Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
29 of your 70 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 16.36s · analysis 7.5s · 49.1 MB · GitHub API rate-limit (preflight)

obsidian-tasks-group/obsidian-tasks

https://github.com/obsidian-tasks-group/obsidian-tasks · scanned 2026-06-05 20:51 UTC (1 week, 2 days ago) · 10 languages

311 raw signals (61 security + 250 graph) 11/13 scanners ran 98th percentile · Typescript · large (100-500K LoC) System graph score 64 (higher by 26)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 week, 2 days ago · v2 · 142 actionable findings from 2 signal sources. 44 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
78.0
/100
Security checks
92
27 findings
System graph
64
77.8% cov · 115 findings
Critical
1
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 100.0 0.20 20.00
documentation_score 84.0 0.15 12.60
practices_score 85.0 0.15 12.75
code_quality 70.0 0.10 7.00
Overall 1.00 90.1
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: severity: info × excluding tests × Reset all
Severity: Critical 1 High 0 Medium 10 Low 66 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 27 System graph 115 Crowd 0 Layer: Quality 41 Security 4 Software 54 Cicd 2 Api 1 Frontend 36 Network 4
Scan summary Quality grade A (90/100). Dimensions: security 100, maintainability 85. 61 findings (18 security). 127,922 lines analyzed.

Showing 65 of 142 actionable findings. 186 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

info Security checks software Ssrf conf 1.00 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches.
Validate the URL against an allowlist BEFORE fetching: ALLOWED = {'images.example.com', 'cdn.example.com'} host = urlparse(url).hostname if host not in ALLOWED: abort(400) Or use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request h…
docs/.obsidian/plugins/copy-publish-url/main.js:30
info Security checks software Ssrf conf 1.00 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches.
Validate the URL against an allowlist BEFORE fetching: ALLOWED = {'images.example.com', 'cdn.example.com'} host = urlparse(url).hostname if host not in ALLOWED: abort(400) Or use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request h…
contributing/.obsidian/plugins/copy-publish-url/main.js:30
info Security checks software Xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.
For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.
src/Query/Presets/Presets.ts:51
info Security checks quality Quality conf 1.00 3 occurrences [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).
Use a literal RegExp or whitelist-validate user input before constructing patterns.
3 files, 3 locations
src/Query/Filter/BooleanPreprocessor.ts:102
src/Query/Matchers/RegexMatcher.ts:39
src/Scripting/KnownPlaceholderResolver.ts:73
info Security checks quality Quality conf 1.00 3 occurrences [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).
Use execFile / spawn with separate args array; never pass shell strings.
3 files, 3 locations
src/DateTime/DateFallback.ts:56
src/Query/Filter/BooleanDelimiters.ts:58
src/Query/Filter/BooleanPreprocessor.ts:136
info Security checks quality Quality conf 1.00 3 occurrences [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes — DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production.
Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint.
3 files, 3 locations
src/Config/EnableJsInTasksQueries.ts:64
src/Config/InMemoryLocalStorageProvider.ts:19
src/ui/Menus/DatePicker.ts:43
info Security checks software Redos conf 1.00 [SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like `(a+)+` or quantified alternation with overlapping branches. On adversarial input these patterns exhibit exponential backtracking, freezing the process. CWE-1333. Real CVEs: CVE-2017-16129 (minimatch), CVE-2021-3807 (ansi-regex), and dozens more.
Three options, pick one: 1. Rewrite the pattern to avoid nested quantifiers. E.g. `(a+)+` is functionally equivalent to `a+` for matching purposes. 2. Use Google's re2 (`pip install google-re2`): linear-time, drop-in replacement for `re` for most use cases. 3. Set a hard timeout: `s…
src/Scripting/ExpandPlaceholders.ts:59
info Security checks security Security conf 1.00 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and the parent tab quietly navigates to attacker-controlled content (reverse tabnabbing). OWASP-classic; modern browsers default rel='noopener' for new windows but explicit attribute is still required for compatibility.
Add rel="noopener noreferrer" to every <a target="_blank">: <a href="..." target="_blank" rel="noopener noreferrer">link</a> For dynamically generated links from JS, set rel on the element before appending. Even safe-looking subdomains should harden — costs nothing.
contributing/.obsidian/plugins/copy-publish-url/main.js:30
info Security checks security Injection conf 1.00 3 occurrences [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection).
For literal data structures: use ast.literal_eval(text) — only parses literals, raises on code. For formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists). For Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec'). If you genuinely need to execute admin-st…
3 files, 3 locations
src/DateTime/DateFallback.ts:56
src/Query/Filter/BooleanDelimiters.ts:58
src/Query/Filter/BooleanPreprocessor.ts:136
info Security checks quality Quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p
Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.
src/Obsidian/FileParser.ts:165
info Security checks quality Quality conf 0.45 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
This hit is in a test, sample, or example path. It is useful as polish/teaching-surface feedback, but should not dominate production risk scoring.
resources/sample_vaults/Tasks-Demo/.obsidian/plugins/reveal-active-file-button/main.js:36 examplesquality
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
esbuild.config.mjs:141
info Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.
Review and fix per the pattern semantics. See CWE-532 / for context.
3 files, 3 locations
contributing/.obsidian/plugins/copy-publish-url/main.js:30
docs/.obsidian/plugins/copy-publish-url/main.js:30
resources/sample_vaults/Tasks-Demo/.obsidian/plugins/hot-reload/main.js:96
examplesquality
info Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.
Review and fix per the pattern semantics. See CWE-476 / for context.
3 files, 3 locations
src/Commands/AddQueryFileDefaultsProperties.ts:9
src/Commands/CreateEditorCallback.ts:67
src/Commands/CreateOrEdit.ts:19
info Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.
Review and fix per the pattern semantics. See CWE-704 / for context.
3 files, 3 locations
src/IQuery.ts:87
src/Obsidian/FileParser.ts:17
src/Scripting/ExpandPlaceholders.ts:27
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.
Review and fix per the pattern semantics. See CWE-704 / for context.
src/Suggestor/EditorSuggestorPopup.ts:136
info System graph quality Integrity conf 1.00 Commented-code block (10 lines) in src/lib/logging.ts:225
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (14 lines) in src/Query/QueryFileDefaults.ts:33
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in src/Config/CustomStatusModal.ts:164
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in src/Layout/QueryLayout.ts:22
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in src/Query/Filter/FunctionField.ts:310
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in src/Query/Matchers/RegexMatcher.ts:30
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in src/Renderer/QueryRenderer.ts:392
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in src/Renderer/TaskLineRenderer.ts:46
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in tests/Query/Filter/DescriptionField.test.ts:36
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in src/Config/Settings.ts:224
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in src/lib/RegExpTools.ts:6
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in src/Scripting/ExpandPlaceholders.ts:139
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in src/Task/Task.ts:744
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in src/ui/DependencyHelpers.ts:44
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (7 lines) in src/Suggestor/Suggestor.ts:390
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (7 lines) in src/Task/TaskRegularExpressions.ts:17
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (7 lines) in tests/ui/EditableTask.test.ts:224
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (8 lines) in src/Obsidian/LivePreviewExtension.ts:115
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (8 lines) in src/Query/Filter/BooleanPreprocessor.ts:23
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph api Coverage conf 1.00 No API endpoints detected
The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported.
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Commands/CreateEditorCallback.ts:72
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Commands/index.ts:25
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Config/PresetsSettingsUI.ts:377
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Config/Settings.ts:188
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/DateTime/Postponer.ts:128
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Obsidian/Cache.ts:206
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Obsidian/File.ts:218
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Query/Query.ts:188
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Statuses/StatusConfiguration.ts:69
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/Suggestor/Suggestor.ts:128
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/ui/EditInstructions/DateInstructions.ts:141
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/ui/Menus/DatePicker.ts:25
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — src/ui/Menus/PostponeMenu.ts:41
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/DateTime/Postponer.test.ts:95
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/DateTime/TasksDate.test.ts:231
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Query/Filter/PriorityField.test.ts:118
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Query/Presets/Presets.test.ts:177
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/ExpandPlaceholders.test.ts:110
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/ScriptingReference/CustomFiltering/CustomFilteringExamples.test.ts:597
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/ScriptingReference/CustomGrouping/CustomGroupingExamples.test.ts:552
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/ScriptingReference/CustomSorting/CustomSortingExamples.test.ts:304
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/ScriptingTestHelpers.ts:38
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/TaskProperties.test.ts:22
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Scripting/TasksFile.test.ts:146
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/Suggestor/Suggestor.test.ts:363
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/TestingTools/VerifyMarkdown.ts:11
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/ui/DependencyHelpers.test.ts:14
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/ui/EditableTask.test.ts:224
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
info System graph frontend Frontend quality conf 1.00 TODO/FIXME marker in shipping code — tests/ui/Menus/PostponeMenu.test.ts:137
Track in /reviews or /issues, not as a code comment that rots. Why: Drift control — shouldn't be the same as Quality TODO scanner. Rule id: fq.todo-marker
Fq todo marker
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/8e99b1a9-d2ca-409a-82ad-1347c5dd3629/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/8e99b1a9-d2ca-409a-82ad-1347c5dd3629/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.