File as GitHub Issue repo: infiniflow/ragflow

Push this scan report to `infiniflow/ragflow`

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Issue title

Mutable default argument in `reflect_async` (dict)

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)

Severity	Rule	Title	File:line
MED	`MINED109`	[MINED109] Mutable default argument in `assign_toc_levels` (dict): `def assign_toc_levels…	`rag/prompts/generator.py:784`
MED	`MINED109`	[MINED109] Mutable default argument in `gen_json` (dict): `def gen_json(... = []/{}/set()…	`rag/prompts/generator.py:543`
MED	`MINED109`	[MINED109] Mutable default argument in `rank_memories_async` (dict): `def rank_memories_a…	`rag/prompts/generator.py:485`
MED	`MINED109`	[MINED109] Mutable default argument in `tool_call_summary` (dict): `def tool_call_summary…	`rag/prompts/generator.py:474`
MED	`MINED109`	[MINED109] Mutable default argument in `reflect_async` (dict): `def reflect_async(... = […	`rag/prompts/generator.py:443`
MED	`MINED109`	[MINED109] Mutable default argument in `next_step_async` (dict): `def next_step_async(...…	`rag/prompts/generator.py:421`
MED	`MINED109`	[MINED109] Mutable default argument in `analyze_task_async` (dict): `def analyze_task_asy…	`rag/prompts/generator.py:402`
MED	`MINED109`	[MINED109] Mutable default argument in `cross_languages` (list): `def cross_languages(...…	`rag/prompts/generator.py:281`
MED	`MINED109`	[MINED109] Mutable default argument in `full_question` (list): `def full_question(... = […	`rag/prompts/generator.py:245`
MED	`MINED109`	[MINED109] Mutable default argument in `citation_prompt` (dict): `def citation_prompt(...…	`rag/prompts/generator.py:205`
MED	`MINED109`	[MINED109] Mutable default argument in `_merge` (dict): `def _merge(... = []/{}/set())` —…	`agent/component/string_transform.py:93`
MED	`MINED109`	[MINED109] Mutable default argument in `get_kwargs` (dict): `def get_kwargs(... = []/{}/s…	`agent/component/message.py:153`
MED	`MINED109`	[MINED109] Mutable default argument in `add_memory` (dict): `def add_memory(... = []/{}/s…	`agent/component/llm.py:472`
MED	`MINED109`	[MINED109] Mutable default argument in `stream_output_with_tools_async` (dict): `def stre…	`agent/component/agent_with_tools.py:263`
MED	`MINED109`	[MINED109] Mutable default argument in `gen_mindmap` (dict): `def gen_mindmap(... = []/{}…	`api/db/services/dialog_service.py:1656`
MED	`MINED109`	[MINED109] Mutable default argument in `async_ask` (dict): `def async_ask(... = []/{}/set…	`api/db/services/dialog_service.py:1540`
MED	`MINED109`	[MINED109] Mutable default argument in `get_task` (list): `def get_task(... = []/{}/set()…	`api/db/services/task_service.py:76`
MED	`MINED109`	[MINED109] Mutable default argument in `async_chat_streamly_delta` (dict): `def async_cha…	`api/db/services/llm_service.py:483`
MED	`MINED109`	[MINED109] Mutable default argument in `async_chat_streamly` (dict): `def async_chat_stre…	`api/db/services/llm_service.py:437`
MED	`MINED109`	[MINED109] Mutable default argument in `async_chat` (dict): `def async_chat(... = []/{}/s…	`api/db/services/llm_service.py:401`
MED	`MINED109`	[MINED109] Mutable default argument in `get_total_size_by_kb_id` (list): `def get_total_s…	`api/db/services/document_service.py:342`
MED	`MINED109`	[MINED109] Mutable default argument in `__send_devtools` (dict): `def __send_devtools(...…	`api/utils/web_utils.py:142`
MED	`MINED109`	[MINED109] Mutable default argument in `html2pdf` (dict): `def html2pdf(... = []/{}/set()…	`api/utils/web_utils.py:132`
MED	`MINED109`	[MINED109] Mutable default argument in `init_database_tables` (list): `def init_database_…	`api/db/db_models.py:674`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`api/validation.py:48`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/connection_utils.py:44`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/token_utils.py:34`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/settings.py:247`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/float_utils.py:46`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/log_utils.py:98`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/mcp_tool_call_conn.py:254`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/mcp_tool_call_conn.py:157`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/mcp_tool_call_conn.py:100`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/tag_feature_utils.py:40`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/tag_feature_utils.py:35`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/metadata_infinity_filter.py:272`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/crypto_utils.py:373`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/crypto_utils.py:347`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/constants.py:33`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/metadata_es_filter.py:488`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/metadata_es_filter.py:384`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/metadata_es_filter.py:455`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/metadata_es_filter.py:431`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/http_client.py:86`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`common/versions.py:49`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`agent/canvas.py:234`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`agent/canvas.py:223`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`run_tests.py:291`
MED	`MINED111`	[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r…	`run_tests.py:209`
MED	`SEC134`	[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum…	`web/src/stories/ragflow-avatar.stories.…:31`
MED	`SEC046`	[SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning win…	`web/src/services/user-service.ts:83`
MED	`ERR002`	[ERR002] Empty Catch Block: Empty catch blocks hide errors.	`web/src/pages/agent/hooks/use-download-…:18`
MED	`SEC041`	[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan…	`web/src/components/new-document-link.tsx:34`
MED	`SEC041`	[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan…	`web/src/components/markdown-content/ind…:95`
MED	`SEC041`	[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan…	`web/src/components/floating-chat-widget…:90`
MED	`SEC015`	[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. …	`sdk/python/ragflow_sdk/modules/chat.py:46`
MED	`SEC015`	[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. …	`sdk/python/ragflow_sdk/modules/agent.py:69`
MED	`SEC014`	[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma…	`rag/utils/minio_conn.py:38`
MED	`SEC045`	[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even …	`web/src/components/floating-chat-widget…:308`
MED	`SEC045`	[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even …	`internal/dao/time_record.go:55`
MED	`SEC045`	[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even …	`internal/cli/filesystem/skill_hub/secur…:236`
MED	`SEC031`	[SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like …	`deepdoc/parser/resume/entities/corporat…:59`
MED	`SEC091`	[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read…	`cmd/server_main.go:238`
MED	`SEC091`	[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read…	`cmd/admin_server.go:133`
MED	`SEC007`	[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.	`common/config_utils.py:34`
MED	`SEC007`	[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.	`api/utils/configs.py:40`
MED	`SEC127`	[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T…	`rag/flow/base.py:62`
MED	`SEC127`	[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T…	`common/doc_store/doc_store_base.py:243`
MED	`SEC127`	[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T…	`agent/plugin/llm_tool_plugin.py:29`
MED	`SEC136`	[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti…	`deepdoc/parser/utils.py:40`
MED	`SEC136`	[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti…	`api/utils/file_utils.py:129`
MED	`SEC136`	[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti…	`agent/component/switch.py:117`
MED	`ERR001`	[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even…	`agent/tools/searxng.py:60`
MED	`ERR001`	[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even…	`agent/component/string_transform.py:104`
MED	`ERR001`	[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even…	`agent/component/fillup.py:56`
MED	`SEC034`	[SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge…	`agent/sandbox/executor_manager/core/con…:42`
MED	`SEC034`	[SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge…	`agent/component/categorize.py:138`
MED	`SEC034`	[SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge…	`admin/server/auth.py:78`
MED	`COMP001`	[COMP001] High cognitive complexity: Function `load_user` has cognitive complexity 18 (So…	`admin/server/auth.py:41`
MED	`DKR003`	Compose service `sandbox-executor-manager` image uses the latest tag	`agent/sandbox/docker-compose.yml:1`
MED	`AUC001`	[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks…	—
MED	`MINED124`	[MINED124] requirements.txt: `requests` has no version pin: Unpinned pip requirement mean…	`tools/chatgpt-on-wechat/plugins/require…:1`
MED	`MINED124`	[MINED124] requirements.txt: `requests` has no version pin: Unpinned pip requirement mean…	`agent/sandbox/sandbox_base_image/python…:4`
MED	`MINED124`	[MINED124] requirements.txt: `matplotlib` has no version pin: Unpinned pip requirement me…	`agent/sandbox/sandbox_base_image/python…:3`
MED	`MINED124`	[MINED124] requirements.txt: `pandas` has no version pin: Unpinned pip requirement means …	`agent/sandbox/sandbox_base_image/python…:2`
MED	`MINED124`	[MINED124] requirements.txt: `numpy` has no version pin: Unpinned pip requirement means e…	`agent/sandbox/sandbox_base_image/python…:1`
MED	`MINED124`	[MINED124] requirements.txt: `slowapi` has no version pin: Unpinned pip requirement means…	`agent/sandbox/executor_manager/requirem…:3`
MED	`MINED124`	[MINED124] requirements.txt: `uvicorn` has no version pin: Unpinned pip requirement means…	`agent/sandbox/executor_manager/requirem…:2`
MED	`MINED124`	[MINED124] requirements.txt: `fastapi` has no version pin: Unpinned pip requirement means…	`agent/sandbox/executor_manager/requirem…:1`
MED	`DKR017`	Dockerfile installs dependencies after copying the full source tree	`agent/sandbox/executor_manager/Dockerfi…:38`
MED	`DKR007`	Docker build context has no .dockerignore	`.dockerignore`
MED	`JRN002`	Browser storage is used for session token material	`web/src/utils/authorization-util.ts:23`
MED	`JRN002`	Browser storage is used for session token material	`web/src/utils/authorization-util.ts:10`
MED	`DKR001`	Docker final stage has no non-root USER	`agent/sandbox/sandbox_base_image/python…:1`
MED	`DKR001`	Docker final stage has no non-root USER	`agent/sandbox/sandbox_base_image/nodejs…:1`
MED	`DKR001`	Docker final stage has no non-root USER	`agent/sandbox/executor_manager/Dockerfi…:1`
MED	`WEB003`	Public web service has no security.txt	`.well-known/security.txt`
MED	`AIC004`	Suspicious implementation file appears unreferenced	`internal/common/kg_query_rewrite.go:1`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/vite.config.ts:95`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/vite.config.ts:90`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/vite.config.ts:61`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/utils/llm-util.ts:93`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/utils/llm-util.ts:92`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/utils/llm-util.ts:91`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/utils/llm-util.ts:88`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/utils/llm-util.ts:87`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/utils/api.ts:2`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/pages/skills/hooks.ts:1540`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/pages/skills/hooks.ts:932`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/pages/skills/hooks.ts:623`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/pages/agent/hooks/use-send-shar…:62`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/interfaces/database/dataset.ts:2`
MED	`JRN003`	Frontend API reference is not matched by discovered backend routes	`web/src/components/next-markdown-conten…:49`
MED	`AUC002`	[AUC002] Low visible authorization coverage in route inventory: Only 30.3% of discovered …	—
MED	`AGT012`	Agent control bridge may listen on a network interface without visible auth	`docker/docker-compose.yml:3`
MED	`AGT012`	Agent control bridge may listen on a network interface without visible auth	`api/utils/health_utils.py:12`
MED	`AGT012`	Agent control bridge may listen on a network interface without visible auth	`api/ragflow_server.py:12`
MED	`WEB015`	Public web app has no Content Security Policy	`index.html`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:83`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:82`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:79`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:78`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:77`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:76`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/admin/router.go:59`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/service/chunk.go:415`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`internal/service/skill_space.go:516`
MED	`AUC009`	[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears …	`common/data_source/box_connector.py:188`
MED	`AGT008`	Ollama audio payload path may mislead users about direct model audio	`rag/llm/tts_model.py:365`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:63`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:62`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:56`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:54`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:47`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:45`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:44`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/router.go:38`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/handler.go:389`
MED	`AUC004`	[AUC004] Admin route does not show super_admin separation: An administrative route was de…	`internal/admin/handler.go:366`
LOW	`ERR003`	[ERR003] Ignored Error (Go): Ignoring error return values.	`internal/entity/models/paddleocr.go:164`
LOW	`ERR003`	[ERR003] Ignored Error (Go): Ignoring error return values.	`internal/entity/models/mineru_local.go:135`
LOW	`ERR003`	[ERR003] Ignored Error (Go): Ignoring error return values.	`internal/common/logger.go:150`
LOW	`SEC132`	[SEC132] String concat where the language has interpolation (AI style drift): String buil…	`internal/service/llm.go:352`
LOW	`SEC132`	[SEC132] String concat where the language has interpolation (AI style drift): String buil…	`agent/tools/qweather.py:74`
LOW	`SEC118`	[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC a…	`common/misc_utils.py:35`
LOW	`SEC118`	[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC a…	`api/db/init_data.py:54`
LOW	`SEC118`	[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC a…	`admin/server/auth.py:95`
LOW	`COMP001`	[COMP001] High cognitive complexity: Function `init_default_admin` has cognitive complexi…	`admin/server/auth.py:90`
LOW	`COMP001`	[COMP001] High cognitive complexity: Function `request` has cognitive complexity 11 (Sona…	`admin/client/http_client.py:73`
LOW	`AIC003`	Duplicated implementation block across source files	`internal/cpp/stemmer/stem_UTF_8_porter.…:134`
LOW	`AIC003`	Duplicated implementation block across source files	`internal/cpp/stemmer/stem_UTF_8_german.…:237`
LOW	`AIC003`	Duplicated implementation block across source files	`internal/cpp/re2/sparse_set.h:10`
LOW	`AIC003`	Duplicated implementation block across source files	`internal/cpp/pcre2posix.h:7`
LOW	`AIC003`	Duplicated implementation block across source files	`internal/cli/filesystem/skill_hub/sourc…:267`
LOW	`AIC003`	Duplicated implementation block across source files	`internal/cli/filesystem/file.go:230`
LOW	`AIC003`	Duplicated implementation block across source files	`deepdoc/parser/paddleocr_parser.py:380`
LOW	`AIC003`	Duplicated implementation block across source files	`deepdoc/parser/opendataloader_parser.py:176`
LOW	`AIC003`	Duplicated implementation block across source files	`common/metadata_infinity_filter.py:11`
LOW	`AIC003`	Duplicated implementation block across source files	`common/doc_store/ob_conn_base.py:547`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/webdav_connector.py:390`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/teams_connector.py:21`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/teams_connector.py:16`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/salesforce_connector…:18`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/salesforce_connector…:17`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/outlook_connector.py:7`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/outlook_connector.py:5`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/onedrive_connector.py:6`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/interfaces.py:238`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/interfaces.py:131`
LOW	`AIC003`	Duplicated implementation block across source files	`common/data_source/config.py:45`
LOW	`AIC003`	Duplicated implementation block across source files	`cmd/server_main.go:71`
LOW	`AIC003`	Duplicated implementation block across source files	`api/db/services/user_canvas_version.py:18`
LOW	`AIC003`	Duplicated implementation block across source files	`api/db/services/llm_service.py:276`
LOW	`AIC003`	Duplicated implementation block across source files	`api/db/joint_services/user_account_serv…:48`
LOW	`AIC003`	Duplicated implementation block across source files	`api/db/init_data.py:42`
LOW	`AIC003`	Duplicated implementation block across source files	`api/apps/services/provider_api_service.…:317`
LOW	`AIC003`	Duplicated implementation block across source files	`agent/tools/retrieval.py:118`
LOW	`AIC003`	Duplicated implementation block across source files	`agent/tools/__init__.py:1`
LOW	`WEB001`	Public web app has no robots.txt	`robots.txt`
LOW	`DKR010`	Dockerfile leaves apt package indexes in the image layer	`Dockerfile:99`
LOW	`DKR010`	Dockerfile leaves apt package indexes in the image layer	`Dockerfile:89`
LOW	`DKR010`	Dockerfile leaves apt package indexes in the image layer	`Dockerfile:34`
LOW	`WEB002`	Public web app has no sitemap	`sitemap.xml`
LOW	`DKR012`	Dockerfile keeps pip download cache	`agent/sandbox/sandbox_base_image/python…:13`
LOW	`DKR012`	Dockerfile keeps pip download cache	`agent/sandbox/executor_manager/Dockerfi…:38`
LOW	`DKR011`	Dockerfile installs recommended OS packages	`agent/sandbox/executor_manager/Dockerfi…:5`
LOW	`DKR012`	Dockerfile keeps pip download cache	`Dockerfile.scratch.oc9:50`
LOW	`DKR012`	Dockerfile keeps pip download cache	`Dockerfile.scratch.oc9:44`
LOW	`DKR012`	Dockerfile keeps pip download cache	`Dockerfile.scratch.oc9:43`
LOW	`DKR011`	Dockerfile installs recommended OS packages	`Dockerfile:99`
LOW	`DKR011`	Dockerfile installs recommended OS packages	`Dockerfile:89`
LOW	`AIC009`	Multiple AI-agent scaffold marker files are present	`.github/copilot-instructions.md:1`
LOW	`WEB008`	Public docs site has no llms.txt	`llms.txt`
LOW	`DKC010`	Compose service lacks no-new-privileges hardening	`docker/docker-compose.yml:55`
LOW	`DKC010`	Compose service lacks no-new-privileges hardening	`docker/docker-compose.yml:4`
LOW	`AIC002`	Source file name looks like an AI patch artifact	`internal/common/kg_query_rewrite.go:1`
LOW	`DKC006`	Compose service does not declare a runtime user	`docker/docker-compose.yml:55`
LOW	`DKC006`	Compose service does not declare a runtime user	`docker/docker-compose.yml:4`
LOW	`DKC006`	Compose service does not declare a runtime user	`agent/sandbox/docker-compose.yml:1`
LOW	`WEB011`	Public web app has no humans.txt	`humans.txt`

Reset to top 5 200 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `infiniflow/ragflow`

**Score: 76/100 (A-)**  ·  398 findings  ·  scanned 2026-06-05 07:21 UTC  ·  689,216 LOC

| Severity | Count |
|---|---|
| CRITICAL | 22 |
| HIGH | 102 |
| MEDIUM | 139 |
| LOW | 61 |

📊 [Full filterable report](https://repobility.com/scan/9df3fddb-fa15-4c0f-9022-a4923625a9d6/)  ·  ![scorecard](https://repobility.com/scan/9df3fddb-fa15-4c0f-9022-a4923625a9d6/report.png?v=1780644107-s2)

### Top findings

1. **MEDIUM** `MINED109` — Mutable default argument in `assign_toc_levels` (dict)
   `rag/prompts/generator.py:784` · ✓ Repobility
2. **MEDIUM** `MINED109` — Mutable default argument in `gen_json` (dict)
   `rag/prompts/generator.py:543` · ✓ Repobility
3. **MEDIUM** `MINED109` — Mutable default argument in `rank_memories_async` (dict)
   `rag/prompts/generator.py:485` · ✓ Repobility
4. **MEDIUM** `MINED109` — Mutable default argument in `tool_call_summary` (dict)
   `rag/prompts/generator.py:474` · ✓ Repobility
5. **MEDIUM** `MINED109` — Mutable default argument in `reflect_async` (dict)
   `rag/prompts/generator.py:443` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/9df3fddb-fa15-4c0f-9022-a4923625a9d6/_

Already filed

This repo publishes a SECURITY.md policy and the scan contains 37 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.

Megaproject â high spam risk

Could not determine 'infiniflow/ragflow' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.

I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.

Push this scan report to infiniflow/ragflow

Embedded score card image

Issue title

Curate findings to include

Issue body (markdown)

Push this scan report to `infiniflow/ragflow`