← Back to scan
File as GitHub Issue repo: jingyaogong/minimind

Push this scan report to jingyaogong/minimind

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Auth/permission check missing on AI-generated endpoint

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED019 [MINED019] Ssti Jinja From String: jinja2.Environment().from_string(user_input) — full RC… scripts/serve_openai_api.py:187
CRIT MINED107 Missing import: `queue` used but not imported scripts/serve_openai_api.py:133
CRIT GHSA-7p94-766c-hgjp nltk: GHSA-7p94-766c-hgjp requirements.txt
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… trainer/rollout_engine.py:202
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… scripts/serve_openai_api.py:171
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… scripts/serve_openai_api.py:98
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… scripts/eval_toolcall.py:76
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … trainer/train_full_sft.py:47
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … trainer/train_dpo.py:93
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … model/model_lora.py:52
HIGH MINED108 `self.forward` used but never assigned in __init__ model/model_minimind.py:265
HIGH MINED108 `self.freqs_sin` used but never assigned in __init__ model/model_minimind.py:219
HIGH MINED108 `self.freqs_cos` used but never assigned in __init__ model/model_minimind.py:219
HIGH MINED108 `self.freqs_sin` used but never assigned in __init__ model/model_minimind.py:218
HIGH MINED108 `self.freqs_cos` used but never assigned in __init__ model/model_minimind.py:218
HIGH MINED108 `self.freqs_cos` used but never assigned in __init__ model/model_minimind.py:216
HIGH MINED108 `self.training` used but never assigned in __init__ model/model_minimind.py:169
HIGH MINED108 `self.aux_loss` used but never assigned in __init__ model/model_minimind.py:175
HIGH MINED108 `self.aux_loss` used but never assigned in __init__ model/model_minimind.py:173
HIGH MINED108 `self.training` used but never assigned in __init__ model/model_minimind.py:171
HIGH MINED108 `self.training` used but never assigned in __init__ model/model_minimind.py:126
HIGH MINED108 `self.norm` used but never assigned in __init__ model/model_minimind.py:60
HIGH MINED108 `self.parse_conversations` used but never assigned in __init__ dataset/lm_dataset.py:251
HIGH MINED108 `self.create_chat_prompt` used but never assigned in __init__ dataset/lm_dataset.py:219
HIGH MINED108 `self.generate_loss_mask` used but never assigned in __init__ dataset/lm_dataset.py:159
HIGH MINED108 `self.generate_loss_mask` used but never assigned in __init__ dataset/lm_dataset.py:156
HIGH MINED108 `self.generate_labels` used but never assigned in __init__ dataset/lm_dataset.py:113
HIGH MINED108 `self.create_chat_prompt` used but never assigned in __init__ dataset/lm_dataset.py:109
HIGH MINED108 `self.model` used but never assigned in __init__ trainer/train_ppo.py:46
HIGH MINED108 `self.model` used but never assigned in __init__ trainer/train_ppo.py:45
HIGH GHSA-wpqr-jcpx-745r ujson: GHSA-wpqr-jcpx-745r requirements.txt
HIGH GHSA-c8rr-9gxc-jprv ujson: GHSA-c8rr-9gxc-jprv requirements.txt
HIGH GHSA-c38f-wx89-p2xg ujson: GHSA-c38f-wx89-p2xg requirements.txt
HIGH OSV-2021-955 ujson: OSV-2021-955 requirements.txt
HIGH OSV-2021-1809 ujson: OSV-2021-1809 requirements.txt
HIGH PYSEC-2025-217 transformers: PYSEC-2025-217 requirements.txt
HIGH GHSA-jm6w-m3j8-898g nltk: GHSA-jm6w-m3j8-898g requirements.txt
HIGH GHSA-469j-vmhf-r6v7 nltk: GHSA-469j-vmhf-r6v7 requirements.txt
HIGH PYSEC-2026-99 nltk: PYSEC-2026-99 requirements.txt
HIGH PYSEC-2026-98 nltk: PYSEC-2026-98 requirements.txt
HIGH PYSEC-2026-97 nltk: PYSEC-2026-97 requirements.txt
HIGH PYSEC-2024-167 nltk: PYSEC-2024-167 requirements.txt
HIGH PYSEC-2024-271 flask-cors: PYSEC-2024-271 requirements.txt
HIGH PYSEC-2024-260 flask-cors: PYSEC-2024-260 requirements.txt
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… scripts/eval_toolcall.py:129
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… eval_llm.py:91
HIGH MINED112 FastAPI POST /v1/chat/completions has no auth scripts/serve_openai_api.py:172
HIGH CORE_NO_TESTS No test files found —
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… scripts/serve_openai_api.py:98
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… scripts/eval_toolcall.py:76
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … scripts/eval_toolcall.py:30
MED SEC011 [SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execut… scripts/convert_model.py:21
MED SEC011 [SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execut… model/model_lora.py:36
MED SEC011 [SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execut… eval_llm.py:23
MED MINED111 Bare except continues silently scripts/eval_toolcall.py:111
MED MINED111 Bare except continues silently scripts/eval_toolcall.py:104
MED MINED111 Bare except continues silently scripts/serve_openai_api.py:167
MED MINED111 Bare except continues silently scripts/web_demo.py:158
MED MINED111 Bare except continues silently scripts/web_demo.py:145
MED MINED111 Bare except continues silently trainer/rollout_engine.py:188
MED MINED111 Bare except continues silently trainer/rollout_engine.py:204
MED MINED111 Bare except continues silently trainer/train_agent.py:227
MED MINED111 Bare except continues silently trainer/train_agent.py:141
MED MINED111 Bare except continues silently trainer/train_agent.py:91
MED COMP001 [COMP001] High cognitive complexity: Function `generate_loss_mask` has cognitive complexi… dataset/lm_dataset.py:176
MED COMP001 [COMP001] High cognitive complexity: Function `generate_labels` has cognitive complexity … dataset/lm_dataset.py:88
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DEPCUR-PY Python package `trl` is 1 major version(s) behind (0.13.0 -> 1.5.1) requirements.txt:24
MED DEPCUR-PY Python package `transformers` is 1 major version(s) behind (4.57.6 -> 5.10.2) requirements.txt:21
MED DEPCUR-PY Python package `sentence_transformers` is 3 major version(s) behind (2.3.1 -> 5.5.1) requirements.txt:18
MED DEPCUR-PY Python package `rich` is 2 major version(s) behind (13.7.1 -> 15.0.0) requirements.txt:16
MED DEPCUR-PY Python package `psutil` is 2 major version(s) behind (5.9.8 -> 7.2.2) requirements.txt:14
MED DEPCUR-PY Python package `openai` is 1 major version(s) behind (1.59.6 -> 2.41.0) requirements.txt:12
MED DEPCUR-PY Python package `marshmallow` is 1 major version(s) behind (3.22.0 -> 4.3.0) requirements.txt:7
MED DEPCUR-PY Python package `Flask_Cors` is 2 major version(s) behind (4.0.0 -> 6.0.2) requirements.txt:4
MED DEPCUR-PY Python package `datasets` is 1 major version(s) behind (3.6.0 -> 4.8.5) requirements.txt:1
MED GHSA-fm67-cv37-96ff ujson: GHSA-fm67-cv37-96ff requirements.txt
MED GHSA-fh56-85cw-5pq6 ujson: GHSA-fh56-85cw-5pq6 requirements.txt
MED GHSA-69w3-r845-3855 transformers: GHSA-69w3-r845-3855 requirements.txt
MED GHSA-7p48-42j8-8846 streamlit: GHSA-7p48-42j8-8846 requirements.txt
MED GHSA-rf74-v2fm-23pw nltk: GHSA-rf74-v2fm-23pw requirements.txt
MED GHSA-gfwx-w7gr-fvh7 nltk: GHSA-gfwx-w7gr-fvh7 requirements.txt
MED GHSA-428g-f7cq-pgp5 marshmallow: GHSA-428g-f7cq-pgp5 requirements.txt
MED GHSA-q2x7-8rv6-6q7h jinja2: GHSA-q2x7-8rv6-6q7h requirements.txt
MED GHSA-h75v-3vvj-5mfj jinja2: GHSA-h75v-3vvj-5mfj requirements.txt
MED GHSA-h5c8-rqwp-cp95 jinja2: GHSA-h5c8-rqwp-cp95 requirements.txt
MED GHSA-gmj6-6f8f-6699 jinja2: GHSA-gmj6-6f8f-6699 requirements.txt
MED GHSA-cpwx-vrp4-4pq7 jinja2: GHSA-cpwx-vrp4-4pq7 requirements.txt
MED GHSA-8vgw-p6qm-5gr7 flask-cors: GHSA-8vgw-p6qm-5gr7 requirements.txt
MED GHSA-7rxf-gvfg-47g4 flask-cors: GHSA-7rxf-gvfg-47g4 requirements.txt
MED GHSA-43qf-4rqw-9q2g flask-cors: GHSA-43qf-4rqw-9q2g requirements.txt
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED CORE_NO_CI No CI/CD configuration found —
LOW COMP001 [COMP001] High cognitive complexity: Function `create_chat_prompt` has cognitive complexi… dataset/lm_dataset.py:71
LOW DEPCUR-PY Python package `swanlab` is minor version(s) behind (0.7.11 -> 0.8.0) requirements.txt:29
LOW DEPCUR-PY Python package `streamlit` is minor version(s) behind (1.50.0 -> 1.58.0) requirements.txt:27
LOW DEPCUR-PY Python package `wandb` is minor version(s) behind (0.18.3 -> 0.27.1) requirements.txt:26
LOW DEPCUR-PY Python package `ujson` is minor version(s) behind (5.1.0 -> 5.12.1) requirements.txt:25
LOW DEPCUR-PY Python package `tiktoken` is minor version(s) behind (0.10.0 -> 0.13.0) requirements.txt:20
LOW DEPCUR-PY Python package `scikit_learn` is minor version(s) behind (1.5.1 -> 1.9.0) requirements.txt:17
LOW DEPCUR-PY Python package `pydantic` is minor version(s) behind (2.11.5 -> 2.13.4) requirements.txt:15
LOW DEPCUR-PY Python package `nltk` is minor version(s) behind (3.8 -> 3.9.4) requirements.txt:10
LOW DEPCUR-PY Python package `ngrok` is minor version(s) behind (1.4.0 -> 1.7.0) requirements.txt:9
LOW DEPCUR-PY Python package `Flask` is minor version(s) behind (3.0.3 -> 3.1.3) requirements.txt:3
LOW DEPCUR-PY Python package `datasketch` is minor version(s) behind (1.6.4 -> 1.10.0) requirements.txt:2
LOW GHSA-68rp-wp8r-4726 flask: GHSA-68rp-wp8r-4726 requirements.txt
LOW AIC003 Duplicated implementation block across source files trainer/train_pretrain.py:110
LOW AIC003 Duplicated implementation block across source files trainer/train_pretrain.py:90
LOW AIC003 Duplicated implementation block across source files trainer/train_pretrain.py:17
LOW AIC003 Duplicated implementation block across source files trainer/train_ppo.py:281
LOW AIC003 Duplicated implementation block across source files trainer/train_ppo.py:246
LOW AIC003 Duplicated implementation block across source files trainer/train_lora.py:21
LOW AIC003 Duplicated implementation block across source files trainer/train_grpo.py:152
LOW AIC003 Duplicated implementation block across source files trainer/train_full_sft.py:110
LOW AIC003 Duplicated implementation block across source files trainer/train_full_sft.py:91
LOW AIC003 Duplicated implementation block across source files trainer/train_dpo.py:149
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. scripts/eval_toolcall.py:226
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. scripts/chat_api.py:12
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. eval_llm.py:64
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. trainer/train_tokenizer.py:106
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. scripts/eval_toolcall.py:129
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. eval_llm.py:91
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… scripts/serve_openai_api.py:99
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… scripts/eval_toolcall.py:77
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… dataset/lm_dataset.py:256
INFO DEPCUR-PY Python package `modelscope` is patch version(s) behind (1.37.0 -> 1.37.1) requirements.txt:30
INFO DEPCUR-PY Python package `einops` is patch version(s) behind (0.8.1 -> 0.8.2) requirements.txt:28
INFO DEPCUR-PY Python package `jinja2` is patch version(s) behind (3.1.2 -> 3.1.6) requirements.txt:22
Reset to top 5 129 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `jingyaogong/minimind`

**Score: 67/100 (D)**  ·  129 findings  ·  scanned 2026-06-05 11:39 UTC  ·  4,631 LOC

| Severity | Count |
|---|---|
| CRITICAL | 3 |
| HIGH | 45 |
| MEDIUM | 45 |
| LOW | 24 |

📊 [Full filterable report](https://repobility.com/scan/998a2207-f825-44b2-b8a5-0ec507737cd5/)  ·  ![scorecard](https://repobility.com/scan/998a2207-f825-44b2-b8a5-0ec507737cd5/report.png?v=1780659582-s2)

### Top findings

1. **CRITICAL** `MINED019` — Ssti Jinja From String
   `scripts/serve_openai_api.py:187` · CWE-94 · ✓ Repobility
2. **CRITICAL** `MINED107` — Missing import: `queue` used but not imported
   `scripts/serve_openai_api.py:133` · ✓ Repobility
3. **CRITICAL** `GHSA-7p94-766c-hgjp` — nltk: GHSA-7p94-766c-hgjp
   `requirements.txt`
4. **HIGH** `SEC029` — Server-Side Request Forgery (SSRF) — outbound HTTP from user input
   `trainer/rollout_engine.py:202` · A10:2021 SSRF
5. **HIGH** `SEC135` — Auth/permission check missing on AI-generated endpoint
   `scripts/serve_openai_api.py:171` · CWE-862

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/998a2207-f825-44b2-b8a5-0ec507737cd5/_
Megaproject â high spam risk
Could not determine 'jingyaogong/minimind' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
55/137 findings (40%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.