1726
low System graph software Dead code conf 1.00 Possibly dead Python function: approve
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/agents/factory.py:139
low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_on_exit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/cli.py:122
low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_on_exit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:839
low System graph software Dead code conf 1.00 Possibly dead Python function: compose
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:853
low System graph software Dead code conf 1.00 Possibly dead Python function: configure
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/agents/factory.py:270
low System graph software Dead code conf 1.00 Possibly dead Python function: display_vulnerability
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/cli.py:104
low System graph software Dead code conf 1.00 Possibly dead Python function: do_GET
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/server.py:147
low System graph software Dead code conf 1.00 Possibly dead Python function: do_POST
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/server.py:164
low System graph software Dead code conf 1.00 Possibly dead Python function: draw
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/report_pdf.py:117
low System graph software Dead code conf 1.00 Possibly dead Python function: invoke
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/agents/factory.py:238
low System graph software Dead code conf 1.00 Possibly dead Python function: log_message
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/viewer/server.py:144
low System graph software Dead code conf 1.00 Possibly dead Python function: register_tool_renderer
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/renderers/registry.py:24
low System graph software Dead code conf 1.00 Possibly dead Python function: scan_target
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1457
low System graph software Dead code conf 1.00 Possibly dead Python function: update_status
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/cli.py:162
low System graph software Dead code conf 1.00 Possibly dead Python function: watch_selected_agent_id
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:1444
low System graph software Dead code conf 1.00 Possibly dead Python function: watch_show_splash
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
strix/interface/tui/app.py:857
low System graph quality Integrity conf 1.00 Stub function `render` (body is just `pass`/`return`) — strix/interface/tui/renderers/base_renderer.py:13
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Complexity conf 1.00 Very large file: strix/interface/tui/app.py (2027 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: strix/interface/utils.py (1580 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-g4jq-h2w9-997c
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite middleware may serve files starting with the same name wit…
strix/viewer/frontend/package.json ScaOsvGhsa g4jq h2w9 997c
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.0: GHSA-jqfw-vq24-v9c3
OSV.dev reports `vite` at version `6.0.0` (declared in `strix/viewer/frontend/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752). Note: `6.0.0` is the declared floor of a range — the installed version may be newer. Vite's `server.fs` settings were not applied to HTML files Ali…
strix/viewer/frontend/package.json ScaOsvGhsa jqfw vq24 v9c3
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/7e003d23-ee4a-46ef-8c80-6fa19a07ded0/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/7e003d23-ee4a-46ef-8c80-6fa19a07ded0/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.