bashaarZ/visualize-qatar

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

1 of your 8 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

https://github.com/bashaarZ/visualize-qatar.git · scanned 2026-05-18 14:47 UTC (2 weeks, 4 days ago) · 10 languages

44 findings (8 legacy + 36 scanner) 30th percentile · Python · tiny (<2K LoC) Scanner says 81 (lower by 28)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 weeks, 4 days ago · v4 · 17 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	100.0	0.25	25.00
`testing_score`	0.0	0.20	0.00
`documentation_score`	40.0	0.15	6.00
`practices_score`	40.0	0.15	6.00
`code_quality`	70.0	0.10	7.00
Overall		1.00	53.0

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 0 Medium 4 Low 5 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 8 9-layer 9 Crowd 0 Layer: Quality 10 Software 3 Api 1 Frontend 1 Security 1 Cicd 1

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 81.1/100 with 88.9% coverage. It contains 12 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 9 findings — concentrated in quality (4), software (1), api (1). Risk profile is low: 0 critical, 0 high, 4 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 9 of 17 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — qatar_analysis.py:98

`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer security coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

coverageauth

medium 9-layer cicd coverage conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

coverage

medium 9-layer quality tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 3 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

testscoverage

low Legacy software race_condition conf 1.00 [SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason.

Use `os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)` for atomic create-only. Use `tempfile.NamedTemporaryFile()` (not `mktemp`). For locking, use `fcntl.flock`.

qatar_analysis.py:133 race_conditionlegacy

low Legacy quality documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

documentationlegacy

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: qatar_analysis.py

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer quality integrity conf 1.00 Legacy-named symbol `qat_pop_2026_CN_100m_R2025A_v1` in qatar_analysis.py:130

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low Legacy quality quality conf 1.00 ✓ Repobility [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.

Review and fix per the pattern semantics. See CWE-400 / for context.

qatar_analysis.py:98 qualitylegacy

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/a1096069-e6b4-4028-b5eb-e5a3a3371da0/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/a1096069-e6b4-4028-b5eb-e5a3a3371da0/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.