← Back to scan
File as GitHub Issue repo: odoo/odoo

Push this scan report to odoo/odoo

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Missing import: `stat` used but not imported

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 [MINED107] Missing import: `string` used but not imported: The file uses `string.somethin… odoo/addons/base/models/assetsbundle.py:398
CRIT MINED107 [MINED107] Missing import: `queue` used but not imported: The file uses `queue.something(… odoo/addons/base/models/ir_ui_view.py:1026
CRIT MINED107 [MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.some… odoo/addons/base/models/ir_fields.py:668
CRIT MINED107 [MINED107] Missing import: `platform` used but not imported: The file uses `platform.some… odoo/addons/base/models/res_device.py:74
CRIT MINED107 [MINED107] Missing import: `stat` used but not imported: The file uses `stat.something(..… odoo/addons/base/models/ir_attachment.py:931
CRIT MINED107 [MINED107] Missing import: `operator` used but not imported: The file uses `operator.some… odoo/addons/base/models/res_partner.py:177
CRIT MINED107 [MINED107] Missing import: `queue` used but not imported: The file uses `queue.something(… odoo/addons/base/models/ir_autovacuum.py:45
CRIT MINED107 [MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.some… odoo/addons/base/models/ir_actions.py:765
CRIT MINED107 [MINED107] Missing import: `datetime` used but not imported: The file uses `datetime.some… odoo/addons/base/models/ir_actions.py:518
CRIT MINED107 [MINED107] Missing import: `html` used but not imported: The file uses `html.something(..… odoo/addons/base/models/ir_module.py:179
CRIT MINED107 [MINED107] Missing import: `html` used but not imported: The file uses `html.something(..… odoo/_monkeypatches/lxml.py:29
CRIT MINED107 [MINED107] Missing import: `string` used but not imported: The file uses `string.somethin… odoo/_monkeypatches/werkzeug.py:431
CRIT MINED107 [MINED107] Missing import: `operator` used but not imported: The file uses `operator.some… odoo/orm/fields_properties.py:744
CRIT MINED107 [MINED107] Missing import: `operator` used but not imported: The file uses `operator.some… odoo/orm/fields.py:1317
CRIT MINED107 [MINED107] Missing import: `operator` used but not imported: The file uses `operator.some… odoo/orm/models.py:1456
CRIT MINED107 [MINED107] Missing import: `queue` used but not imported: The file uses `queue.something(… odoo/orm/registry.py:358
CRIT MINED107 [MINED107] Missing import: `locale` used but not imported: The file uses `locale.somethin… odoo/tools/date_utils.py:447
CRIT MINED107 [MINED107] Missing import: `stat` used but not imported: The file uses `stat.something(..… odoo/tools/cache.py:285
CRIT MINED107 [MINED107] Missing import: `locale` used but not imported: The file uses `locale.somethin… odoo/tools/i18n.py:67
CRIT MINED107 [MINED107] Missing import: `string` used but not imported: The file uses `string.somethin… odoo/tools/misc.py:1964
CRIT MINED107 [MINED107] Missing import: `locale` used but not imported: The file uses `locale.somethin… odoo/tools/misc.py:643
CRIT MINED107 [MINED107] Missing import: `stat` used but not imported: The file uses `stat.something(..… odoo/http.py:543
CRIT MINED007 [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection. addons/event_product/models/event_type_…:89
CRIT MINED007 [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection. addons/event_booth_sale/models/event_bo…:122
HIGH MINED106 [MINED106] Phantom test coverage: test_python_expr: Test function `test_python_expr` runs… odoo/tools/safe_eval.py:422
HIGH MINED108 [MINED108] `self.postrollback` used but never assigned in __init__: Method `commit` of cl… odoo/sql_db.py:567
HIGH MINED108 [MINED108] `self.prerollback` used but never assigned in __init__: Method `commit` of cla… odoo/sql_db.py:566
HIGH MINED108 [MINED108] `self._now` used but never assigned in __init__: Method `commit` of class `Cur… odoo/sql_db.py:565
HIGH MINED108 [MINED108] `self.cache` used but never assigned in __init__: Method `_close` of class `Cu… odoo/sql_db.py:534
HIGH MINED108 [MINED108] `self.connection` used but never assigned in __init__: Method `_format` of cla… odoo/sql_db.py:411
HIGH MINED108 [MINED108] `self._cr` used but never assigned in __init__: Method `_close` of class `_Flu… odoo/sql_db.py:146
HIGH MINED108 [MINED108] `self._cr` used but never assigned in __init__: Method `_close` of class `_Flu… odoo/sql_db.py:143
HIGH MINED108 [MINED108] `self._cr` used but never assigned in __init__: Method `rollback` of class `_F… odoo/sql_db.py:139
HIGH MINED108 [MINED108] `self._cr` used but never assigned in __init__: Method `rollback` of class `_F… odoo/sql_db.py:138
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build_image` of class… setup/package.py:431
HIGH MINED108 [MINED108] `self.docker_dir` used but never assigned in __init__: Method `build_image` of… setup/package.py:431
HIGH MINED108 [MINED108] `self.tag` used but never assigned in __init__: Method `build_image` of class … setup/package.py:432
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:417
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `start_test` of class … setup/package.py:362
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:358
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:357
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `start_test` of class … setup/package.py:334
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `start_test` of class … setup/package.py:325
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:321
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `start_test` of class … setup/package.py:304
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `start_test` of class … setup/package.py:290
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:286
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:285
HIGH MINED108 [MINED108] `self.args` used but never assigned in __init__: Method `build` of class `Dock… setup/package.py:284
HIGH MINED106 [MINED106] Phantom test coverage: test_odoo: Test function `test_odoo` runs code but cont… setup/package.py:252
HIGH MINED108 [MINED108] `self._release` used but never assigned in __init__: Method `get_version` of c… setup/requirements-check.py:230
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… addons/html_editor/static/src/others/qw…:29
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… addons/html_editor/static/src/others/em…:30
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… addons/html_editor/static/src/main/font…:199
HIGH MINED027 [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — Re… addons/html_editor/static/src/main/chat…:47
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… addons/google_calendar/utils/google_eve…:199
HIGH SEC004 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection. addons/event_product/models/event_type_…:89
HIGH SEC004 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection. addons/event_booth_sale/models/event_bo…:122
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… addons/cloud_storage_google/models/res_…:68
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… addons/cloud_storage_azure/utils/cleanu…:55
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… addons/cloud_storage_azure/models/res_c…:73
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… addons/html_editor/static/src/main/yout…:25
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… addons/html_builder/static/src/core/ope…:40
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… addons/base_import/static/src/binary_fi…:34
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… addons/barcodes_gs1_nomenclature/static…:10
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… addons/barcodes_gs1_nomenclature/static…:27
HIGH SEC027 [SEC027] XML External Entity (XXE) — Node.js xml parsers: Node.js XML parsers can expand … addons/html_builder/static/src/plugins/…:71
HIGH SEC027 [SEC027] XML External Entity (XXE) — Node.js xml parsers: Node.js XML parsers can expand … addons/html_builder/static/image_shapes…:52
HIGH SEC027 [SEC027] XML External Entity (XXE) — Node.js xml parsers: Node.js XML parsers can expand … addons/auth_totp_portal/static/src/inte…:142
HIGH SEC043 [SEC043] Secret stored in Odoo ir.config_parameter — broadly readable: ir.config_paramete… addons/auth_password_policy/models/res_…:13
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). addons/auth_totp/models/totp.py:15
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). addons/auth_passkey/_vendor/webauthn/he…:38
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). addons/auth_passkey/_vendor/webauthn/he…:10
HIGH SEC030 [SEC030] Open Redirect — user-controlled redirect target: Redirect target is taken direct… addons/auth_signup/controllers/main.py:33
HIGH SEC030 [SEC030] Open Redirect — user-controlled redirect target: Redirect target is taken direct… addons/auth_oauth/controllers/main.py:93
HIGH SEC044 [SEC044] CSRF disabled on destructive HTTP endpoint: An auth='user' endpoint with csrf=Fa… addons/account_peppol/controllers/webho…:7
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … addons/base_geolocalize/models/base_geo…:95
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … addons/api_doc/static/src/utils/doc_cod…:82
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … addons/account_edi_proxy_client/models/…:111
HIGH MINED031 [MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React … addons/account/static/src/components/ta…:70
HIGH MINED031 [MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React … addons/account/static/src/components/pr…:54
HIGH MINED031 [MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React … addons/account/static/src/components/ac…:51
HIGH MINED009 [MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of D… addons/account/models/account_reconcile…:71
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… addons/attachment_indexation/models/ir_…:81
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… addons/account/models/account_analytic_…:54
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… addons/account/models/account_analytic_…:67
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … addons/account/static/src/components/ac…:16
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … addons/account/models/ir_actions_report…:70
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … addons/account/controllers/portal.py:94
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… addons/google_recaptcha/models/ir_http.…:111
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… addons/account_peppol/controllers/authe…:24
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… addons/html_editor/static/src/others/dy…:24
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… addons/html_builder/static/src/core/bui…:45
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… addons/crm_livechat/static/src/core/thr…:35
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… addons/iot_drivers/iot_handlers/drivers…:101
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/addons/base/models/ir_model.py:2268
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/addons/base/models/ir_model.py:2564
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/addons/base/models/ir_actions.py:351
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/cli/start.py:58
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/orm/registry.py:667
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/orm/registry.py:725
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/tools/barcode.py:33
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/tools/misc.py:1560
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/tools/misc.py:1505
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… odoo/tools/misc.py:943
MED MINED109 [MINED109] Mutable default argument in `_babel_extract_terms` (dict): `def _babel_extract… odoo/tools/translate.py:1436
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … addons/im_livechat/static/src/embed/com…:54
MED SEC046 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win… addons/calendar/static/src/components/c…:57
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … addons/html_editor/static/src/main/yout…:25
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … addons/html_builder/static/src/core/ope…:40
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … addons/base_import/static/src/binary_fi…:34
MED SEC127 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T… addons/barcodes/models/barcode_events_m…:25
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … addons/auth_passkey/models/auth_passkey…:164
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… addons/attachment_indexation/models/ir_…:81
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… addons/iap_mail/static/src/js/services/…:28
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… addons/html_builder/static/src/core/bui…:45
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… addons/api_doc/static/src/components/do…:35
MED COMP001 [COMP001] High cognitive complexity: Function `portal_my_journal_unsubscribe` has cogniti… addons/account/controllers/portal.py:188
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED MINED124 [MINED124] requirements.txt: `import ansitoimg` has no version pin: Unpinned pip requirem… setup/requirements-check.py:37
MED MINED124 [MINED124] requirements.txt: `try:` has no version pin: Unpinned pip requirement means ev… setup/requirements-check.py:36
MED MINED124 [MINED124] requirements.txt: `import tempfile` has no version pin: Unpinned pip requireme… setup/requirements-check.py:34
MED MINED124 [MINED124] requirements.txt: `import shutil` has no version pin: Unpinned pip requirement… setup/requirements-check.py:33
MED MINED124 [MINED124] requirements.txt: `import re` has no version pin: Unpinned pip requirement mea… setup/requirements-check.py:32
MED MINED124 [MINED124] requirements.txt: `import os` has no version pin: Unpinned pip requirement mea… setup/requirements-check.py:31
MED MINED124 [MINED124] requirements.txt: `import json` has no version pin: Unpinned pip requirement m… setup/requirements-check.py:30
MED MINED124 [MINED124] requirements.txt: `import itertools` has no version pin: Unpinned pip requirem… setup/requirements-check.py:29
MED MINED124 [MINED124] requirements.txt: `import gzip` has no version pin: Unpinned pip requirement m… setup/requirements-check.py:28
MED MINED124 [MINED124] requirements.txt: `import argparse` has no version pin: Unpinned pip requireme… setup/requirements-check.py:27
MED MINED124 [MINED124] requirements.txt: `"""` has no version pin: Unpinned pip requirement means eve… setup/requirements-check.py:25
MED MINED124 [MINED124] requirements.txt: `...` has no version pin: Unpinned pip requirement means eve… setup/requirements-check.py:23
MED MINED124 [MINED124] requirements.txt: `TODO:` has no version pin: Unpinned pip requirement means e… setup/requirements-check.py:16
MED MINED124 [MINED124] requirements.txt: `This script was heavily reworked but is not in a final vers… setup/requirements-check.py:15
MED MINED124 [MINED124] requirements.txt: `requirements necessating showing the row)` has no version p… setup/requirements-check.py:13
MED MINED124 [MINED124] requirements.txt: `checking multiple releases: one of the other releases may m… setup/requirements-check.py:12
MED MINED124 [MINED124] requirements.txt: `* empty or green cells mean that specific release matches i… setup/requirements-check.py:11
MED MINED124 [MINED124] requirements.txt: `matching requirements version` has no version pin: Unpinned… setup/requirements-check.py:10
MED MINED124 [MINED124] requirements.txt: `* only shows requirements for which at least one release di… setup/requirements-check.py:9
MED MINED124 [MINED124] requirements.txt: `requirements.` has no version pin: Unpinned pip requirement… setup/requirements-check.py:7
MED MINED124 [MINED124] requirements.txt: `against a release which bundles Python 3.5, checks the 3.5 … setup/requirements-check.py:6
MED MINED124 [MINED124] requirements.txt: `versions, taking distribution's Python version in account e… setup/requirements-check.py:5
MED MINED124 [MINED124] requirements.txt: `Checks versions from the requirements files against distrib… setup/requirements-check.py:4
MED MINED124 [MINED124] requirements.txt: `"""` has no version pin: Unpinned pip requirement means eve… setup/requirements-check.py:3
MED MINED124 [MINED124] requirements.txt: `pytz # no version pinning to avoid OS perturbations` has n… requirements.txt:79
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED CORE_NO_CI No CI/CD configuration found —
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… addons/html_builder/static/src/utils/op…:69
LOW SEC047 [SEC047] Unbounded ORM search([]) in a request handler: An unbounded .search([]) call ins… addons/account_edi/models/account_journ…:48
LOW SEC047 [SEC047] Unbounded ORM search([]) in a request handler: An unbounded .search([]) call ins… addons/account_edi/models/account_edi_f…:37
LOW SEC047 [SEC047] Unbounded ORM search([]) in a request handler: An unbounded .search([]) call ins… addons/account/__init__.py:10
LOW COMP001 [COMP001] High cognitive complexity: Function `portal_my_invoice_detail` has cognitive co… addons/account/controllers/portal.py:154
LOW COMP001 [COMP001] High cognitive complexity: Function `download_invoice_documents_filetype` has c… addons/account/controllers/download_doc…:51
INFO MINED098 [MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global win… addons/im_livechat/static/src/core/comm…:17
INFO MINED073 [MINED073] Redos Greedy Quantifier: Pattern with nested quantifiers like (a+)+ applied to… addons/html_editor/models/ir_websocket.…:17
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. addons/google_calendar/utils/google_cal…:22
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. addons/auth_signup/models/res_partner.py:12
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. addons/auth_passkey/_vendor/webauthn/he…:1
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. addons/auth_passkey/_vendor/webauthn/re…:28
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. addons/auth_passkey/_vendor/webauthn/au…:28
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… addons/base_iban/models/res_partner_ban…:27
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… addons/base_geolocalize/models/base_geo…:94
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… addons/auth_oauth/controllers/main.py:76
INFO MINED088 [MINED088] React Conditional Hook: useState/useEffect inside if/loop violates Rules of Ho… addons/html_editor/static/src/main/medi…:22
INFO MINED088 [MINED088] React Conditional Hook: useState/useEffect inside if/loop violates Rules of Ho… addons/html_builder/static/src/core/bui…:75
INFO MINED088 [MINED088] React Conditional Hook: useState/useEffect inside if/loop violates Rules of Ho… addons/api_doc/static/src/utils/doc_ui_…:9
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… addons/base_geolocalize/models/base_geo…:95
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… addons/auth_oauth/models/res_users.py:49
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… addons/account_edi_proxy_client/models/…:111
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … addons/api_doc/static/src/doc_model_sto…:77
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … addons/api_doc/static/src/components/do…:156
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … addons/account/static/src/views/upload_…:18
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… addons/account/models/ir_actions_report…:37
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… addons/account/models/account_analytic_…:55
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… addons/account/models/account_analytic_…:68
Reset to top 5 174 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `odoo/odoo`

**Score: 75/100 (B)**  ·  203 findings  ·  scanned 2026-07-27 15:03 UTC  ·  1,140,314 LOC

| Severity | Count |
|---|---|
| CRITICAL | 24 |
| HIGH | 70 |
| MEDIUM | 52 |
| LOW | 6 |

📊 [Full filterable report](https://repobility.com/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/)  ·  ![scorecard](https://repobility.com/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/report.png?v=1785164608-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `string` used but not imported
   `odoo/addons/base/models/assetsbundle.py:398` · ✓ Repobility
2. **CRITICAL** `MINED107` — Missing import: `queue` used but not imported
   `odoo/addons/base/models/ir_ui_view.py:1026` · ✓ Repobility
3. **CRITICAL** `MINED107` — Missing import: `warnings` used but not imported
   `odoo/addons/base/models/ir_fields.py:668` · ✓ Repobility
4. **CRITICAL** `MINED107` — Missing import: `platform` used but not imported
   `odoo/addons/base/models/res_device.py:74` · ✓ Repobility
5. **CRITICAL** `MINED107` — Missing import: `stat` used but not imported
   `odoo/addons/base/models/ir_attachment.py:931` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/_
Already filed
Repobility already filed issue #264868 on this repo on 2026-05-17. Filing again would be duplicate spam.
View existing issue
Already filed
This repo publishes a SECURITY.md policy and the scan contains 32 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'odoo/odoo' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Filing guard overridden Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.