← Back to scan
File as GitHub Issue repo: nightscout/nocturne

Push this scan report to nightscout/nocturne

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Compose service mounts the Docker socket

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT SEC022 [SEC022] Database URL With Embedded Credential: A database connection URL contains an emb… src/Aspire/Nocturne.Aspire.Hosting/Noct…:38
CRIT MINED018 [MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLo… src/Aspire/Nocturne.Aspire.Host/Publish…:114
CRIT SEC116 [SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Mar… src/Aspire/Nocturne.Aspire.Host/Publish…:114
CRIT SEC079 [SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader ca… src/Aspire/Nocturne.Aspire.Host/Publish…:114
CRIT DKC008 Compose service mounts the Docker socket deploy/portainer/docker-compose.yaml:140
CRIT DKC008 Compose service mounts the Docker socket deploy/docker-compose/docker-compose.ya…:152
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… src/Web/packages/cms/src/editor/markdow…:32
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… src/Web/packages/cms/src/editor/extensi…:59
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… src/Web/packages/cms/src/blog/rss.ts:23
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… src/Web/packages/cms/src/remark/vars.ts:18
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… src/Web/packages/app/tools/eslint/no-im…:43
HIGH SEC025 [SEC025] XML External Entity (XXE) — .NET XmlDocument / XmlTextReader: .NET XmlDocument a… src/API/Nocturne.API/Services/Platform/…:119
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/Connectors/Nocturne.Connectors.Core…:22
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/Aspire/Nocturne.Aspire.Hosting/DevS…:71
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/API/Nocturne.API/Services/Backgroun…:85
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). src/Connectors/Nocturne.Connectors.Core…:32
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). src/API/Nocturne.API/Services/Compatibi…:220
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). src/API/Nocturne.API/Hubs/AlarmHub.cs:66
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … src/Desktop/Nocturne.Desktop.Tray/Views…:98
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … src/Aspire/Nocturne.Aspire.Host/Publish…:188
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … scripts/publish-release.cs:121
HIGH MINED118 [MINED118] Dockerfile FROM `node:24-alpine` not pinned by digest: `FROM node:24-alpine` r… src/Web/Dockerfile:31
HIGH MINED118 [MINED118] Dockerfile FROM `node:24-alpine` not pinned by digest: `FROM node:24-alpine` r… src/Web/Dockerfile:6
HIGH MINED115 [MINED115] Action `gradle/actions/setup-gradle` pinned to mutable ref `@v4`: `uses: gradl… .github/workflows/sdk-publish.yml:223
HIGH MINED115 [MINED115] Action `actions/setup-java` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/sdk-publish.yml:217
HIGH MINED115 [MINED115] Action `actions/download-artifact` pinned to mutable ref `@v4`: `uses: actions… .github/workflows/sdk-publish.yml:193
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/sdk-publish.yml:190
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/sdk-publish.yml:165
HIGH MINED115 [MINED115] Action `actions/download-artifact` pinned to mutable ref `@v4`: `uses: actions… .github/workflows/sdk-publish.yml:146
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/sdk-publish.yml:143
HIGH MINED115 [MINED115] Action `NuGet/login` pinned to mutable ref `@v1`: `uses: NuGet/login@v1` resol… .github/workflows/sdk-publish.yml:126
HIGH MINED115 [MINED115] Action `actions/setup-dotnet` pinned to mutable ref `@v4`: `uses: actions/setu… .github/workflows/sdk-publish.yml:114
HIGH MINED115 [MINED115] Action `actions/download-artifact` pinned to mutable ref `@v4`: `uses: actions… .github/workflows/sdk-publish.yml:95
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/sdk-publish.yml:92
HIGH MINED115 [MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/u… .github/workflows/sdk-publish.yml:78
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/sdk-publish.yml:42
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/sdk-publish.yml:37
HIGH MINED115 [MINED115] Action `actions/setup-dotnet` pinned to mutable ref `@v4`: `uses: actions/setu… .github/workflows/sdk-publish.yml:32
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/sdk-publish.yml:29
HIGH MINED115 [MINED115] Action `actions/setup-dotnet` pinned to mutable ref `@v4`: `uses: actions/setu… .github/workflows/copilot-setup-steps.y…:12
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/copilot-setup-steps.y…:8
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/commit-generated-api-…:37
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/commit-generated-api-…:32
HIGH MINED115 [MINED115] Action `actions/setup-dotnet` pinned to mutable ref `@v4`: `uses: actions/setu… .github/workflows/commit-generated-api-…:27
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/commit-generated-api-…:24
HIGH MINED115 [MINED115] Action `github/codeql-action/analyze` pinned to mutable ref `@v4`: `uses: gith… .github/workflows/codeql.yml:63
HIGH MINED115 [MINED115] Action `github/codeql-action/init` pinned to mutable ref `@v4`: `uses: github/… .github/workflows/codeql.yml:46
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/codeql.yml:43
HIGH MINED118 [MINED118] Dockerfile FROM `node:24-alpine` not pinned by digest: `FROM node:24-alpine` r… Dockerfile.web:31
HIGH MINED118 [MINED118] Dockerfile FROM `node:24-alpine` not pinned by digest: `FROM node:24-alpine` r… Dockerfile.web:1
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… src/Connectors/Nocturne.Connectors.Care…:83
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… src/API/Nocturne.API/Services/Auth/Totp…:187
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… src/API/Nocturne.API/Services/Auth/Auth…:58
HIGH JRN004 Consent is collected in UI without visible backend audit persistence src/Web/locales/.wuchale/main.main.de.c…:3
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … src/Web/packages/cms/src/remark/vars.ts:18
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … src/Web/packages/app/tools/eslint/no-im…:43
MED SEC007 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code. src/Aspire/Nocturne.Aspire.Host/Publish…:114
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… src/API/Nocturne.API/Services/Devices/D…:158
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… src/API/Nocturne.API/Services/Alerts/Ru…:97
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… src/API/Nocturne.API/Services/Alerts/Ru…:209
MED DKR003 Compose service `watchtower` image uses the latest tag deploy/portainer/docker-compose.yaml:140
MED DKR003 Compose service `watchtower` image uses the latest tag deploy/docker-compose/docker-compose.ya…:152
MED DKC015 Database service has no healthcheck deploy/portainer/docker-compose.yaml:1
MED DKC015 Database service has no healthcheck deploy/docker-compose/docker-compose.ya…:1
MED DKR001 Docker final stage has no non-root USER src/Web/Dockerfile:31
MED DKR001 Docker final stage has no non-root USER Dockerfile.web:32
MED AGT007 localStorage write failures are swallowed silently src/Web/packages/app/src/lib/components…:23
MED AGT007 localStorage write failures are swallowed silently src/Web/packages/app/src/lib/coach-mark…:23
MED CORE_LARGE_FILES Average file size is 666 lines (recommend <300) —
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Services/Identity/…:471
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Services/Connector…:236
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Services/Connector…:129
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Services/Backgroun…:80
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Services/Backgroun…:23
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Models/Requests/V4…:3
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Models/Requests/V4…:4
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Middleware/Handler…:129
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Middleware/Handler…:33
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Middleware/Handler…:72
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Hubs/DataHub.cs:41
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V4/Tre…:39
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V4/Tre…:99
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V4/Ten…:138
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V3/Tre…:442
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V3/Tre…:437
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V3/Ent…:433
LOW AIC003 Duplicated implementation block across source files src/API/Nocturne.API/Controllers/V2/Not…:64
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKC016 App service does not wait for database health deploy/portainer/docker-compose.yaml:25
LOW DKC016 App service does not wait for database health deploy/docker-compose/docker-compose.ya…:25
LOW AIC009 Multiple AI-agent scaffold marker files are present .github/copilot-instructions.md:1
LOW DKC010 Compose service lacks no-new-privileges hardening deploy/portainer/docker-compose.yaml:76
LOW DKC010 Compose service lacks no-new-privileges hardening deploy/portainer/docker-compose.yaml:45
LOW DKC010 Compose service lacks no-new-privileges hardening deploy/portainer/docker-compose.yaml:25
LOW DKC010 Compose service lacks no-new-privileges hardening deploy/docker-compose/docker-compose.ya…:80
LOW DKC010 Compose service lacks no-new-privileges hardening deploy/docker-compose/docker-compose.ya…:47
LOW DKC010 Compose service lacks no-new-privileges hardening deploy/docker-compose/docker-compose.ya…:25
LOW DKC017 Database password is wired through an environment variable placeholder deploy/portainer/docker-compose.yaml:1
LOW DKC017 Database password is wired through an environment variable placeholder deploy/docker-compose/docker-compose.ya…:1
LOW DKC006 Compose service does not declare a runtime user deploy/portainer/docker-compose.yaml:76
LOW DKC006 Compose service does not declare a runtime user deploy/docker-compose/docker-compose.ya…:80
LOW CORE_NO_LICENSE No LICENSE file —
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … src/Web/packages/cms/src/email/componen…:15
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. src/Web/packages/cms/src/editor/extensi…:88
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. src/Web/packages/bridge/src/types.ts:85
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… src/Web/packages/bridge/src/constants.ts:7
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. src/Web/packages/cms/src/editor/extensi…:23
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. src/Web/packages/app/src/routes/(authen…:24
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. src/Web/packages/app/src/routes/(authen…:64
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/Web/packages/cms/src/blog/rss.ts:37
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/Connectors/Nocturne.Connectors.MyLi…:20
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/Connectors/Nocturne.Connectors.MyLi…:10
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … src/Web/packages/app/src/hooks.client.ts:15
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … src/Web/packages/app/server.js:51
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … src/API/Nocturne.API/wwwroot/scalar/mer…:78
INFO MINED051 [MINED051] Csharp Null Forgive: x! tells compiler "definitely not null" — bypasses nullab… src/API/Nocturne.API/Hubs/HomeAssistant…:166
INFO MINED051 [MINED051] Csharp Null Forgive: x! tells compiler "definitely not null" — bypasses nullab… src/API/Nocturne.API/Controllers/V4/Ide…:56
INFO MINED051 [MINED051] Csharp Null Forgive: x! tells compiler "definitely not null" — bypasses nullab… scripts/publish-release.cs:78
Reset to top 5 118 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `nightscout/nocturne`

**Score: 71/100 (B+)**  ·  118 findings  ·  scanned 2026-06-05 22:41 UTC  ·  2,416,504 LOC

| Severity | Count |
|---|---|
| CRITICAL | 6 |
| HIGH | 48 |
| MEDIUM | 15 |
| LOW | 33 |

📊 [Full filterable report](https://repobility.com/scan/9287f0ec-2794-49f7-bdc4-6dd3062629db/)  ·  ![scorecard](https://repobility.com/scan/9287f0ec-2794-49f7-bdc4-6dd3062629db/report.png?v=1780699284-s2)

### Top findings

1. **CRITICAL** `SEC022` — Database URL With Embedded Credential
   `src/Aspire/Nocturne.Aspire.Hosting/NocturneDatabaseExtensions.cs:38` · A07:2021 Identification & Authentication Failures
2. **CRITICAL** `MINED018` — Unsafe Deserialization Pickle
   `src/Aspire/Nocturne.Aspire.Host/Publishing/PortainerComposePublisher.cs:114` · CWE-502 · ✓ Repobility
3. **CRITICAL** `SEC116` — Ruby YAML.load / Marshal.load on untrusted input
   `src/Aspire/Nocturne.Aspire.Host/Publishing/PortainerComposePublisher.cs:114` · A08:2021 Software & Data Integrity Failures
4. **CRITICAL** `SEC079` — Python: yaml.load without SafeLoader
   `src/Aspire/Nocturne.Aspire.Host/Publishing/PortainerComposePublisher.cs:114` · A05:2021 Security Misconfiguration
5. **CRITICAL** `DKC008` — Compose service mounts the Docker socket
   `deploy/portainer/docker-compose.yaml:140`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/9287f0ec-2794-49f7-bdc4-6dd3062629db/_
Megaproject â high spam risk
Could not determine 'nightscout/nocturne' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.