Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
125 of your 321 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.05s · analysis 20.88s · 12.3 MB · GitHub API rate-limit (preflight)

hashgraph-online/hol-guard

https://github.com/hashgraph-online/hol-guard · scanned 2026-06-06 00:56 UTC (4 days ago) · 10 languages

680 raw signals (272 security + 408 graph) 27th percentile · Python · large (100-500K LoC) System graph score 74 (lower by 7)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days ago · v2 · 315 actionable findings from 2 signal sources. 136 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
65.3
/100
Security checks
57
128 findings
System graph
74
100.0% cov · 187 findings
Critical
10
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 18.3 0.25 4.58
testing_score 100.0 0.20 20.00
documentation_score 95.0 0.15 14.25
practices_score 96.0 0.15 14.40
code_quality 7.0 0.10 0.70
Overall 1.00 66.7
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 10 High 58 Medium 20 Low 161 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 128 System graph 187 Crowd 0 Layer: Security 23 Software 95 Cicd 7 Quality 150 Api 1 Frontend 36 Hardware 3
Scan summary Quality grade B- (67/100). Dimensions: security 18, maintainability 85. 272 findings (81 security). 267,572 lines analyzed.

Showing 207 of 315 actionable findings. 451 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection.
Review and fix per the pattern semantics. See CWE-89 / A03:2021 for context.
src/codex_plugin_scanner/guard/store_resume.py:159
critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection.
Review and fix per the pattern semantics. See CWE-89 / A03:2021 for context.
src/codex_plugin_scanner/guard/store_evidence.py:173
critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.
Review and fix per the pattern semantics. See CWE-95 / for context.
src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-catalog.js:31
critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.
Review and fix per the pattern semantics. See CWE-95 / for context.
dashboard/src/apps/app-catalog.ts:78
critical Security checks security secrets conf 0.95 8 occurrences Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks detected a committed secret or credential pattern.
4 files, 8 locations
tests/test_guard_runtime_actions.py:240, 431, 449 (3 hits)
tests/test_guard_headless_daemon_api.py:1684, 1706 (2 hits)
tests/test_guard_redaction.py:33, 205 (2 hits)
tests/fixtures/bad-plugin/secrets.js:1
critical Security checks security secrets conf 0.95 13 occurrences Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
Gitleaks detected a committed secret or credential pattern.
4 files, 13 locations
tests/test_guard_store_migrations.py:471, 670, 730, 796, 885, 944, 996 (7 hits)
tests/test_guard_surface_server.py:1006, 1089, 1198 (3 hits)
tests/test_guard_source_view_secret_fixtures.py:19, 51 (2 hits)
tests/test_guard_product_flow.py:356
high Security checks quality Quality conf 1.00 ✓ Repobility 12 occurrences Missing import: `signal` used but not imported
The file uses `signal.something(...)` but never imports `signal`. This raises NameError at runtime the first time the line executes.
12 files, 12 locations
src/codex_plugin_scanner/guard/cli/commands.py:5317
src/codex_plugin_scanner/guard/cli/install_commands.py:236
src/codex_plugin_scanner/guard/consumer/service.py:252
src/codex_plugin_scanner/guard/risk.py:241
src/codex_plugin_scanner/guard/runtime/cisco_preflight.py:215
src/codex_plugin_scanner/guard/runtime/composition_rules.py:76
src/codex_plugin_scanner/guard/runtime/data_flow_rules.py:606
src/codex_plugin_scanner/guard/runtime/decisions.py:154
critical Security checks security secrets conf 0.95 4 occurrences Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.
Gitleaks detected a committed secret or credential pattern.
2 files, 4 locations
tests/test_guard_data_flow.py:227, 231, 294 (3 hits)
tests/test_guard_runtime.py:18149
critical System graph security Secrets conf 1.00 Possible secret in src/codex_plugin_scanner/guard/cli/approval_gate_prompt.py
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
src/codex_plugin_scanner/guard/cli/approval_gate_prompt.py:25
low Security checks quality Quality conf 1.00 ✓ Repobility [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.
Review and fix per the pattern semantics. See CWE-705 / for context.
src/codex_plugin_scanner/integrations/cisco_skill_scanner.py:90
high Security checks security Injection conf 1.00 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.
Use parameterized queries: conn.execute('SELECT * FROM t WHERE id = ?', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.
src/codex_plugin_scanner/guard/store_evidence.py:173
high Security checks security path traversal conf 0.80 3 occurrences [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.
Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
3 files, 3 locations
src/codex_plugin_scanner/github_reporting.py:232
src/codex_plugin_scanner/guard/adapters/claude_daemon_hook_bridge.py:111
src/codex_plugin_scanner/guard/daemon/client.py:153
high Security checks software dependencies conf 0.90 ✓ Repobility Dockerfile FROM `codex_plugin_scanner.cli (no tag)` not pinned by digest
`FROM codex_plugin_scanner.cli (no tag)` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Dockerfile:35
high Security checks quality Quality conf 1.00 ✓ Repobility Phantom test coverage: test_one_input
Test function `test_one_input` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
fuzzers/manifest_fuzzer.py:9
high Security checks software dependencies conf 0.88 3 occurrences pyjwt: PYSEC-2026-175
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no docu…
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
high Security checks software dependencies conf 0.88 3 occurrences pyjwt: PYSEC-2026-177
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited out…
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
high Security checks software dependencies conf 0.88 3 occurrences pyjwt: PYSEC-2026-178
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b…
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
high Security checks software dependencies conf 0.88 3 occurrences pyjwt: PYSEC-2026-179
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secre…
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value
Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.
dashboard/src/approval-proof-modal.tsx:48
high Security checks software dependencies conf 0.88 3 occurrences starlette: PYSEC-2026-161
BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
high System graph security security conf 1.00 Insecure pattern 'eval_used' in dashboard/src/apps/app-catalog.ts:78
Found a known-risky pattern (eval_used). Review and replace if possible.
dashboard/src/apps/app-catalog.ts:78 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in src/codex_plugin_scanner/checks/code_quality.py:44
Found a known-risky pattern (eval_used). Review and replace if possible.
src/codex_plugin_scanner/checks/code_quality.py:44 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-catalog.js:31
Found a known-risky pattern (eval_used). Review and replace if possible.
src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-catalog.js:31 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in src/codex_plugin_scanner/guard/runtime/detectors.py:268
Found a known-risky pattern (eval_used). Review and replace if possible.
src/codex_plugin_scanner/guard/runtime/detectors.py:268 Eval used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in src/codex_plugin_scanner/guard/capabilities.py:40
Found a known-risky pattern (exec_used). Review and replace if possible.
src/codex_plugin_scanner/guard/capabilities.py:40 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in src/codex_plugin_scanner/guard/runtime/detectors.py:270
Found a known-risky pattern (exec_used). Review and replace if possible.
src/codex_plugin_scanner/guard/runtime/detectors.py:270 Exec used
medium Security checks security Security conf 1.00 [SEC119] World-writable / world-readable file permissions: World-writable files let any local user (or container neighbor) tamper with data; world-readable files leak secrets.
Use 0600 (owner rw only) for secrets, 0644 for general files, 0700 for directories with secrets. Java: `setReadable(true, true)` (owner-only).
src/codex_plugin_scanner/guard/totp.py:35
low Security checks quality Quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.
Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.
src/codex_plugin_scanner/guard/bridge/__init__.py:200
medium Security checks cicd CI/CD security conf 0.68 Agent auto-approve or skip-permissions mode is easy to enable
Codex/agent auto-approve, YOLO, or skip-permissions modes can be useful in isolated automation, but they remove the human checkpoint before command execution, network access, and file edits.
scripts/codex-auto-resume-smoke.py:122 CI/CD securityagent runtimepermissions
medium Security checks software dependencies conf 0.88 3 occurrences aiohttp: GHSA-hg6j-4rv6-33pg
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
medium Security checks software dependencies conf 0.88 3 occurrences aiohttp: GHSA-jg22-mg44-37j8
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
medium Security checks quality Quality Average file size is 503 lines (recommend <300)
Refactor large files by extracting related functions into separate modules. Target files with 300+ lines first. Use the Single Responsibility Principle — each module should have one clear purpose.
low Security checks quality Error handling conf 0.55 ✓ Repobility 20 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
7 files, 20 locations
src/codex_plugin_scanner/guard/store.py:378, 444, 487, 498, 659, 665, 671, 677, +2 more (10 hits)
src/codex_plugin_scanner/guard/desktop_notifications.py:124, 140, 202, 290 (4 hits)
src/codex_plugin_scanner/guard/provenance.py:90, 138 (2 hits)
src/codex_plugin_scanner/cli.py:526
src/codex_plugin_scanner/guard/access_graph_events.py:83
src/codex_plugin_scanner/guard/approvals.py:266
src/codex_plugin_scanner/verification.py:432
Error handlingquality
high Security checks security auth conf 0.82 3 occurrences Browser storage is used for session token material
localStorage and sessionStorage are readable by injected JavaScript. For sensitive sessions, this turns XSS into account compromise.
lines 169, 172, 177
dashboard/src/guard-api.ts:169, 172, 177 (3 hits)
high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER
Docker images run as root unless the image or Dockerfile switches to a non-root user.
.clusterfuzzlite/Dockerfile:1 CI/CD securitycontainers
medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore
COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts.
.clusterfuzzlite/Dockerfile:7 CI/CD securitycontainers
medium Security checks software dependencies conf 0.88 3 occurrences idna: GHSA-65pc-fj4g-8rjx
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
3 files, 3 locations
docker-requirements.txt
requirements.txt
uv.lock
high Security checks quality Quality conf 0.80 localStorage write failures are swallowed silently
localStorage quotas are small and writes can fail. Catching storage errors without a user-visible warning causes silent data loss when notes, images, or snapshots exceed quota.
dashboard/src/approval-center-layout.tsx:213
medium Security checks software dependencies conf 0.90 npm package `@vitejs/plugin-react` is 1 major version(s) behind (^5.0.4 -> 6.0.2)
`@vitejs/plugin-react` is pinned/resolved at ^5.0.4 but the latest stable release on the npm registry is 6.0.2 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rai…
dashboard/package.json
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — dashboard/src/guard-api.ts:237
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: __future__
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:17 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: codex_plugin_scanner.cli
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:35 containersPinned dependencies
medium System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
3 files, 3 locations
.github/workflows/dependabot-uv-lock.yml
.github/workflows/publish.yml
.github/workflows/scorecard.yml
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in dashboard/src/guard-api.ts:1252
Found a known-risky pattern (weak_hash). Review and replace if possible.
dashboard/src/guard-api.ts:1252 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in src/codex_plugin_scanner/guard/totp.py:17
Found a known-risky pattern (weak_hash). Review and replace if possible.
src/codex_plugin_scanner/guard/totp.py:17 Weak hash
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/codex-auto-resume-smoke.py:124
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — src/codex_plugin_scanner/guard/shims.py:648
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — src/codex_plugin_scanner/guard/store.py:283
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
.dockerignore exists but does not cover common secret or VCS patterns.
.dockerignore CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.72 Dockerfile keeps pip download cache
Pip's package cache increases image size and can preserve unnecessary artifacts.
Dockerfile:11 CI/CD securitycontainers
low Security checks quality Quality conf 0.60 21 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
12 files, 13 locations
src/codex_plugin_scanner/guard/runtime/signals.py:8, 200 (2 hits)
dashboard/src/evidence/category-tab.tsx:109
dashboard/src/history-charts.tsx:401
src/codex_plugin_scanner/ecosystems/codex.py:2
src/codex_plugin_scanner/ecosystems/gemini.py:2
src/codex_plugin_scanner/ecosystems/opencode.py:2
src/codex_plugin_scanner/guard/adapters/openclaw.py:58
src/codex_plugin_scanner/guard/adapters/openclaw_config.py:77
duplicationquality
low Security checks software dependencies conf 0.90 npm package `tsx` is minor version(s) behind (^4.8.1 -> 4.22.4)
`tsx` is pinned/resolved at ^4.8.1 but the latest stable release on the npm registry is 4.22.4 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
dashboard/package.json
low System graph frontend Frontend quality conf 1.00 "active" state uses light bg in a dark theme — dashboard/src/approval-center-layout.tsx:1776
A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead — border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '…'`. Why: P-E in CHEC…
Fq active light bg
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/e2e/fixture-states.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/playwright.config.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/src/evidence/evidence-types.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/src/guard-types.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/src/main.tsx
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/src/vite-env.d.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: dashboard/vite.config.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/codex_plugin_scanner/guard/runtime/package_intent.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/codex_plugin_scanner/guard/runtime/supply_chain_bundle.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/codex_plugin_scanner/trust_domain_scoring.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/codex_plugin_scanner/trust_specs.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/codex_plugin_scanner/version.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/conftest.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/bad-plugin/secrets.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/code-quality-bad/evil.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/code-quality-bad/inject.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/guard-red-team/benign-docs-fake-token.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/guard-red-team/canary-exfil-encoded.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/guard-red-team/malicious-npm-postinstall.js
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/fixtures/supply-chain/malicious-setup.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph quality Integrity conf 1.00 12 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: src/codex_plugin_scanner/reporting.py:build_json_payload, src/codex_plugin_scanner/reporting.py:format_json This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why…
12 occurrences
repo-level (12 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 3 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: src/codex_plugin_scanner/guard/store_approvals.py:resolve_approval_request, src/codex_plugin_scanner/guard/store_approvals.py:resolve_one_request_only, src/codex_plugin_scanner/guard/store_approvals.py:resolve_request_with_queue_result This is *the* …
3 occurrences
repo-level (3 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 3 occurrences Near-duplicate function bodies in 5 places
Functions with the same first-5-line body hash: src/codex_plugin_scanner/guard/store.py:set_secret, src/codex_plugin_scanner/guard/store.py:set_secret, src/codex_plugin_scanner/guard/store.py:set_secret, src/codex_plugin_scanner/guard/store.py:set_secret This is *the* AI-coder failure mode (4× mor…
3 occurrences
repo-level (3 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 6 places
Functions with the same first-5-line body hash: src/codex_plugin_scanner/guard/models.py:to_dict, src/codex_plugin_scanner/guard/models.py:to_dict, src/codex_plugin_scanner/guard/models.py:to_dict, src/codex_plugin_scanner/guard/models.py:to_dict This is *the* AI-coder failure mode (4× more duplic…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 8 places
Functions with the same first-5-line body hash: src/codex_plugin_scanner/guard/types.py:to_dict, src/codex_plugin_scanner/guard/types.py:to_dict, src/codex_plugin_scanner/guard/types.py:to_dict, src/codex_plugin_scanner/guard/types.py:to_dict This is *the* AI-coder failure mode (4× more duplicatio…
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_scanner_signal_v2` in tests/test_guard_package_hook.py:160
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `add_guard_event_v1` in src/codex_plugin_scanner/guard/access_graph_events.py:74
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `add_guard_event_v1` in src/codex_plugin_scanner/guard/harness_usage.py:70
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `announce_copy` in src/codex_plugin_scanner/guard/cli/connect_flow.py:941
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `announce_copy` in tests/test_guard_cli.py:6570
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `announce_copy` in tests/test_guard_oauth_device_connect.py:956
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `artifact_risk_signals_v2` in src/codex_plugin_scanner/guard/risk.py:244
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `artifact_risk_signals_v2` in tests/test_guard_risk.py:26
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `artifact_v1` in tests/test_guard_approval_decisions.py:312
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_decision_v2` in src/codex_plugin_scanner/guard/cli/commands.py:127
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_decision_v2` in src/codex_plugin_scanner/guard/consumer/service.py:20
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_decision_v2` in src/codex_plugin_scanner/guard/policy/__init__.py:3
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_decision_v2` in src/codex_plugin_scanner/guard/policy/engine.py:46
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_decision_v2` in src/codex_plugin_scanner/guard/proxy/runtime_mcp.py:28
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_provenance_copy` in src/codex_plugin_scanner/guard/provenance.py:359
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `build_provenance_copy` in tests/test_guard_provenance.py:359
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `call_v1` in tests/test_guard_action_identity.py:133
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `cisco_risk_signal_v3_to_v2` in src/codex_plugin_scanner/guard/runtime/cisco_preflight.py:54
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `count_guard_events_v1` in src/codex_plugin_scanner/guard/approvals.py:800
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `decide_action_with_v2` in tests/test_guard_runtime.py:44
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `decision_v2` in dashboard/src/guard-api.test.ts:394
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `decision_v2` in dashboard/src/phase09-review.test.ts:707
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `export_product_model_v1` in src/codex_plugin_scanner/guard/product_model.py:348
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `export_product_model_v1` in tests/test_guard_product_model_contracts.py:36
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `guard_event_v1` in src/codex_plugin_scanner/guard/edge_events.py:9
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `guard_event_v1` in src/codex_plugin_scanner/guard/store.py:31
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `guard_event_v1` in tests/test_guard_event_schema_v1.py:19
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `list_guard_events_v1` in tests/test_guard_cloud_local_sync.py:173
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `observed_copy` in src/codex_plugin_scanner/guard/cli/install_commands.py:107
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `observed_copy` in tests/test_guard_phase04_harness_contracts.py:114
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `remove_managed_copy` in src/codex_plugin_scanner/guard/adapters/cursor_hooks.py:194
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `repair_copy` in src/codex_plugin_scanner/guard/daemon/server.py:504
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `req_legacy` in tests/test_guard_approval_store_dedup.py:256
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `runtime_detector_signals_v2` in src/codex_plugin_scanner/guard/runtime/runner.py:497
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `runtime_detector_signals_v2` in tests/test_guard_runtime_detectors.py:534
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_coerce_permission_payload_with_dict_returns_copy` in tests/test_opencode_adapter.py:427
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_compact_removes_old` in tests/test_guard_evidence_store.py:280
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_evaluate_package_request_artifact_surfaces_yanked_safer_python_version_copy` in tests/test_guard_python_supply_chain_heuristics_phase12.py:515
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_gr097_hook_reason_deduplicates_duplicate_copy` in tests/test_guard_phase04_harness_ux.py:577
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_guard_daemon_dashboard_assets_use_oauth_connect_copy` in tests/test_guard_surface_server.py:142
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_guard_json_renderer_receives_payload_copy` in tests/test_guard_render.py:143
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_guard_reinstall_codex_preserves_original_backup` in tests/test_guard_codex_install.py:1579
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_guard_status_json_surfaces_first_sync_repair_over_generic_pending_copy` in tests/test_guard_product_flow.py:398
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_headless_app_operations_write_receipts_without_cli_copy` in tests/test_guard_headless_daemon_api.py:1130
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_migrate_guard_home_state_copies_guard_db_with_sqlite_backup` in tests/test_guard_config_paths.py:354
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_uninstall_cursor_hooks_restores_backup` in tests/test_cursor_hooks.py:155
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `tool_v1` in tests/test_guard_hashnet_mcp_canaries.py:158
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in src/codex_plugin_scanner/guard/cli/render.py:1627
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in src/codex_plugin_scanner/guard/local_supply_chain.py:547
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py:111
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in tests/test_guard_js_lockfile_resolution_phase11.py:82
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in tests/test_guard_js_supply_chain_phase11.py:233
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in tests/test_guard_local_supply_chain_phase15.py:628
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in tests/test_guard_python_lab_phase12.py:139
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in tests/test_guard_python_supply_chain_phase12.py:436
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `user_copy` in tests/test_guard_supply_chain_evaluator.py:345
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: add_operation_item
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/daemon/client.py:107
low System graph software Dead code conf 1.00 Possibly dead Python function: all_setup_contracts
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/adapters/contracts.py:358
low System graph software Dead code conf 1.00 Possibly dead Python function: audit_payload
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate.py:593
low System graph software Dead code conf 1.00 Possibly dead Python function: count_pending_requests
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/store.py:2746
low System graph software Dead code conf 1.00 Possibly dead Python function: default_state
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate_state.py:62
low System graph software Dead code conf 1.00 Possibly dead Python function: delete_request_resumes
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/store_resume.py:155
low System graph software Dead code conf 1.00 Possibly dead Python function: device_authorization_endpoint_from_connect_url
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/cli/connect_flow.py:543
low System graph software Dead code conf 1.00 Possibly dead Python function: do_GET
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/cli/connect_flow.py:276
low System graph software Dead code conf 1.00 Possibly dead Python function: load_json
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/checks/ecosystem_common.py:12
low System graph software Dead code conf 1.00 Possibly dead Python function: log_message
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/cli/connect_flow.py:318
low System graph software Dead code conf 1.00 Possibly dead Python function: mark_connect_result
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/store_connect.py:127
low System graph software Dead code conf 1.00 Possibly dead Python function: optional_bool
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate_state.py:134
low System graph software Dead code conf 1.00 Possibly dead Python function: prune_grants
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate_state.py:142
low System graph software Dead code conf 1.00 Possibly dead Python function: record_failed_attempt
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate_state.py:94
low System graph software Dead code conf 1.00 Possibly dead Python function: test_one_input
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fuzzers/manifest_fuzzer.py:9
low System graph software Dead code conf 1.00 Possibly dead Python function: update_settings
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate.py:158
low System graph software Dead code conf 1.00 Possibly dead Python function: upsert_supply_chain_bundle
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/store_supply_chain.py:66
low System graph software Dead code conf 1.00 Possibly dead Python function: upsert_supply_chain_evaluation
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/store_supply_chain.py:129
low System graph software Dead code conf 1.00 Possibly dead Python function: validate_settings_update
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate.py:176
low System graph software Dead code conf 1.00 Possibly dead Python function: verify_password
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/guard/approval_gate_state.py:77
low System graph software Dead code conf 1.00 Possibly dead Python function: weighted_score
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/codex_plugin_scanner/trust_helpers.py:33
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/app-detail-phase11.test.ts:56
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/approval-center-layout.test.ts:340
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/approval-gate.test.ts:250
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-copy.test.ts:86
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-detail.test.ts:106
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-export.test.ts:94
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-filters.test.ts:210
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-metrics.test.ts:106
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-pagination.test.ts:47
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-perf.test.ts:80
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-sort.test.ts:111
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-story.test.ts:110
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/evidence/evidence-url-state.test.ts:76
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/fleet-workspace-phase11.test.ts:64
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/fleet-workspace.test.ts:102
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/guard-api.test.ts:1223
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/phase09-review.test.ts:1282
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/risk-signal-cards.test.ts:158
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/security-fixes.test.ts:326
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — dashboard/src/settings-workspace-phase11.test.ts:87
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph quality Integrity conf 1.00 Stub function `log_message` (body is just `pass`/`return`) — src/codex_plugin_scanner/guard/cli/connect_flow.py:318
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `log_message` (body is just `pass`/`return`) — src/codex_plugin_scanner/guard/daemon/server.py:1307
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `runtime_probe` (body is just `pass`/`return`) — src/codex_plugin_scanner/guard/adapters/base.py:175
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Complexity conf 1.00 Very large file: dashboard/src/approval-center-layout.tsx (2110 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: dashboard/src/apps/app-detail-workspace.tsx (1929 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: dashboard/src/guard-api.ts (1899 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: dashboard/src/review-workspace.tsx (1513 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: dashboard/src/settings-workspace.tsx (1889 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/cli/commands.py (10064 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/cli/render.py (2360 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/daemon/server.py (4164 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-detail-workspace.js (1473 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/daemon/static/assets/chunks/home-dashboard.js (966 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/daemon/static/assets/chunks/settings-workspace.js (2838 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/daemon/static/assets/chunks/supply-chain-workspace.js (1193 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/local_supply_chain.py (1696 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/runtime/runner.py (3656 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/runtime/secret_file_requests.py (6430 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py (3563 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/codex_plugin_scanner/guard/store.py (4656 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_approval_gate.py (1429 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_approvals.py (2859 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_cli.py (8894 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_codex_install.py (1892 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_codex_proxy.py (1406 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_headless_daemon_api.py (1792 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_oauth_device_connect.py (1909 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_risk.py (4021 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_runtime.py (19041 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_supply_chain_evaluator.py (1918 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_guard_surface_server.py (2647 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/9defc105-15ae-4694-847f-5be73fe34511/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/9defc105-15ae-4694-847f-5be73fe34511/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.