← Back to scan
File as GitHub Issue repo: virattt/ai-hedge-fund

Push this scan report to virattt/ai-hedge-fund

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Bare except continues silently

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … app/frontend/src/data/node-mappings.ts:18
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… app/frontend/src/components/settings/ap…:187
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … app/backend/routes/api_keys.py:27
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … app/backend/repositories/api_key_reposi…:15
MED MINED111 Bare except continues silently src/utils/ollama.py:144
MED MINED111 Bare except continues silently src/utils/ollama.py:51
MED MINED111 Bare except continues silently src/utils/ollama.py:45
MED MINED111 Bare except continues silently src/utils/ollama.py:387
MED MINED111 Bare except continues silently src/utils/ollama.py:306
MED MINED111 Bare except continues silently src/utils/ollama.py:109
MED MINED111 Bare except continues silently src/utils/llm.py:72
MED MINED111 Bare except continues silently src/utils/llm.py:157
MED MINED111 Bare except continues silently src/agents/valuation.py:390
MED MINED111 Bare except continues silently src/agents/risk_manager.py:84
MED MINED111 Bare except continues silently src/agents/charlie_munger.py:724
MED MINED111 Bare except continues silently src/agents/rakesh_jhunjhunwala.py:577
MED MINED111 Bare except continues silently app/backend/routes/hedge_fund.py:216
MED MINED111 Bare except continues silently app/backend/routes/hedge_fund.py:59
MED MINED111 Bare except continues silently app/backend/services/ollama_service.py:371
MED MINED111 Bare except continues silently app/backend/services/ollama_service.py:354
MED MINED111 Bare except continues silently app/backend/services/ollama_service.py:204
MED MINED111 Bare except continues silently app/backend/services/graph.py:190
MED MINED111 Bare except continues silently app/backend/services/backtest_service.py:344
MED MINED111 Bare except continues silently app/backend/services/backtest_service.py:386
MED MINED111 Bare except continues silently app/backend/services/backtest_service.py:351
MED MINED109 Mutable default argument in `__init__` (dict) app/backend/services/backtest_service.py:24
MED MINED111 Bare except continues silently tests/backtesting/integration/conftest.…:58
MED MINED111 Bare except continues silently tests/backtesting/integration/conftest.…:25
MED MINED111 Bare except continues silently src/main.py:40
MED MINED109 Mutable default argument in `run_hedge_fund` (list) src/main.py:46
MED MINED111 Bare except continues silently src/backtester.py:36
MED DKR003 Compose service `ollama` image uses the latest tag docker/docker-compose.yml:1
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR002 Compose service `backtester-ollama` image has no explicit tag docker/docker-compose.yml:77
MED DKR002 Compose service `backtester` image has no explicit tag docker/docker-compose.yml:62
MED DKR002 Compose service `hedge-fund-ollama` image has no explicit tag docker/docker-compose.yml:47
MED DKR002 Compose service `hedge-fund-reasoning` image has no explicit tag docker/docker-compose.yml:32
MED DKR002 Compose service `hedge-fund` image has no explicit tag docker/docker-compose.yml:17
MED DEPCUR-NPM npm package `@vitejs/plugin-react` is 2 major version(s) behind (4.2.1 -> 6.0.2) app/frontend/package.json
MED DEPCUR-NPM npm package `@types/react-dom` is 1 major version(s) behind (18.2.18 -> 19.2.3) app/frontend/package.json
MED DEPCUR-NPM npm package `react-syntax-highlighter` is 1 major version(s) behind (15.6.1 -> 16.1.1) app/frontend/package.json
MED DEPCUR-NPM npm package `react-resizable-panels` is 1 major version(s) behind (3.0.2 -> 4.11.2) app/frontend/package.json
MED DEPCUR-PY Python package `groq` is 1 major version(s) behind (0.32.0 -> 1.4.0) poetry.lock
MED DEPCUR-PY Python package `flake8` is 1 major version(s) behind (6.1.0 -> 7.3.0) poetry.lock
MED DEPCUR-PY Python package `certifi` is 1 major version(s) behind (2025.10.5 -> 2026.5.20) poetry.lock
MED DEPCUR-PY Python package `cachetools` is 1 major version(s) behind (6.2.1 -> 7.1.4) poetry.lock
MED DEPCUR-PY Python package `black` is 3 major version(s) behind (23.12.1 -> 26.5.1) poetry.lock
MED DEPCUR-PY Python package `attrs` is 1 major version(s) behind (25.4.0 -> 26.1.0) poetry.lock
MED DEPCUR-PY Python package `anyio` is 1 major version(s) behind (3.7.1 -> 4.13.0) poetry.lock
MED GHSA-2c2j-9gv5-cj73 starlette: GHSA-2c2j-9gv5-cj73 poetry.lock
MED GHSA-gc5v-m9x4-r6x2 requests: GHSA-gc5v-m9x4-r6x2 poetry.lock
MED GHSA-mf9w-mj56-hr94 python-dotenv: GHSA-mf9w-mj56-hr94 poetry.lock
MED GHSA-6w46-j5rx-g56g pytest: GHSA-6w46-j5rx-g56g poetry.lock
MED GHSA-r73j-pqj5-w3x7 pillow: GHSA-r73j-pqj5-w3x7 poetry.lock
MED GHSA-5xmw-vc9v-4wf2 pillow: GHSA-5xmw-vc9v-4wf2 poetry.lock
MED GHSA-v34v-rq6j-cj6p langsmith: GHSA-v34v-rq6j-cj6p poetry.lock
MED GHSA-rr7j-v2q5-chgv langsmith: GHSA-rr7j-v2q5-chgv poetry.lock
MED GHSA-mhr3-j7m5-c7c9 langgraph-checkpoint: GHSA-mhr3-j7m5-c7c9 poetry.lock
MED GHSA-926x-3r5x-gfhw langchain-core: GHSA-926x-3r5x-gfhw poetry.lock
MED GHSA-65pc-fj4g-8rjx idna: GHSA-65pc-fj4g-8rjx poetry.lock
MED GHSA-768j-98cg-p3fv fonttools: GHSA-768j-98cg-p3fv poetry.lock
MED GHSA-w2fm-2cpv-w7v5 aiohttp: GHSA-w2fm-2cpv-w7v5 poetry.lock
MED GHSA-p998-jp59-783m aiohttp: GHSA-p998-jp59-783m poetry.lock
MED GHSA-m5qp-6w8w-w647 aiohttp: GHSA-m5qp-6w8w-w647 poetry.lock
MED GHSA-jj3x-wxrx-4x23 aiohttp: GHSA-jj3x-wxrx-4x23 poetry.lock
MED GHSA-jg22-mg44-37j8 aiohttp: GHSA-jg22-mg44-37j8 poetry.lock
MED GHSA-hg6j-4rv6-33pg aiohttp: GHSA-hg6j-4rv6-33pg poetry.lock
MED GHSA-g84x-mcqj-x9qq aiohttp: GHSA-g84x-mcqj-x9qq poetry.lock
MED GHSA-c427-h43c-vf67 aiohttp: GHSA-c427-h43c-vf67 poetry.lock
MED GHSA-6jhg-hg63-jvvf aiohttp: GHSA-6jhg-hg63-jvvf poetry.lock
MED GHSA-48c2-rrv3-qjmp yaml: GHSA-48c2-rrv3-qjmp app/frontend/pnpm-lock.yaml
MED GHSA-93m4-6634-74q7 vite: GHSA-93m4-6634-74q7 app/frontend/pnpm-lock.yaml
MED GHSA-4w7w-66w2-5vf9 vite: GHSA-4w7w-66w2-5vf9 app/frontend/pnpm-lock.yaml
MED GHSA-x7hr-w5r2-h6wg prismjs: GHSA-x7hr-w5r2-h6wg app/frontend/pnpm-lock.yaml
MED GHSA-qx2v-qp2m-jg93 postcss: GHSA-qx2v-qp2m-jg93 app/frontend/pnpm-lock.yaml
MED GHSA-3v7f-55p6-f55p picomatch: GHSA-3v7f-55p6-f55p app/frontend/pnpm-lock.yaml
MED GHSA-mh29-5h37-fv8m js-yaml: GHSA-mh29-5h37-fv8m app/frontend/pnpm-lock.yaml
MED GHSA-67mh-4wv8-2f99 esbuild: GHSA-67mh-4wv8-2f99 app/frontend/pnpm-lock.yaml
MED GHSA-f886-m6hf-6m8v brace-expansion: GHSA-f886-m6hf-6m8v app/frontend/pnpm-lock.yaml
MED GHSA-2g4f-4pwh-qvx6 ajv: GHSA-2g4f-4pwh-qvx6 app/frontend/pnpm-lock.yaml
MED GHSA-48c2-rrv3-qjmp yaml: GHSA-48c2-rrv3-qjmp app/frontend/package-lock.json
MED GHSA-xcj6-pq6g-qj4x vite: GHSA-xcj6-pq6g-qj4x app/frontend/package-lock.json
MED GHSA-x574-m823-4x7w vite: GHSA-x574-m823-4x7w app/frontend/package-lock.json
MED GHSA-vg6x-rcgg-rjx6 vite: GHSA-vg6x-rcgg-rjx6 app/frontend/package-lock.json
MED GHSA-9cwx-2883-4wfx vite: GHSA-9cwx-2883-4wfx app/frontend/package-lock.json
MED GHSA-93m4-6634-74q7 vite: GHSA-93m4-6634-74q7 app/frontend/package-lock.json
MED GHSA-8jhw-289h-jh2g vite: GHSA-8jhw-289h-jh2g app/frontend/package-lock.json
MED GHSA-859w-5945-r5v3 vite: GHSA-859w-5945-r5v3 app/frontend/package-lock.json
MED GHSA-64vr-g452-qvp3 vite: GHSA-64vr-g452-qvp3 app/frontend/package-lock.json
MED GHSA-4w7w-66w2-5vf9 vite: GHSA-4w7w-66w2-5vf9 app/frontend/package-lock.json
MED GHSA-4r4m-qw57-chr8 vite: GHSA-4r4m-qw57-chr8 app/frontend/package-lock.json
MED GHSA-356w-63v5-8wf4 vite: GHSA-356w-63v5-8wf4 app/frontend/package-lock.json
MED GHSA-x7hr-w5r2-h6wg prismjs: GHSA-x7hr-w5r2-h6wg app/frontend/package-lock.json
MED GHSA-qx2v-qp2m-jg93 postcss: GHSA-qx2v-qp2m-jg93 app/frontend/package-lock.json
MED GHSA-3v7f-55p6-f55p picomatch: GHSA-3v7f-55p6-f55p app/frontend/package-lock.json
MED GHSA-mh29-5h37-fv8m js-yaml: GHSA-mh29-5h37-fv8m app/frontend/package-lock.json
MED GHSA-67mh-4wv8-2f99 esbuild: GHSA-67mh-4wv8-2f99 app/frontend/package-lock.json
MED GHSA-f886-m6hf-6m8v brace-expansion: GHSA-f886-m6hf-6m8v app/frontend/package-lock.json
MED GHSA-2g4f-4pwh-qvx6 ajv: GHSA-2g4f-4pwh-qvx6 app/frontend/package-lock.json
MED GHSA-968p-4wvh-cqc8 @babel/helpers: GHSA-968p-4wvh-cqc8 app/frontend/package-lock.json
MED DKR001 Docker final stage has no non-root USER docker/Dockerfile:1
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED DKR014 Dockerfile copies broad context with incomplete .dockerignore docker/Dockerfile:19
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered r… —
MED AUC012 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /… —
MED AGT015 Remote install command pipes network code directly to a shell src/utils/ollama.py:34
MED CORE_NO_CI No CI/CD configuration found —
LOW COMP001 [COMP001] High cognitive complexity: Function `get_agent_model_config` has cognitive comp… app/backend/models/schemas.py:76
LOW COMP001 [COMP001] High cognitive complexity: Function `startup_event` has cognitive complexity 10… app/backend/main.py:33
LOW COMP001 [COMP001] High cognitive complexity: Function `downgrade` has cognitive complexity 8 (Son… app/backend/alembic/versions/3f9a6b7c8d…:70
LOW DEPCUR-NPM npm package `eslint-plugin-react-refresh` is minor version(s) behind (0.4.5 -> 0.5.2) app/frontend/package.json
LOW DEPCUR-NPM npm package `autoprefixer` is minor version(s) behind (10.4.21 -> 10.5.0) app/frontend/package.json
LOW DEPCUR-NPM npm package `tailwind-merge` is minor version(s) behind (3.2.0 -> 3.6.0) app/frontend/package.json
LOW DEPCUR-NPM npm package `@xyflow/react` is minor version(s) behind (12.5.1 -> 12.11.0) app/frontend/package.json
LOW DEPCUR-PY Python package `iniconfig` is minor version(s) behind (2.1.0 -> 2.3.0) poetry.lock
LOW DEPCUR-PY Python package `idna` is minor version(s) behind (3.11 -> 3.18) poetry.lock
LOW DEPCUR-PY Python package `httpx` is minor version(s) behind (0.27.2 -> 0.28.1) poetry.lock
LOW DEPCUR-PY Python package `httptools` is minor version(s) behind (0.7.1 -> 0.8.0) poetry.lock
LOW DEPCUR-PY Python package `grpcio-status` is minor version(s) behind (1.75.1 -> 1.81.0) poetry.lock
LOW DEPCUR-PY Python package `googleapis-common-protos` is minor version(s) behind (1.70.0 -> 1.75.0) poetry.lock
LOW DEPCUR-PY Python package `google-auth` is minor version(s) behind (2.41.1 -> 2.53.0) poetry.lock
LOW DEPCUR-PY Python package `google-api-core` is minor version(s) behind (2.26.0 -> 2.31.0) poetry.lock
LOW DEPCUR-PY Python package `google-ai-generativelanguage` is minor version(s) behind (0.7.0 -> 0.12.0) poetry.lock
LOW DEPCUR-PY Python package `gigachat` is minor version(s) behind (0.1.42.post2 -> 0.2.1) poetry.lock
LOW DEPCUR-PY Python package `fastapi` is minor version(s) behind (0.104.1 -> 0.136.3) poetry.lock
LOW DEPCUR-PY Python package `docstring-parser` is minor version(s) behind (0.17.0 -> 0.18.0) poetry.lock
LOW DEPCUR-PY Python package `click` is minor version(s) behind (8.3.0 -> 8.4.1) poetry.lock
LOW DEPCUR-PY Python package `anthropic` is minor version(s) behind (0.70.0 -> 0.105.2) poetry.lock
LOW DEPCUR-PY Python package `alembic` is minor version(s) behind (1.17.0 -> 1.18.4) poetry.lock
LOW GHSA-5239-wwwm-4pmq pygments: GHSA-5239-wwwm-4pmq poetry.lock
LOW GHSA-2g6r-c272-w58r langchain-core: GHSA-2g6r-c272-w58r poetry.lock
LOW GHSA-mwh4-6h8g-pg8w aiohttp: GHSA-mwh4-6h8g-pg8w poetry.lock
LOW GHSA-mqqc-3gqh-h2x8 aiohttp: GHSA-mqqc-3gqh-h2x8 poetry.lock
LOW GHSA-hcc4-c3v8-rx92 aiohttp: GHSA-hcc4-c3v8-rx92 poetry.lock
LOW GHSA-fh55-r93g-j68g aiohttp: GHSA-fh55-r93g-j68g poetry.lock
LOW GHSA-966j-vmvw-g2g9 aiohttp: GHSA-966j-vmvw-g2g9 poetry.lock
LOW GHSA-69f9-5gxw-wvc2 aiohttp: GHSA-69f9-5gxw-wvc2 poetry.lock
LOW GHSA-63hf-3vf5-4wqf aiohttp: GHSA-63hf-3vf5-4wqf poetry.lock
LOW GHSA-54jq-c3m8-4m76 aiohttp: GHSA-54jq-c3m8-4m76 poetry.lock
LOW GHSA-3wq7-rqq7-wx6j aiohttp: GHSA-3wq7-rqq7-wx6j poetry.lock
LOW GHSA-2vrm-gr82-f7m5 aiohttp: GHSA-2vrm-gr82-f7m5 poetry.lock
LOW GHSA-jqfw-vq24-v9c3 vite: GHSA-jqfw-vq24-v9c3 app/frontend/pnpm-lock.yaml
LOW GHSA-g4jq-h2w9-997c vite: GHSA-g4jq-h2w9-997c app/frontend/pnpm-lock.yaml
LOW GHSA-v6h2-p8h4-qcjw brace-expansion: GHSA-v6h2-p8h4-qcjw app/frontend/pnpm-lock.yaml
LOW GHSA-jqfw-vq24-v9c3 vite: GHSA-jqfw-vq24-v9c3 app/frontend/package-lock.json
LOW GHSA-g4jq-h2w9-997c vite: GHSA-g4jq-h2w9-997c app/frontend/package-lock.json
LOW GHSA-v6h2-p8h4-qcjw brace-expansion: GHSA-v6h2-p8h4-qcjw app/frontend/package-lock.json
LOW AIC003 Duplicated implementation block across source files v2/event_study/__main__.py:9
LOW AIC003 Duplicated implementation block across source files src/main.py:23
LOW AIC003 Duplicated implementation block across source files src/cli/input.py:73
LOW AIC003 Duplicated implementation block across source files src/agents/stanley_druckenmiller.py:449
LOW AIC003 Duplicated implementation block across source files src/agents/stanley_druckenmiller.py:58
LOW AIC003 Duplicated implementation block across source files src/agents/stanley_druckenmiller.py:42
LOW AIC003 Duplicated implementation block across source files src/agents/sentiment.py:85
LOW AIC003 Duplicated implementation block across source files src/agents/rakesh_jhunjhunwala.py:532
LOW AIC003 Duplicated implementation block across source files src/agents/phil_fisher.py:459
LOW AIC003 Duplicated implementation block across source files src/agents/phil_fisher.py:56
LOW AIC003 Duplicated implementation block across source files app/frontend/src/services/backtest-api.…:24
LOW AIC003 Duplicated implementation block across source files app/frontend/src/nodes/components/stock…:5
LOW AIC003 Duplicated implementation block across source files app/frontend/src/nodes/components/json-…:61
LOW AIC003 Duplicated implementation block across source files app/frontend/src/nodes/components/json-…:94
LOW AIC003 Duplicated implementation block across source files app/frontend/src/hooks/use-flow-managem…:45
LOW AIC003 Duplicated implementation block across source files app/frontend/src/hooks/use-flow-managem…:14
LOW AIC003 Duplicated implementation block across source files app/frontend/src/hooks/use-flow-managem…:47
LOW AIC003 Duplicated implementation block across source files app/frontend/src/components/settings/mo…:683
LOW AIC003 Duplicated implementation block across source files app/frontend/src/components/panels/left…:100
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKR012 Dockerfile keeps pip download cache docker/Dockerfile:9
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:77
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:62
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:47
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:32
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:17
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:77
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:62
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:47
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:32
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:17
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:1
LOW CORE_NO_LICENSE No LICENSE file —
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… v2/data/protocol.py:12
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… v2/backtesting/strategy.py:29
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/utils/llm.py:122
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… src/utils/docker.py:36
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… docker/run.sh:113
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… docker/docker-compose.yml:28
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. app/frontend/src/nodes/components/inves…:79
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. app/frontend/src/hooks/use-output-node-…:28
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. app/frontend/src/hooks/use-enhanced-flo…:31
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. app/frontend/src/components/tabs/flow-t…:39
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. app/frontend/src/components/panels/bott…:221
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … app/frontend/src/utils/text-utils.ts:61
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … app/frontend/src/hooks/use-node-state.ts:46
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … app/frontend/src/components/panels/bott…:126
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… app/frontend/src/nodes/components/agent…:137
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… app/frontend/src/components/panels/bott…:45
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … app/frontend/src/components/panels/left…:56
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … app/frontend/src/components/panels/bott…:21
Reset to top 5 200 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `virattt/ai-hedge-fund`

**Score: 60/100 (D+)**  ·  315 findings  ·  scanned 2026-06-05 09:47 UTC  ·  37,487 LOC

| Severity | Count |
|---|---|
| CRITICAL | 3 |
| HIGH | 95 |
| MEDIUM | 107 |
| LOW | 75 |

📊 [Full filterable report](https://repobility.com/scan/969af918-800c-4c7e-85b0-b124b88cdd8c/)  ·  ![scorecard](https://repobility.com/scan/969af918-800c-4c7e-85b0-b124b88cdd8c/report.png?v=1780652838-s2)

### Top findings

1. **MEDIUM** `SEC087` — JS: weak Math.random for crypto
   `app/frontend/src/data/node-mappings.ts:18`
2. **MEDIUM** `SEC041` — Tabnabbing — target="_blank" without rel="noopener noreferrer"
   `app/frontend/src/components/settings/api-keys.tsx:187` · A05:2021 Security Misconfiguration
3. **MEDIUM** `SEC015` — Insecure Randomness for Security
   `app/backend/routes/api_keys.py:27` · A02:2021 Cryptographic Failures
4. **MEDIUM** `SEC015` — Insecure Randomness for Security
   `app/backend/repositories/api_key_repository.py:15` · A02:2021 Cryptographic Failures
5. **MEDIUM** `MINED111` — Bare except continues silently
   `src/utils/ollama.py:144` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/969af918-800c-4c7e-85b0-b124b88cdd8c/_
Megaproject â high spam risk
Could not determine 'virattt/ai-hedge-fund' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.