Push this scan report to abhigyanpatwari/GitNexus

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Issue title

Hi @abhigyanpatwari, an automated scan of this repository surfaced **59 code-quality findings** that may be worth a look. 
Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

## Full interactive report

**https://repobility.com/scan/82add7fd-bbe5-41de-a489-334bbd732e67/**

![Live scan page](https://repobility.com/scan/82add7fd-bbe5-41de-a489-334bbd732e67/report.png?v=1778987104)

## At a glance

- **Score**: `75/100`  •  **Grade**: `A-`
- **Scanned**: `2026-05-17 03:05 UTC`
- **Lines of code**: 185,986
- **Total findings**: 59
- **Security-tagged**: 3
- **Credential / secret patterns**: 0

## Top issues, with file & line

_These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree._

1. **[high]** [BINARY] scipy: compound risk score 2194 (CVEs: 0, binary findings: 550)
   _Review binary security profile of scipy — consider alternatives with lower binary attack surface_
2. **[high]** [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — `.github/scripts/check-tree-sitter-upgrade-readiness.py:140`
   _Validate the URL against an allowlist BEFORE fetching:   ALLOWED = {'images.example.com', 'cdn.example.com'}   host = urlparse(url).hostname   if host not in ALLOWED: abort(400)…_
3. **[high]** [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — `.github/scripts/triage/sweep.py:104`
   _Validate the URL against an allowlist BEFORE fetching:   ALLOWED = {'images.example.com', 'cdn.example.com'}   host = urlparse(url).hostname   if host not in ALLOWED: abort(400)…_
4. **[high]** [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — `eval/environments/gitnexus_docker.py:237`
   _Validate the URL against an allowlist BEFORE fetching:   ALLOWED = {'images.example.com', 'cdn.example.com'}   host = urlparse(url).hostname   if host not in ALLOWED: abort(400)…_
5. **[high]** [SEC033] Prototype Pollution — unfiltered merge of user object: Merging user-controlled object into a target without filtering `__proto__`/`constructor`/`prototype` keys lets attackers inject properties onto Object.prototype, affecting every object in the process. CWE-1321. Real-world: CVE-2019-10744 (lodash), CVE-2021-23337 (lodash.set), CVE-2023-26136 (tough-cookie). — `gitnexus/src/core/ingestion/shadow-harness.ts:148`
   _Sanitize keys BEFORE merge:   function sanitize(obj) {     delete obj.__proto__;     delete obj.constructor;     delete obj.prototype;     return obj;   } Or use Object.create(n…_

See all 59 findings, with severity filters and AI fix prompts: **https://repobility.com/scan/82add7fd-bbe5-41de-a489-334bbd732e67/**

---

**What is this?** [Repobility](https://repobility.com) is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is **not a sales pitch** — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

**To re-run after fixes land:** paste your repo URL at [repobility.com](https://repobility.com) — fresh scan, free.

_Issue filed via the public Repobility report at https://repobility.com/scan/82add7fd-bbe5-41de-a489-334bbd732e67/._