Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

simplex-chat/simplex-chat

https://github.com/simplex-chat/simplex-chat · scanned 2026-07-23 19:45 UTC (3 months ago)

175 raw signals (0 security + 175 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v7 · 173 actionable findings from 1 signal source. 2 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
78.1
/100
Security checks
78
0 findings
System graph
78
90.0% cov · 173 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: layer: security × excluding tests × Reset all
Severity: Critical 0 High 11 Medium 79 Low 70 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 173 Crowd 0 Layer: Software 30 Frontend 17 Security 67 Network 5 Hardware 3 Cicd 4 Quality 24 Dependencies 23
Scan summary Repository scanned at 78.1/100 with 90.0% coverage. It contains 4064 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 175 findings — concentrated in security (67), software (30), quality (24). Risk profile is high: 0 critical, 11 high, 81 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 67 of 173 actionable findings. 175 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — Dockerfile
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-12 llvm-12-dev libnuma-dev libssl-dev' Rule: DS-0029 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — Dockerfile.build
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y curl libpq-dev git strip-nondeterminism sqlite3 libsqli…
Misconfig
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — packages/simplex-chat-python/src/simplex_chat/_native.py:102
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
packages/simplex-chat-python/src/simplex_chat/_native.py:102 SecurityPython
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in apps/multiplatform/common/src/commonMain/resources/assets/www/desktop/ui.js:89
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
apps/multiplatform/common/src/commonMain/resources/assets/www/desktop/ui.js:89 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/simplex-chat-webrtc/src/desktop/ui.ts:108
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
packages/simplex-chat-webrtc/src/desktop/ui.ts:108 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in website/.eleventy.js:136
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
website/.eleventy.js:136 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in website/src/js/docs.js:6
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
website/src/js/docs.js:6 Direct innerhtml assignment
medium System graph security security conf 0.85 Insecure pattern 'direct_innerhtml_assignment' in website/src/js/prism.min.js:3
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
website/src/js/prism.min.js:3 Direct innerhtml assignment
medium System graph security security conf 0.85 Insecure pattern 'direct_innerhtml_assignment' in website/src/js/swiper-bundle.min.js:13
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
website/src/js/swiper-bundle.min.js:13 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in website/src/js/demo.js:61
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
website/src/js/demo.js:61 Insert adjacent html
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in website/src/js/index.js:61
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
website/src/js/index.js:61 Insert adjacent html
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/contact_page.html:11
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/contact_page.html:11 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/footer.html:13
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/footer.html:13 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/hero.html:11
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/hero.html:11 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/layouts/article.html:44
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/layouts/article.html:44 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/layouts/doc.html:77
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/layouts/doc.html:77 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/layouts/jobs.html:32
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/layouts/jobs.html:32 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/layouts/main.html:43
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/layouts/main.html:43 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/layouts/privacy.html:39
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/layouts/privacy.html:39 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/layouts/token.html:222
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/layouts/token.html:222 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/navbar.html:17
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/navbar.html:17 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/file/protocol.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/file/protocol.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/hero/card_1.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/hero/card_1.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/hero/card_2.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/hero/card_2.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/hero/card_3.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/hero/card_3.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/simplex_network/card_1.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/simplex_network/card_1.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_privacy_matters/card_1.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_privacy_matters/card_1.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_privacy_matters/card_2.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_privacy_matters/card_2.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_privacy_matters/card_3.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_privacy_matters/card_3.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_simplex_is_unique/card_1.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_simplex_is_unique/card_1.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_simplex_is_unique/card_2.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_simplex_is_unique/card_2.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_simplex_is_unique/card_3.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_simplex_is_unique/card_3.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/overlay_content/why_simplex_is_unique/card_4.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/overlay_content/why_simplex_is_unique/card_4.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/sections/join_simplex.html:6
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/sections/join_simplex.html:6 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/sections/simplex_unique.html:3
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/sections/simplex_unique.html:3 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/sections/simplex_unique/card_1.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/sections/simplex_unique/card_1.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/sections/simplex_unique/card_2.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/sections/simplex_unique/card_2.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/sections/simplex_unique/card_3.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/sections/simplex_unique/card_3.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/sections/simplex_unique/card_4.html:2
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/sections/simplex_unique/card_4.html:2 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/_includes/simplex_explained.html:28
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/_includes/simplex_explained.html:28 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/blog.html:76
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/blog.html:76 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/fdroid.html:21
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/fdroid.html:21 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/file.html:187
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/file.html:187 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/index.html:100
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/index.html:100 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/links.html:236
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/links.html:236 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/messaging.html:21
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/messaging.html:21 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/old.html:14
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/old.html:14 SecurityFlask
medium System graph security Semgrep conf 0.55 template unescaped with safe — website/src/why.html:15
Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. Rule: python.flask.security.xss.audit.templa…
website/src/why.html:15 SecurityFlask
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/layouts/article.html:5
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/layouts/article.html:5 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/layouts/doc.html:6
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/layouts/doc.html:6 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/layouts/jobs.html:5
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/layouts/jobs.html:5 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/layouts/main.html:5
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/layouts/main.html:5 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/layouts/privacy.html:5
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/layouts/privacy.html:5 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/layouts/token.html:5
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/layouts/token.html:5 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/navbar.html:51
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/navbar.html:51 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/_includes/sections/join_simplex.html:20
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/_includes/sections/join_simplex.html:20 SecurityHtml templates
medium System graph security Semgrep conf 0.55 unquoted attribute var — website/src/index.html:12
Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}". Rule: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var Severi…
website/src/index.html:12 SecurityHtml templates
medium System graph security Semgrep conf 0.55 var in href — website/src/_includes/layouts/doc.html:54
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely…
website/src/_includes/layouts/doc.html:54 SecurityHtml templates
medium System graph security Semgrep conf 0.55 var in href — website/src/_includes/layouts/redirect.html:19
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely…
website/src/_includes/layouts/redirect.html:19 SecurityHtml templates
medium System graph security Semgrep conf 0.55 var in href — website/src/_includes/navbar.html:51
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely…
website/src/_includes/navbar.html:51 SecurityHtml templates
medium System graph security Semgrep conf 0.55 var in href — website/src/blog.html:76
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely…
website/src/blog.html:76 SecurityHtml templates
medium System graph security Semgrep conf 0.55 var in href — website/src/index.html:117
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely…
website/src/index.html:117 SecurityHtml templates
medium System graph security Semgrep conf 0.55 var in href — website/src/links.html:295
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely…
website/src/links.html:295 SecurityHtml templates
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.build
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.build
Misconfig
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/98c199aa-1a97-4398-868b-c6574c528b0c/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/98c199aa-1a97-4398-868b-c6574c528b0c/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.