Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
9 of your 114 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.61s · analysis 20.51s · 6.8 MB · GitHub API rate-limit (preflight)

mastomii/nexss

https://github.com/mastomii/nexss · scanned 2026-06-17 03:51 UTC (1 month, 1 week ago) · 10 languages

143 raw signals (109 security + 34 graph) 0th percentile · Typescript · small (2-20K LoC) System graph score 74 (lower by 35)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 1 week ago · v1 · 118 actionable findings from 2 signal sources. 25 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
60.5
/100
Security checks
47
86 findings
System graph
74
88.9% cov · 32 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 100.0 0.15 15.00
security_score 0.8 0.25 0.20
testing_score 0.0 0.20 0.00
documentation_score 63.1 0.15 9.46
practices_score 52.0 0.15 7.80
code_quality 66.3 0.10 6.62
Overall 1.00 39.1
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 43 Medium 34 Low 23 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 86 System graph 32 Crowd 0 Layer: Quality 31 Security 21 Software 50 Cicd 5 Api 1 Frontend 9 Hardware 1
Scan summary Repository scanned at 74.3/100 with 88.9% coverage. It contains 572 nodes across 9 cross-layer flows, written primarily in mixed languages. Engine surfaced 34 findings — concentrated in quality (16), frontend (9), security (5). Risk profile is high: 1 critical, 2 high, 12 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 102 of 118 actionable findings. 143 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks software dependencies conf 0.88 fast-xml-parser: GHSA-m7jm-9gc2-mpf2
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
package-lock.json
critical System graph security Secrets conf 1.00 Possible secret in src/app/api/setup/sync/route.ts
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
src/app/api/setup/sync/route.ts:197
low Security checks cicd CI/CD security conf 0.84 Database service publishes a host port
Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports.
docker-compose.yml:38 CI/CD securitycontainers
high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences Dockerfile FROM `node:22-alpine` not pinned by digest
`FROM node:22-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
lines 6, 20, 36
Dockerfile:6, 20, 36 (3 hits)
high Security checks software dependencies conf 0.88 fast-xml-parser: GHSA-37qj-frw5-hhjh
fast-xml-parser has RangeError DoS Numeric Entities Bug
package-lock.json
high Security checks software dependencies conf 0.88 fast-xml-parser: GHSA-8gc5-j5rx-235r
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
package-lock.json
high Security checks software dependencies conf 0.88 flatted: GHSA-25h7-pfq9-p65f
flatted vulnerable to unbounded recursion DoS in parse() revive phase
package-lock.json
high Security checks software dependencies conf 0.88 flatted: GHSA-rf6f-7fwh-wjgh
Prototype Pollution via parse() in NodeJS flatted
package-lock.json
high Security checks software dependencies conf 0.88 minimatch: GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
package-lock.json
high Security checks software dependencies conf 0.88 minimatch: GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
package-lock.json
high Security checks software dependencies conf 0.88 minimatch: GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-267c-6grr-h53f
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-26hh-7cqf-hhc6
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-36qx-fr4f-26g5
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-492v-c6pp-mqqv
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-c4j6-fc7j-m34r
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-mg66-mrh9-m8jx
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
package-lock.json
high Security checks software dependencies conf 0.88 next: GHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
package-lock.json
high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers
package-lock.json
high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value
Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.
src/app/login/page.tsx:185
high System graph security security conf 1.00 Insecure pattern 'eval_used' in src/app/(dashboard)/payloads/page.tsx:226
Found a known-risky pattern (eval_used). Review and replace if possible.
src/app/(dashboard)/payloads/page.tsx:226 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in src/app/route.ts:381
Found a known-risky pattern (eval_used). Review and replace if possible.
src/app/route.ts:381 Eval used
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /settings/route.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /settings/route.
src/app/api/settings/route.ts:63
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /settings/route.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /settings/route.
src/app/api/settings/route.ts:24
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /enumeration/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /enumeration/route.
src/app/api/enumeration/route.ts:84
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /enumeration/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /enumeration/route.
src/app/api/enumeration/route.ts:8
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /reports/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /reports/route.
src/app/api/reports/route.ts:6
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /traffic/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /traffic/route.
src/app/api/traffic/route.ts:186
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /user/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /user/route.
src/app/api/user/route.ts:7
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PATCH /enumeration/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PATCH /enumeration/route.
src/app/api/enumeration/route.ts:113
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /enumeration/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /enumeration/route.
src/app/api/enumeration/route.ts:19
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /persist/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /persist/route.
src/app/api/persist/route.ts:75
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /enumeration/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /enumeration/route.
src/app/api/enumeration/route.ts:47
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /user/route.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /user/route.
src/app/api/user/route.ts:23
medium Security checks software dependencies conf 0.88 ajv: GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option
package-lock.json
medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
package-lock.json
medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore
COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts.
Dockerfile:25 CI/CD securitycontainers
medium Security checks software dependencies conf 0.88 fast-xml-parser: GHSA-gh4j-gqv2-49f6
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
package-lock.json
medium Security checks software dependencies conf 0.88 fast-xml-parser: GHSA-jp2q-39xq-3w4g
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
package-lock.json
high Security checks quality Quality conf 0.74 15 occurrences Frontend API reference is not matched by discovered backend routes
A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys.
5 files, 15 locations
src/app/(dashboard)/payloads/page.tsx:80, 98, 120, 143, 157, 172, 465 (7 hits)
next.config.ts:30, 54, 78, 102 (4 hits)
src/app/(dashboard)/profile/page.tsx:66, 127 (2 hits)
src/app/(dashboard)/dashboard/page.tsx:51
src/app/(dashboard)/reports/[id]/page.tsx:311
medium Security checks software dependencies conf 0.88 js-yaml: GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-3x4c-7xq6-9pq8
Next.js: Unbounded next/image disk cache growth can exhaust storage
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-5f7q-jpqc-wp7h
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-9g9p-9gw9-jx7f
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-ffhc-5mcf-pf4q
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-ggv3-7p47-pfv8
Next.js: HTTP request smuggling in rewrites
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-gx5p-jg67-6x7h
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-h27x-g6w4-24gq
Next.js: Unbounded postponed resume buffering can lead to DoS
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-h64f-5h5j-jqjh
Next.js has a Denial of Service in the Image Optimization API
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-mq59-m269-xvcx
Next.js: null origin can bypass Server Actions CSRF checks
package-lock.json
medium Security checks software dependencies conf 0.88 next: GHSA-wfc6-r584-vfw7
Next.js vulnerable to cache poisoning in React Server Component responses
package-lock.json
high Security checks software dependencies conf 0.90 npm package `otplib` is 1 major version(s) behind (12.0.1 -> 13.4.1)
`otplib` is pinned/resolved at 12.0.1 but the latest stable release on the npm registry is 13.4.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
package-lock.json
medium Security checks software dependencies conf 0.88 postcss: GHSA-qx2v-qp2m-jg93
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
package-lock.json
medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy
A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.
index.html
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.
.well-known/security.txt
medium Security checks quality Quality conf 0.78 React interval is created without an explicit cleanup
Intervals created in React hooks or components should be cleared on unmount. Missing cleanup can keep stale callbacks alive after recording, polling, or overlay components close.
src/app/route.ts:292
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/app/(dashboard)/payloads/page.tsx:231
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/app/(dashboard)/reports/page.tsx:96
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/app/route.ts:309
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/components/layout/header.tsx:23
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/lib/api-client.ts:41
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/lib/settings-context.tsx:23
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/lib/telegram.ts:131
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in src/lib/cors.ts:10
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
src/lib/cors.ts:10 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/app/route.ts:340
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
src/app/route.ts:340 Direct innerhtml assignment
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 34 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
0 test file(s) for 80 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.
Coverage
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
.dockerignore exists but does not cover common secret or VCS patterns.
.dockerignore CI/CD securitycontainers
low Security checks software dependencies conf 0.88 @babel/core: GHSA-4x5r-pxfx-6jf8
@babel/core: Arbitrary File Read via sourceMappingURL Comment
package-lock.json
low Security checks security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
high Security checks cicd CI/CD security conf 0.62 Compose service lacks no-new-privileges hardening
no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.
docker-compose.yml:4 CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.58 Database password is wired through an environment variable placeholder
Environment placeholders are not committed secrets, but database official images often support *_FILE variables so Compose secrets can provide narrower filesystem-based access.
docker-compose.yml:38 CI/CD securitycontainers
low Security checks quality Quality conf 0.60 4 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
4 files, 4 locations
src/app/(dashboard)/settings/page.tsx:425
src/app/api/settings/route.ts:15
src/app/api/traffic/route.ts:43
src/lib/auth.ts:84
duplicationquality
low Security checks software dependencies conf 0.88 fast-xml-parser: GHSA-fj3w-jwp8-x2g3
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
package-lock.json
low Security checks software dependencies conf 0.88 next: GHSA-3g8h-86w9-wvmq
Next.js's Middleware / Proxy redirects can be cache-poisoned
package-lock.json
low Security checks software dependencies conf 0.88 next: GHSA-jcc7-9wpm-mj36
Next.js: null origin can bypass dev HMR websocket CSRF checks
package-lock.json
low Security checks software dependencies conf 0.88 next: GHSA-vfv6-92ff-j949
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
package-lock.json
high Security checks software dependencies conf 0.90 npm package `@types/pg` is minor version(s) behind (8.16.0 -> 8.20.0)
`@types/pg` is pinned/resolved at 8.16.0 but the latest stable release on the npm registry is 8.20.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `jose` is minor version(s) behind (6.1.3 -> 6.2.3)
`jose` is pinned/resolved at 6.1.3 but the latest stable release on the npm registry is 6.2.3 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `pg` is minor version(s) behind (8.16.3 -> 8.21.0)
`pg` is pinned/resolved at 8.16.3 but the latest stable release on the npm registry is 8.21.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `sharp` is minor version(s) behind (0.34.5 -> 0.35.1)
`sharp` is pinned/resolved at 0.34.5 but the latest stable release on the npm registry is 0.35.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `swr` is minor version(s) behind (2.3.8 -> 2.4.1)
`swr` is pinned/resolved at 2.3.8 but the latest stable release on the npm registry is 2.4.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `tailwind-merge` is minor version(s) behind (3.4.0 -> 3.6.0)
`tailwind-merge` is pinned/resolved at 3.4.0 but the latest stable release on the npm registry is 3.6.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
low Security checks quality Quality conf 0.64 Public docs site has no llms.txt
AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.
llms.txt
low Security checks quality Quality conf 0.50 Public web app has no humans.txt
humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.
humans.txt
low Security checks quality Quality conf 0.72 Public web app has no sitemap
A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.
sitemap.xml
low System graph quality Production readiness conf 1.00 Composite production-readiness gap
Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.
Repo hardeningGenerated repo pattern
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 3 occurrences Docker base image is tag-pinned but not digest-pinned: node:22-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
lines 6, 20, 36
Dockerfile:6, 20, 36 (3 hits)
containersPinned dependencies
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — src/app/api/callback/route.ts:216
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — src/app/api/setup/sync/route.ts:429
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — src/lib/cleanup.ts:299
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — src/services/base.service.ts:109
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph quality Complexity conf 1.00 Very large file: src/app/(dashboard)/reports/[id]/page.tsx (1634 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/app/(dashboard)/settings/page.tsx (896 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
high Security checks software dependencies conf 0.90 npm package `react-syntax-highlighter` is patch version(s) behind (16.1.0 -> 16.1.1)
`react-syntax-highlighter` is pinned/resolved at 16.1.0 but the latest stable release on the npm registry is 16.1.1 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs …
package.json
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/7f330887-921c-4316-9fdc-23c4726f09d4/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/7f330887-921c-4316-9fdc-23c4726f09d4/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.