Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

8 of your 63 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.35s · analysis 27.53s · 13.1 MB · GitHub API rate-limit (preflight)

palmier-io/palmier-pro

https://github.com/palmier-io/palmier-pro · scanned 2026-06-22 03:20 UTC (1 month ago) · 10 languages

83 raw signals (55 security + 28 graph) 40th percentile · Swift · medium (20-100K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v1 · 68 actionable findings from 2 signal sources. 15 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

55.6% cov · 27 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	40.0	0.15	6.00
`security_score`	55.0	0.25	13.75
`testing_score`	80.0	0.20	16.00
`documentation_score`	90.0	0.15	13.50
`practices_score`	65.0	0.15	9.75
`code_quality`	74.8	0.10	7.48
Overall		1.00	66.5

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 1 High 23 Medium 23 Low 18 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 41 System graph 27 Crowd 0 Layer: Software 38 Cicd 1 Quality 11 Security 18

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 75.8/100 with 55.6% coverage. It contains 393 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 28 findings — concentrated in security (18), quality (8), software (1). Risk profile is high: 0 critical, 5 high, 11 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 65 of 68 actionable findings. 83 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks software dependencies conf 0.88 pillow: GHSA-3f63-hfp8-52jq

Arbitrary Code Execution in Pillow

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 pillow: GHSA-44wm-f244-xhp3

Pillow buffer overflow vulnerability

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 pillow: PYSEC-2023-175

Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 pillow: PYSEC-2023-227

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on …

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 pillow: PYSEC-2026-165

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 requests: PYSEC-2018-28

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 requests: PYSEC-2023-74

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent …

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-203

An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-204

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-205

A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-206

pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-207

A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-208

A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2025-209

An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 torch: PYSEC-2026-139

A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project …

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 transformers: PYSEC-2025-217

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vul…

models/siglip2/requirements.txt

high Security checks software dependencies conf 0.88 undici: GHSA-hm92-r4w5-c3mj

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

mcpb/server/package-lock.json

high Security checks software dependencies conf 0.88 undici: GHSA-vmh5-mc38-953g

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

mcpb/server/package-lock.json

high Security checks software dependencies conf 0.88 undici: GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

mcpb/server/package-lock.json

high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.25.0 — mcpb/server/package-lock.json

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …

VulnCve 2026 12151

high System graph security Trivy conf 1.00 CVE-2026-28980: github.com/apple/swift-nio 2.97.1 — Package.resolved

SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS ### Summary The `HTTPDecoder` in `NIOHTTP1` enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary numb…

VulnCve 2026 28980

high System graph security Trivy conf 1.00 CVE-2026-43671: github.com/apple/swift-nio 2.97.1 — Package.resolved

SwiftNIO: Out-of-bounds write via ByteBuffer index and length UInt32 overflow ### Summary A program using swift-nio is vulnerable to a potential out-of-bounds write when attacker-controlled index or length values exceeding `UInt32.max` are passed to some `ByteBuffer` methods. This affects all swi…

VulnCve 2026 43671

high System graph security Trivy conf 1.00 CVE-2026-6734: undici 7.25.0 — mcpb/server/package-lock.json

undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requ…

VulnCve 2026 6734

high System graph security Trivy conf 1.00 CVE-2026-9697: undici 7.25.0 — mcpb/server/package-lock.json

undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default tr…

VulnCve 2026 9697

medium Security checks software dependencies conf 0.88 filelock: GHSA-qmgc-5h2g-mvrw

filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 filelock: GHSA-w853-jp5j-5j7f

filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 pillow: GHSA-r73j-pqj5-w3x7

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 requests: GHSA-9hjg-9r4m-mvj7

Requests vulnerable to .netrc credentials leak via malicious URLs

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 requests: GHSA-9wx4-h78v-vm56

Requests `Session` object does not verify requests after making first request with verify=False

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 requests: GHSA-gc5v-m9x4-r6x2

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.90 ✓ Repobility 5 occurrences requirements.txt: `pillow` has no version pin

Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins.

lines 4, 6, 8, 9, 10

models/siglip2/requirements.txt:4, 6, 8, 9, 10 (5 hits)

medium Security checks software dependencies conf 0.88 torch: GHSA-887c-mr87-cxwp

PyTorch Improper Resource Shutdown or Release vulnerability

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 torch: GHSA-vgrw-7cvw-pwgx

PyTorch is vulnerable to memory corruption through its unpack_sequence function

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 transformers: GHSA-69w3-r845-3855

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

models/siglip2/requirements.txt

medium Security checks software dependencies conf 0.88 undici: GHSA-p88m-4jfj-68fv

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

mcpb/server/package-lock.json

medium Security checks software dependencies conf 0.88 undici: GHSA-pr7r-676h-xcf6

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

mcpb/server/package-lock.json

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph quality Tests conf 1.00 CI is configured but no tests are detected

A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal.

CI/CDConfig theaterRepo hardening

medium System graph security Trivy conf 1.00 CVE-2025-2999: torch 2.7.0 — models/siglip2/requirements.txt

A vulnerability was found in PyTorch 2.6.0. It has been rated as criti ... A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requi…

VulnCve 2025 2999

medium System graph security Trivy conf 1.00 CVE-2025-3730: torch 2.7.0 — models/siglip2/requirements.txt

A vulnerability, which was classified as problematic, was found in PyT ... A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of servi…

VulnCve 2025 3730

medium System graph security Trivy conf 1.00 CVE-2026-28970: github.com/apple/swift-nio 2.97.1 — Package.resolved

SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator Programs using swift-nio is vulnerable to HTTP request smuggling and HTTP response splitting attacks, caused by insufficient validation of outbound HTTP/1.1 request and response start line components. This vu…

VulnCve 2026 28970

medium System graph security Trivy conf 1.00 CVE-2026-47121: github.com/sparkle-project/Sparkle 2.9.1 — Package.resolved

Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta ## Summary Binary delta apply intermediate-symlink traversal in malicious .delta `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent …

VulnCve 2026 47121

medium System graph security Trivy conf 1.00 CVE-2026-47122: github.com/sparkle-project/Sparkle 2.9.1 — Package.resolved

Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection ## Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. ## Details `Autoupdate/AppInstaller.m`'…

VulnCve 2026 47122

medium System graph security Trivy conf 1.00 CVE-2026-9678: undici 7.25.0 — mcpb/server/package-lock.json

undici: Undici: Information disclosure due to improper cache-control header parsing Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" author…

VulnCve 2026 9678

medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 7.25.0 — mcpb/server/package-lock.json

undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…

VulnCve 2026 9679

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 3 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks quality Quality conf 0.60 8 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

8 files, 8 locations

Sources/PalmierPro/Account/IdentityViews.swift:96

Sources/PalmierPro/Agent/Clients/PalmierClient.swift:6

Sources/PalmierPro/MediaPanel/MusicTab.swift:239

Sources/PalmierPro/Preview/TransformOverlayView.swift:218

Sources/PalmierPro/Project/ProjectCard.swift:78

Sources/PalmierPro/Project/WelcomeOverlay.swift:48

Sources/PalmierPro/Settings/SettingsView.swift:159

Tests/PalmierProTests/Timeline/RippleGapDeleteTests.swift:1

duplicationquality

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 19, 25

.github/workflows/ci.yml:19, 25 (3 hits)

CI/CD securitySupply chainGitHub Actions

low Security checks software dependencies conf 0.90 Python package `torch` is minor version(s) behind (2.7.0 -> 2.12.1)

`torch==2.7.0` is minor version(s) behind the latest stable release on PyPI (2.12.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

models/siglip2/requirements.txt:1

low Security checks software dependencies conf 0.88 torch: GHSA-3749-ghw9-m3mg

PyTorch susceptible to local Denial of Service

models/siglip2/requirements.txt

low Security checks software dependencies conf 0.88 torch: GHSA-qfhq-4f3w-5fph

PyTorch is vulnerable to memory corruption through its torch.lstm_cell function

models/siglip2/requirements.txt

low Security checks software dependencies conf 0.88 torch: GHSA-rrmf-rvhw-rf47

PyTorch is vulnerable to memory corruption through its torch.jit.script function

models/siglip2/requirements.txt

low Security checks software dependencies conf 0.88 undici: GHSA-35p6-xmwp-9g52

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

mcpb/server/package-lock.json

low Security checks software dependencies conf 0.88 undici: GHSA-g8m3-5g58-fq7m

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

mcpb/server/package-lock.json

low System graph security Trivy conf 1.00 CVE-2025-2953: torch 2.7.0 — models/siglip2/requirements.txt

torch: PyTorch torch.mkldnn_max_pool2d denial of service A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally.…

VulnCve 2025 2953

low System graph security Trivy conf 1.00 CVE-2025-3000: torch 2.7.0 — models/siglip2/requirements.txt

A vulnerability classified as critical has been found in PyTorch 2.6.0 ... A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exp…

VulnCve 2025 3000

low System graph security Trivy conf 1.00 CVE-2025-3001: torch 2.7.0 — models/siglip2/requirements.txt

A vulnerability classified as critical was found in PyTorch 2.6.0. Thi ... A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit…

VulnCve 2025 3001

low System graph security Trivy conf 1.00 CVE-2026-11525: undici 7.25.0 — mcpb/server/package-lock.json

undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC…

VulnCve 2026 11525

low System graph security Trivy conf 1.00 CVE-2026-6733: undici 7.25.0 — mcpb/server/package-lock.json

undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response…

VulnCve 2026 6733

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 12 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence

The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.

Governance

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: models/siglip2/convert.py:forward, models/siglip2/convert.py:forward This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.

duplicatesduplication

low System graph software Dead code conf 1.00 Possibly dead Python function: forward

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

models/siglip2/convert.py:73

low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence

The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.

Git historyGenerated repo pattern

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/8e02260d-0b37-45ba-bb45-a755948fcd18/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/8e02260d-0b37-45ba-bb45-a755948fcd18/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.