Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
19 of your 187 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.
Upstream (GitHub) caused delay on this scan — not Repobility.
  • GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
  • Clone from GitHub took 427.97s for a 448.2 MB repo slow.
  • Repobility's analysis ran in 32.16s after the clone landed.

opf/openproject

https://github.com/opf/openproject · scanned 2026-06-05 14:08 UTC (5 days, 4 hours ago) · 10 languages

180 findings 11/13 scanners ran

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

87 actionable findings from 1 signal source. 93 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

Combined
87.8
/100
Security checks
88
87 findings
System graph
—
—% cov · 0 findings
Critical
4
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 25.0 0.20 5.00
documentation_score 85.0 0.15 12.75
practices_score 100.0 0.15 15.00
code_quality 80.0 0.10 8.00
Overall 1.00 78.5
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 4 High 48 Medium 9 Low 15 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 87 System graph 0 Crowd 0 Layer: Quality 22 Security 33 Cicd 23 Software 9

Showing 76 of 87 actionable findings. 180 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Quality conf 1.00 3 occurrences [SEC096] Rails: SQL injection via where("#{...}") or find_by_sql: ActiveRecord where() / find_by_sql with interpolation enables SQL injection. Concept from Brakeman check_sql — re-authored from OWASP CWE-89.
Use parameterized form: `.where("name = ?", user_input)` or named placeholders.
3 files, 3 locations
app/models/category.rb:53
app/models/journal.rb:205
app/models/queries/projects/filters/filter_on_project_phase.rb:155
critical Security checks cicd CI/CD security conf 0.96 6 occurrences Compose service contains a literal secret environment value
Rotate the value if real. Move it to Docker Compose secrets, a platform secret manager, or an uncommitted environment file.
2 files, 6 locations
docker/pullpreview/docker-compose.yml:51, 64, 73, 79 (4 hits)
docker-compose.yml:113, 125 (2 hits)
CI/CD securitycontainers
critical Security checks cicd CI/CD security conf 0.98 Compose service mounts the Docker socket
Avoid mounting docker.sock. Use a narrow proxy, rootless build service, or provider-native deployment credentials.
docker/dev/tls/docker-compose.yml:1 CI/CD securitycontainers
critical Security checks cicd CI/CD security conf 0.96 Docker image bakes a secret-like ENV value
Remove the secret from the Dockerfile, rotate the value if real, and inject runtime secrets through your platform secret manager.
docker/prod/Dockerfile:32 CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.35 ✓ Repobility 5 occurrences Workflow references repository secrets in a pull_request workflow
Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.
3 files, 5 locations
.github/workflows/pullpreview.yml:59, 60 (2 hits)
.github/workflows/test-core.yml:87, 88 (2 hits)
.github/workflows/downstream-ci.yml:34
CI/CD securityworkflow secretsGitHub Actions
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /(projects/:project_id)/search.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
config/routes.rb:268
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /by_principal/:principal_id.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
config/routes.rb:508
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /members/:user_id.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
config/routes.rb:628
high Security checks security auth conf 0.70 3 occurrences [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /memberships/:membership_id.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
lines 630, 631, 632
config/routes.rb:630, 631, 632 (3 hits)
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /move/:id.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
config/routes.rb:200
high Security checks security auth conf 0.70 2 occurrences [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /options/:option_id.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
lines 239, 715
config/routes.rb:239, 715 (2 hits)
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugin/:id.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
config/routes.rb:778
high Security checks software dependencies conf 0.90 ✓ Repobility 4 occurrences [MINED118] Dockerfile FROM `ruby:4.0.2-trixie` not pinned by digest: `FROM ruby:4.0.2-trixie` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Replace with: `FROM ruby:4.0.2-trixie@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).
4 files, 4 locations
docker/dev/backend/Dockerfile:1
docker/dev/frontend/Dockerfile:1
docker/prod/mysql-to-postgres/Dockerfile:1
extensions/op-blocknote-hocuspocus/Dockerfile:1
high Security checks software dependencies conf 0.90 ✓ Repobility [MINED122] package.json dep `op-blocknote-extensions` pulled from URL/Git: `dependencies.op-blocknote-extensions` = `https://github.com/opf/op-blocknote-extensions/releases/download/v0.1.0/op-blocknote-extensions-0.1.0.tgz` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or git host is compromised, every `npm install` pulls the new payload.
Publish the dependency to npm (or your private registry) and reference it by `^x.y.z`. If that's not possible, lock by commit SHA: `git+https://...#<full-sha>` AND verify the SHA in CI.
extensions/op-blocknote-hocuspocus/package.json:1
high Security checks software dependencies conf 0.90 ✓ Repobility [MINED122] package.json dep `op-blocknote-extensions` pulled from URL/Git: `dependencies.op-blocknote-extensions` = `https://github.com/opf/op-blocknote-extensions/releases/download/v0.1.0/op-blocknote-extensions-0.1.0.tgz` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or git host is compromised, every `npm install` pulls the new payload.
Publish the dependency to npm (or your private registry) and reference it by `^x.y.z`. If that's not possible, lock by commit SHA: `git+https://...#<full-sha>` AND verify the SHA in CI.
frontend/package.json:1
high Security checks software dependencies conf 0.90 ✓ Repobility [MINED126] Workflow container/services image `postgres:16` unpinned: `container/services image: postgres:16` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.
Replace with `postgres:16@sha256:<digest>`. Re-pin via Dependabot Docker scope.
.github/workflows/seed-all-locales.yml:76
high Security checks software dependencies conf 0.90 ✓ Repobility [MINED126] Workflow container/services image `postgres:16` unpinned: `container/services image: postgres:16` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.
Replace with `postgres:16@sha256:<digest>`. Re-pin via Dependabot Docker scope.
.github/workflows/packager.yml:22
high Security checks software dependencies conf 0.90 ✓ Repobility [MINED130] Lockfile pulls package from off-canonical host `github.com`: `package-lock.json` resolved URL for `node_modules/op-blocknote-extensions` is `https://github.com/opf/op-blocknote-extensions/releases/download/v0.1.0/op-block...` — host `github.com` is not the canonical registry. Could be a mirror compromise, dependency confusion attack, or a forgotten private registry.
Verify the host is intentional. If your org uses a private registry, add it to your scanner's allowlist (CANONICAL_NPM_HOSTS). Otherwise, regenerate the lockfile against the canonical registry.
extensions/op-blocknote-hocuspocus/package-lock.json:1
high Security checks software dependencies conf 0.90 ✓ Repobility [MINED130] Lockfile pulls package from off-canonical host `github.com`: `package-lock.json` resolved URL for `node_modules/op-blocknote-extensions` is `https://github.com/opf/op-blocknote-extensions/releases/download/v0.1.0/op-block...` — host `github.com` is not the canonical registry. Could be a mirror compromise, dependency confusion attack, or a forgotten private registry.
Verify the host is intentional. If your org uses a private registry, add it to your scanner's allowlist (CANONICAL_NPM_HOSTS). Otherwise, regenerate the lockfile against the canonical registry.
frontend/package-lock.json:1
high Security checks quality Quality conf 1.00 3 occurrences [SEC097] Rails: force_ssl disabled / protect_from_forgery missing: Rails app disables SSL or CSRF protection. Concept from Brakeman check_force_ssl / check_forgery_setting — re-authored from OWASP A07.
Set `config.force_ssl = true` in production.rb. Use `protect_from_forgery with: :exception`.
3 files, 3 locations
app/controllers/omni_auth_login_controller.rb:40
app/controllers/scim_v2/base_controller_actions.rb:36
app/controllers/sys_controller.rb:40
low Security checks security Injection conf 1.00 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.
Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders).
app/controllers/search_controller.rb:120
high Security checks software Csrf conf 1.00 3 occurrences [SEC109] Rails skip_forgery_protection / protect_from_forgery disabled: Rails CSRF protection turned off at controller level. Any state-changing endpoint becomes a CSRF target.
Remove the skip. For pure-API controllers, inherit from ActionController::API instead (which doesn't include forgery protection). For Bearer-auth APIs, use `protect_from_forgery with: :null_session` only on those specific controllers.
3 files, 3 locations
app/controllers/omni_auth_login_controller.rb:40
app/controllers/scim_v2/base_controller_actions.rb:36
app/controllers/sys_controller.rb:40
high Security checks cicd CI/CD security conf 0.90 Compose service bind-mounts a sensitive host path
Mount only the exact file or directory required, prefer read-only mode, and avoid host system paths.
docker/dev/keycloak/docker-compose.yml:13 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.90 Compose service bind-mounts a sensitive host path
Mount only the exact file or directory required, prefer read-only mode, and avoid host system paths.
docker/dev/gitlab/docker-compose.yml:3 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.90 Database service has no persistent data volume
Mount the database data directory to a named Docker volume or managed persistent disk, and document backup and restore testing.
docker/dev/xwiki/docker-compose.yml:1 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.84 Database service publishes a host port
Use `expose` for service-to-service access, bind to 127.0.0.1 for local-only access, or protect the port with firewall rules.
docker/dev/minio/docker-compose.yml:2 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.95 Docker final stage runs as root
Create an application user after package installation and switch to it with USER appuser or USER 10001.
docker/dev/backend/Dockerfile:67 CI/CD securitycontainers
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 15.7% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes.
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /admin.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:569
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /custom_actions.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:656
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /hover_card.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:565
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /items.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:253
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /ldap_auth_sources.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:644
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /mcp_configurations.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:650
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /project_phases.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:563
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /projects.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:251
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /settings.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:392
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /work_package_priorities.
Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.
config/routes.rb:695
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /custom_style/:digest/export_logo/:filename.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:214
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /custom_style/:digest/logo_mobile/:filename.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:210
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /groups.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:158
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /members.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:97
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /move/:id.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:200
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /pdf_export_template.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:185
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /resend_invite.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:99
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /roles/workflow/:id/:role_id/:type_id.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:153
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /rows.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:170
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: ANY /types.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
config/routes.rb:155
low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.
Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.
app/models/queries/work_packages/filter_serializer.rb:42
medium Security checks cicd CI/CD security conf 0.94 9 occurrences Compose service `backend` image uses the latest tag
Pin to a maintained version tag or digest and update it deliberately through dependency automation.
5 files, 9 locations
docker-compose.yml:61, 71, 125, 240 (4 hits)
docker/dev/tls/docker-compose.yml:1, 59 (2 hits)
docker/dev/gitlab/docker-compose.yml:3
docker/dev/minio/docker-compose.yml:2
docker/pullpreview/docker-compose.yml:79
CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.56 6 occurrences Compose service contains a literal secret environment value
Rotate the value if real. Move it to Docker Compose secrets, a platform secret manager, or an uncommitted environment file.
5 files, 6 locations
docker/dev/keycloak/docker-compose.yml:1, 13 (2 hits)
docker/dev/hocuspocus/docker-compose.yml:1
docker/dev/jira-software/docker-compose.yml:1
docker/dev/minio/docker-compose.yml:2
docker/dev/tls/docker-compose.yml:59
CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.88 7 occurrences Database service has no healthcheck
Add a database-native healthcheck such as pg_isready, mysqladmin ping, redis-cli ping, or the vendor's readiness command.
5 files, 7 locations
docker-compose.yml:92, 113 (2 hits)
docker/dev/xwiki/docker-compose.yml:1, 18 (2 hits)
docker/dev/jira-software/docker-compose.yml:1
docker/dev/keycloak/docker-compose.yml:1
docker/pullpreview/docker-compose.yml:51
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.82 3 occurrences Docker final stage has no non-root USER
Add a non-root USER in the final runtime stage after files and permissions are prepared.
3 files, 3 locations
docker/prod/Dockerfile:135
docker/prod/mysql-to-postgres/Dockerfile:1
extensions/op-blocknote-hocuspocus/Dockerfile:1
CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore
Tighten .dockerignore or replace COPY . with explicit COPY statements.
docker/prod/Dockerfile:83 CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.86 Dockerfile separates apt update from install
Combine update and install in the same RUN instruction and clean package indexes in that layer.
docker/dev/backend/Dockerfile:37 CI/CD securitycontainers
high Security checks quality Quality conf 0.74 11 occurrences Frontend API reference is not matched by discovered backend routes
Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.
7 files, 11 locations
frontend/src/app/core/current-user/current-user.service.ts:109, 126, 183 (3 hits)
frontend/src/app/core/apiv3/endpoints/work_packages/apiv3-work-package-form.ts:8, 21 (2 hits)
frontend/src/app/features/work-packages/components/wp-edit-form/work-package-filter-values.ts:130, 131 (2 hits)
frontend/src/app/features/work-packages/components/wp-list/wp-list.service.ts:208
frontend/src/app/features/work-packages/components/wp-new/wp-create.service.ts:64
frontend/src/app/features/work-packages/components/wp-table/configuration-modal/wp-table-configuration-relation-selector.ts:107
frontend/src/app/shared/components/work-package-graphs/configuration/wp-graph-configuration.ts:36
medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy
Add a Content-Security-Policy header through the web framework or hosting config. For static apps, add a CSP meta tag that restricts default-src, script-src, connect-src, img-src, and frame-ancestors.
index.html
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.
.well-known/security.txt
medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced
Confirm whether this file is reachable. If not, delete it; if yes, wire it through explicit imports, routes, or entry points and add a test that proves the path executes.
app/models/journal/caused_by_system_update.rb:1
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases.
.dockerignore CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.68 5 occurrences App service does not wait for database health
Give the database a healthcheck and change the dependency to `depends_on: { db: { condition: service_healthy } }`.
2 files, 5 locations
docker-compose.yml:61, 71, 149 (3 hits)
docker/pullpreview/docker-compose.yml:64, 73 (2 hits)
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.56 5 occurrences Compose service does not declare a runtime user
Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.
2 files, 5 locations
docker-compose.yml:61, 71, 149 (3 hits)
docker/pullpreview/docker-compose.yml:64, 73 (2 hits)
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.62 8 occurrences Compose service lacks no-new-privileges hardening
Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.
2 files, 8 locations
docker-compose.yml:61, 71, 78, 132, 149 (5 hits)
docker/pullpreview/docker-compose.yml:64, 73, 79 (3 hits)
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.58 3 occurrences Database password is wired through an environment variable placeholder
Prefer Compose secrets or your platform secret manager with *_FILE variables where the image supports them. Rotate only if a real value was committed.
2 files, 3 locations
docker/dev/xwiki/docker-compose.yml:1, 18 (2 hits)
docker-compose.yml:92
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.72 8 occurrences Dockerfile installs recommended OS packages
Add `--no-install-recommends` and explicitly list only packages the image needs.
4 files, 8 locations
docker/dev/backend/Dockerfile:23, 38, 41, 69 (4 hits)
docker/ci/Dockerfile:10, 15 (2 hits)
docker/dev/frontend/Dockerfile:9
docker/prod/mysql-to-postgres/Dockerfile:10
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.74 3 occurrences Dockerfile leaves apt package indexes in the image layer
End the apt install layer with `rm -rf /var/lib/apt/lists/*`.
3 files, 3 locations
docker/ci/Dockerfile:10
docker/dev/backend/Dockerfile:69
docker/dev/frontend/Dockerfile:9
CI/CD securitycontainers
low Security checks quality Quality conf 0.64 Duplicate top-level symbol appears in a patch-style file
Keep one authoritative implementation, update imports to point at it, and remove or rename the duplicate symbol.
app/models/journal/caused_by_system_update.rb:1
low Security checks quality Quality conf 0.60 10 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
10 files, 10 locations
app/components/admin/import/jira/import_runs/wizard_step_confirm_import_component.rb:15
app/components/groups/edit_page_header_component.rb:2
app/components/my/access_token/ical/row_component.rb:24
app/components/open_project/common/inplace_edit_fields/text_input_component.rb:11
app/components/placeholder_users/show_page_header_component.rb:17
app/components/projects/index_page_header_component.rb:69
app/components/projects/index_sub_header_component.rb:13
app/components/projects/settings/project_custom_field_sections/index_component.rb:14
duplicationquality
low Security checks quality Quality conf 0.68 Multiple AI-agent scaffold marker files are present
Keep one current agent instruction file if it helps contributors, remove stale progress/completion markers, and make sure the README, tests, and CI describe the real supported behavior.
.github/copilot-instructions.md:1
low Security checks quality Quality conf 0.64 Public docs site has no llms.txt
Add llms.txt with the product summary, canonical docs, API endpoints, security guidance, and preferred CLI workflow for AI agents.
llms.txt
low Security checks quality Quality conf 0.50 Public web app has no humans.txt
Add humans.txt with team ownership, contact URL, key documentation links, and the last-updated date.
humans.txt
low Security checks quality Quality conf 0.74 Public web app has no robots.txt
Add robots.txt at the web root or a framework-native robots route. Include an explicit Sitemap directive and disallow only private paths.
robots.txt
low Security checks quality Quality conf 0.72 Public web app has no sitemap
Add sitemap.xml, a sitemap index, or a framework-native sitemap route and reference it from robots.txt.
sitemap.xml
high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact
Rename it to the domain concept it implements or merge it into the existing module it was meant to change.
lib/open_project/inplace_edit/handlers/project_update.rb:1
high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact
Rename it to the domain concept it implements or merge it into the existing module it was meant to change.
app/models/journal/caused_by_system_update.rb:1
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/92b6357d-575d-4f40-a408-5de40603b739/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/92b6357d-575d-4f40-a408-5de40603b739/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.