Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

HKUDS/DeepTutor

https://github.com/HKUDS/DeepTutor · scanned 2026-07-23 19:42 UTC (1 month, 2 weeks ago)

415 raw signals (0 security + 415 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v8 · 414 actionable findings from 1 signal source. 1 repeated signal grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
60.4
/100
Security checks
60
0 findings
System graph
60
100.0% cov · 414 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 197 Medium 68 Low 77 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 414 Crowd 0 Layer: Software 16 Frontend 76 Security 216 Network 1 Hardware 5 Cicd 4 Quality 50 Dependencies 46
Scan summary Repository scanned at 60.4/100 with 100.0% coverage. It contains 14507 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 415 findings — concentrated in security (216), frontend (76), quality (50). Risk profile is high: 0 critical, 197 high, 69 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 341 of 414 actionable findings. 415 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def start` — deeptutor/partners/channels/feishu.py:379
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
deeptutor/partners/channels/feishu.py:379 Sync io in asyncPerformance
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 1.1.14 — web/package-lock.json
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.1.1 — web/package-lock.json
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-44573: next 16.2.3 — web/package-lock.json
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44574: next 16.2.3 — web/package-lock.json
Next.js: Next.js: Authorization bypass via crafted query parameters Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected…
VulnCve 2026 44574
high System graph security Trivy conf 1.00 CVE-2026-44575: next 16.2.3 — web/package-lock.json
next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauth…
VulnCve 2026 44575
high System graph security Trivy conf 1.00 CVE-2026-44578: next 16.2.3 — web/package-lock.json
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-44579: next 16.2.3 — web/package-lock.json
next.js: Next.js: Denial of Service via crafted POST requests to server actions Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection ex…
VulnCve 2026 44579
high System graph security Trivy conf 1.00 CVE-2026-45109: next 16.2.3 — web/package-lock.json
next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Tur…
VulnCve 2026 45109
high System graph security Trivy conf 1.00 CVE-2026-64641: next 16.2.3 — web/package-lock.json
Next.js: Denial of Service in App Router using Server Actions ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exis…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64642: next 16.2.3 — web/package-lock.json
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale ## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication. ## Wor…
VulnCve 2026 64642
high System graph security Trivy conf 1.00 CVE-2026-64645: next 16.2.3 — web/package-lock.json
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffi…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64649: next 16.2.3 — web/package-lock.json
Next.js: Server-Side Request Forgery in Server Actions on custom servers ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to contro…
VulnCve 2026 64649
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security auth conf 0.75 FastAPI DELETE `clear_snapshot_changes` without auth dependency — deeptutor/api/routers/memory.py:779
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/memory.py:779 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `clear_trace_day` without auth dependency — deeptutor/api/routers/memory.py:708
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/memory.py:708 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `clear_trace` without auth dependency — deeptutor/api/routers/memory.py:695
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/memory.py:695 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_book` without auth dependency — deeptutor/api/routers/book.py:189
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/book.py:189 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_category` without auth dependency — deeptutor/api/routers/question_notebook.py:329
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/question_notebook.py:329 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_connection` without auth dependency — deeptutor/api/routers/subagents.py:193
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/subagents.py:193 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_document` without auth dependency — deeptutor/api/routers/co_writer.py:604
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/co_writer.py:604 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_entry` without auth dependency — deeptutor/api/routers/memory.py:159
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/memory.py:159 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_entry` without auth dependency — deeptutor/api/routers/question_notebook.py:269
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/question_notebook.py:269 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_kb_file` without auth dependency — deeptutor/api/routers/knowledge.py:2009
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/knowledge.py:2009 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_knowledge_base` without auth dependency — deeptutor/api/routers/knowledge.py:2033
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/knowledge.py:2033 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_notebook` without auth dependency — deeptutor/api/routers/notebook.py:244
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/notebook.py:244 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_partner_asset` without auth dependency — deeptutor/api/routers/partners.py:708
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/partners.py:708 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_persona` without auth dependency — deeptutor/api/routers/personas.py:129
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/personas.py:129 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_progress` without auth dependency — deeptutor/api/routers/mastery_path.py:183
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/mastery_path.py:183 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_session` without auth dependency — deeptutor/api/routers/chat.py:47
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/chat.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_session` without auth dependency — deeptutor/api/routers/sessions.py:153
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/sessions.py:153 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_skill` without auth dependency — deeptutor/api/routers/skills.py:294
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/skills.py:294 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_soul` without auth dependency — deeptutor/api/routers/partners.py:358
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/partners.py:358 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_tag` without auth dependency — deeptutor/api/routers/skills.py:109
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/skills.py:109 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `delete_turn_by_message` without auth dependency — deeptutor/api/routers/sessions.py:180
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/sessions.py:180 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `destroy_partner` without auth dependency — deeptutor/api/routers/partners.py:639
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/partners.py:639 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `remove_entry_from_category` without auth dependency — deeptutor/api/routers/question_notebook.py:293
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/question_notebook.py:293 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `remove_record` without auth dependency — deeptutor/api/routers/notebook.py:309
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/notebook.py:309 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI DELETE `unlink_folder` without auth dependency — deeptutor/api/routers/knowledge.py:2717
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
deeptutor/api/routers/knowledge.py:2717 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PATCH `rename_category` without auth dependency — deeptutor/api/routers/question_notebook.py:320
`@router.patch` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachabl…
deeptutor/api/routers/question_notebook.py:320 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PATCH `rename_session` without auth dependency — deeptutor/api/routers/sessions.py:143
`@router.patch` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachabl…
deeptutor/api/routers/sessions.py:143 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PATCH `update_entry` without auth dependency — deeptutor/api/routers/question_notebook.py:257
`@router.patch` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachabl…
deeptutor/api/routers/question_notebook.py:257 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PATCH `update_partner` without auth dependency — deeptutor/api/routers/partners.py:587
`@router.patch` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachabl…
deeptutor/api/routers/partners.py:587 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `add_entry_to_category` without auth dependency — deeptutor/api/routers/question_notebook.py:281
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/question_notebook.py:281 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `add_partner_assets` without auth dependency — deeptutor/api/routers/partners.py:694
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:694 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `add_record_with_summary` without auth dependency — deeptutor/api/routers/notebook.py:299
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/notebook.py:299 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `add_record` without auth dependency — deeptutor/api/routers/notebook.py:266
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/notebook.py:266 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `apply_catalog` without auth dependency — deeptutor/api/routers/settings.py:963
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:963 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `apply_doc_ops` without auth dependency — deeptutor/api/routers/memory.py:649
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:649 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `archive_partner_session` without auth dependency — deeptutor/api/routers/partners.py:749
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:749 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `audit_doc` without auth dependency — deeptutor/api/routers/memory.py:544
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:544 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `auto_mark_text` without auth dependency — deeptutor/api/routers/co_writer.py:427
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/co_writer.py:427 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `branch_partner_session` without auth dependency — deeptutor/api/routers/partners.py:782
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:782 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `cancel_document_parsing_job` without auth dependency — deeptutor/api/routers/settings.py:818
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:818 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `cancel_mineru_models_download` without auth dependency — deeptutor/api/routers/settings.py:870
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:870 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `cancel_run` without auth dependency — deeptutor/api/routers/memory.py:363
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:363 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `cancel_service_test` without auth dependency — deeptutor/api/routers/settings.py:1151
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1151 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `change_block_type` without auth dependency — deeptutor/api/routers/book.py:361
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:361 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `clear_progress` without auth dependency — deeptutor/api/routers/knowledge.py:2511
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2511 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `compile_page` without auth dependency — deeptutor/api/routers/book.py:271
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:271 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `complete_tour` without auth dependency — deeptutor/api/routers/settings.py:1180
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1180 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `confirm_proposal` without auth dependency — deeptutor/api/routers/book.py:224
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:224 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `confirm_spine` without auth dependency — deeptutor/api/routers/book.py:247
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:247 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `connect_lightrag_server_route` without auth dependency — deeptutor/api/routers/knowledge.py:1610
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1610 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `connect_linked_folder_route` without auth dependency — deeptutor/api/routers/knowledge.py:1531
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1531 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `connect_obsidian_vault` without auth dependency — deeptutor/api/routers/knowledge.py:1474
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1474 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_book` without auth dependency — deeptutor/api/routers/book.py:198
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:198 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_category` without auth dependency — deeptutor/api/routers/question_notebook.py:311
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/question_notebook.py:311 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_connection` without auth dependency — deeptutor/api/routers/subagents.py:132
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/subagents.py:132 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_document` without auth dependency — deeptutor/api/routers/co_writer.py:558
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/co_writer.py:558 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_kb_folder` without auth dependency — deeptutor/api/routers/knowledge.py:1923
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1923 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_knowledge_base` without auth dependency — deeptutor/api/routers/knowledge.py:2140
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2140 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_notebook` without auth dependency — deeptutor/api/routers/notebook.py:170
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/notebook.py:170 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_partner` without auth dependency — deeptutor/api/routers/partners.py:445
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:445 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_persona` without auth dependency — deeptutor/api/routers/personas.py:91
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/personas.py:91 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_skill` without auth dependency — deeptutor/api/routers/skills.py:214
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/skills.py:214 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_soul` without auth dependency — deeptutor/api/routers/partners.py:330
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:330 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `create_tag` without auth dependency — deeptutor/api/routers/skills.py:83
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/skills.py:83 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `dedup_doc` without auth dependency — deeptutor/api/routers/memory.py:559
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:559 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `deep_dive` without auth dependency — deeptutor/api/routers/book.py:381
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:381 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `delete_block` without auth dependency — deeptutor/api/routers/book.py:338
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:338 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `delete_partner_session` without auth dependency — deeptutor/api/routers/partners.py:771
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:771 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `edit_text_react_stream` without auth dependency — deeptutor/api/routers/co_writer.py:414
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/co_writer.py:414 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `edit_text_react` without auth dependency — deeptutor/api/routers/co_writer.py:403
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/co_writer.py:403 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `edit_text` without auth dependency — deeptutor/api/routers/co_writer.py:379
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/co_writer.py:379 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `execute_capability_stream` without auth dependency — deeptutor/api/routers/plugins_api.py:422
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/plugins_api.py:422 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `execute_tool_stream` without auth dependency — deeptutor/api/routers/plugins_api.py:281
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/plugins_api.py:281 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `execute_tool` without auth dependency — deeptutor/api/routers/plugins_api.py:114
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/plugins_api.py:114 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `fetch_models_from_provider` without auth dependency — deeptutor/api/routers/settings.py:976
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:976 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `generate_from_notebook` without auth dependency — deeptutor/api/routers/mastery_path.py:231
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/mastery_path.py:231 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `import_chat_history` without auth dependency — deeptutor/api/routers/imports.py:74
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/imports.py:74 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `import_from_book` without auth dependency — deeptutor/api/routers/mastery_path.py:149
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/mastery_path.py:149 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `init_modules` without auth dependency — deeptutor/api/routers/mastery_path.py:134
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/mastery_path.py:134 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `insert_block` without auth dependency — deeptutor/api/routers/book.py:317
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:317 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `install_skill` without auth dependency — deeptutor/api/routers/skills.py:233
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/skills.py:233 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `link_folder` without auth dependency — deeptutor/api/routers/knowledge.py:2671
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2671 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `message_connection` without auth dependency — deeptutor/api/routers/subagents.py:216
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/subagents.py:216 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `move_block` without auth dependency — deeptutor/api/routers/book.py:347
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:347 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `move_kb_file` without auth dependency — deeptutor/api/routers/knowledge.py:1937
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1937 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `partner_chat_http_stream` without auth dependency — deeptutor/api/routers/partners.py:981
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:981 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `partner_chat_http` without auth dependency — deeptutor/api/routers/partners.py:890
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:890 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `probe_lightrag_server_route` without auth dependency — deeptutor/api/routers/knowledge.py:1594
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1594 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `probe_linked_folder_route` without auth dependency — deeptutor/api/routers/knowledge.py:1512
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1512 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `quiz_attempt` without auth dependency — deeptutor/api/routers/book.py:401
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:401 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `rebuild_book` without auth dependency — deeptutor/api/routers/book.py:462
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:462 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `record_quiz_results` without auth dependency — deeptutor/api/routers/sessions.py:199
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/sessions.py:199 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `redo_progress` without auth dependency — deeptutor/api/routers/mastery_path.py:193
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/mastery_path.py:193 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `refresh_fingerprints` without auth dependency — deeptutor/api/routers/book.py:423
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:423 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `refresh_snapshot` without auth dependency — deeptutor/api/routers/memory.py:750
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:750 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `regenerate_block` without auth dependency — deeptutor/api/routers/book.py:285
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:285 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `reindex_knowledge_base` without auth dependency — deeptutor/api/routers/knowledge.py:2379
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2379 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `reload_partner_channels` without auth dependency — deeptutor/api/routers/partners.py:647
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:647 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `reopen_tour` without auth dependency — deeptutor/api/routers/settings.py:1212
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1212 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `reset_doc` without auth dependency — deeptutor/api/routers/memory.py:169
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:169 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `reset_settings` without auth dependency — deeptutor/api/routers/settings.py:1065
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1065 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `resume_partner_session` without auth dependency — deeptutor/api/routers/partners.py:759
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:759 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `retry_knowledge_base` without auth dependency — deeptutor/api/routers/knowledge.py:2465
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2465 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `set_page_chat_session` without auth dependency — deeptutor/api/routers/book.py:449
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:449 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `speech_to_text` without auth dependency — deeptutor/api/routers/voice.py:104
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/voice.py:104 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `start_document_parsing_install` without auth dependency — deeptutor/api/routers/settings.py:760
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:760 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `start_document_parsing_model_download` without auth dependency — deeptutor/api/routers/settings.py:780
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:780 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `start_mineru_models_download` without auth dependency — deeptutor/api/routers/settings.py:826
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:826 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `start_partner` without auth dependency — deeptutor/api/routers/partners.py:621
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:621 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `start_run` without auth dependency — deeptutor/api/routers/memory.py:308
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:308 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `start_service_test` without auth dependency — deeptutor/api/routers/settings.py:1119
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1119 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `stop_partner` without auth dependency — deeptutor/api/routers/partners.py:631
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:631 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `supplement` without auth dependency — deeptutor/api/routers/book.py:432
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/book.py:432 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `sync_backend` without auth dependency — deeptutor/api/routers/subagents.py:79
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/subagents.py:79 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `sync_configs_from_metadata` without auth dependency — deeptutor/api/routers/knowledge.py:1424
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1424 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `sync_folder` without auth dependency — deeptutor/api/routers/knowledge.py:2735
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2735 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `test_document_parsing` without auth dependency — deeptutor/api/routers/settings.py:733
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:733 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `test_embeddings_connection` without auth dependency — deeptutor/api/routers/system.py:216
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/system.py:216 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `test_llm_connection` without auth dependency — deeptutor/api/routers/system.py:148
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/system.py:148 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `test_mineru_connection` without auth dependency — deeptutor/api/routers/settings.py:878
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:878 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `test_search_connection` without auth dependency — deeptutor/api/routers/system.py:273
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/system.py:273 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `text_to_speech` without auth dependency — deeptutor/api/routers/voice.py:78
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/voice.py:78 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `undo_run_edit` without auth dependency — deeptutor/api/routers/memory.py:373
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:373 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `update_doc` without auth dependency — deeptutor/api/routers/memory.py:529
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:529 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `upload_files` without auth dependency — deeptutor/api/routers/knowledge.py:2061
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:2061 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `upsert_single_entry` without auth dependency — deeptutor/api/routers/question_notebook.py:182
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/question_notebook.py:182 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `put_capabilities_settings` without auth dependency — deeptutor/api/routers/capabilities_settings.py:34
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/capabilities_settings.py:34 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `put_doc` without auth dependency — deeptutor/api/routers/memory.py:151
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:151 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `put_memory_settings` without auth dependency — deeptutor/api/routers/memory.py:622
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/memory.py:622 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `put_partner_soul` without auth dependency — deeptutor/api/routers/partners.py:674
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:674 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `rename_tag` without auth dependency — deeptutor/api/routers/skills.py:95
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/skills.py:95 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `set_default_kb` without auth dependency — deeptutor/api/routers/knowledge.py:1450
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1450 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `set_rag_active_model` without auth dependency — deeptutor/api/routers/knowledge.py:1293
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1293 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `set_rag_provider_mode` without auth dependency — deeptutor/api/routers/knowledge.py:1007
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1007 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_branch_selection` without auth dependency — deeptutor/api/routers/sessions.py:166
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/sessions.py:166 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_catalog` without auth dependency — deeptutor/api/routers/settings.py:955
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:955 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_chat_attachment_settings` without auth dependency — deeptutor/api/routers/settings.py:579
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:579 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_chat_response_timeout` without auth dependency — deeptutor/api/routers/settings.py:1036
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1036 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_document_parsing_settings` without auth dependency — deeptutor/api/routers/settings.py:712
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:712 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_document` without auth dependency — deeptutor/api/routers/co_writer.py:586
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/co_writer.py:586 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_enabled_tools` without auth dependency — deeptutor/api/routers/settings.py:1110
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1110 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_graphrag_pipeline_config` without auth dependency — deeptutor/api/routers/knowledge.py:1160
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1160 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_kb_config` without auth dependency — deeptutor/api/routers/knowledge.py:1374
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1374 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_language` without auth dependency — deeptutor/api/routers/settings.py:1015
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1015 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_lightrag_pipeline_config` without auth dependency — deeptutor/api/routers/knowledge.py:1194
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1194 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_llamaindex_pipeline_config` without auth dependency — deeptutor/api/routers/knowledge.py:1120
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1120 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_mineru_settings` without auth dependency — deeptutor/api/routers/settings.py:678
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:678 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_network_settings` without auth dependency — deeptutor/api/routers/settings.py:523
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:523 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_notebook` without auth dependency — deeptutor/api/routers/notebook.py:215
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/notebook.py:215 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_pageindex_pipeline_config` without auth dependency — deeptutor/api/routers/knowledge.py:1062
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/knowledge.py:1062 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_persona` without auth dependency — deeptutor/api/routers/personas.py:110
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/personas.py:110 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_record` without auth dependency — deeptutor/api/routers/notebook.py:332
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/notebook.py:332 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_sidebar_description` without auth dependency — deeptutor/api/routers/settings.py:1094
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1094 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_sidebar_nav_order` without auth dependency — deeptutor/api/routers/settings.py:1102
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1102 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_skill` without auth dependency — deeptutor/api/routers/skills.py:270
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/skills.py:270 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_soul` without auth dependency — deeptutor/api/routers/partners.py:350
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/partners.py:350 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_theme` without auth dependency — deeptutor/api/routers/settings.py:1007
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1007 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_ui_settings` without auth dependency — deeptutor/api/routers/settings.py:1050
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1050 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI PUT `update_voice_autoplay` without auth dependency — deeptutor/api/routers/settings.py:1023
`@router.put` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
deeptutor/api/routers/settings.py:1023 securityAuth fastapi unauth mutation
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 16.2.3 — web/package-lock.json
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — web/package-lock.json
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in deeptutor/services/sandbox/runner/server.py:215
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
deeptutor/services/sandbox/runner/server.py:215 Subprocess shell true
high System graph security security conf 1.00 Insecure pattern 'tls_verify_false' in deeptutor/core/agentic/client.py:67
Found a known-risky pattern (tls_verify_false). Review and replace if possible.
deeptutor/core/agentic/client.py:67 Tls verify false
high System graph security security conf 1.00 Insecure pattern 'tls_verify_false' in deeptutor/services/llm/openai_http_client.py:42
Found a known-risky pattern (tls_verify_false). Review and replace if possible.
deeptutor/services/llm/openai_http_client.py:42 Tls verify false
high System graph security security conf 1.00 Insecure pattern 'tls_verify_false' in deeptutor/services/llm/provider_core/openai_codex_provider.py:86
Found a known-risky pattern (tls_verify_false). Review and replace if possible.
deeptutor/services/llm/provider_core/openai_codex_provider.py:86 Tls verify false
high System graph security security conf 1.00 Insecure pattern 'tls_verify_false' in deeptutor/services/llm/providers/open_ai.py:65
Found a known-risky pattern (tls_verify_false). Review and replace if possible.
deeptutor/services/llm/providers/open_ai.py:65 Tls verify false
high System graph security Semgrep conf 0.70 subprocess shell true — deeptutor/services/sandbox/runner/server.py:217
Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. Rule: py…
deeptutor/services/sandbox/runner/server.py:217 SecurityPython
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.14: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `1.1.14` (resolved in `web/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via expo…
web/package-lock.json ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.1.0: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `2.1.0` (resolved in `web/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via expon…
web/package-lock.json ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-267c-6grr-h53f
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-267c-6grr-h53f (aka CVE-2026-44575). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes Aliases: CVE-2026-44575 Advisory: https://osv.dev/vulnerability/…
web/package.json ScaOsvGhsa 267c 6grr h53f
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-26hh-7cqf-hhc6
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-26hh-7cqf-hhc6 (aka CVE-2026-45109). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up Aliases: CVE-2026-45109 Advisory: htt…
web/package.json ScaOsvGhsa 26hh 7cqf hhc6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-…
web/package.json ScaOsvGhsa 36qx fr4f 26g5
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-492v-c6pp-mqqv
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-492v-c6pp-mqqv (aka CVE-2026-44574). Next.js has a Middleware / Proxy bypass through dynamic route parameter injection Aliases: CVE-2026-44574 Advisory: https://osv.dev/vulnerability/GHSA-492v-c6p…
web/package.json ScaOsvGhsa 492v c6pp mqqv
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-6gpp-xcg3-4w24
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-6gpp-xcg3-4w24 (aka CVE-2026-64642). Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale Aliases: CVE-2026-64642 Advisory: https://osv.dev/vulnerability…
web/package.json ScaOsvGhsa 6gpp xcg3 4w24
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x Fi…
web/package.json ScaOsvGhsa 89xv 2m56 2m9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the advis…
web/package.json ScaOsvGhsa 8h8q 6873 q5fj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-c4j6-fc7j-m34r
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-c4j6-fc7j-m34r (aka CVE-2026-44578). Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades Aliases: CVE-2026-44578 Advisory: https://osv.dev/vulnerability/GHSA…
web/package.json ScaOsvGhsa c4j6 fc7j m34r
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-m99w-x7hq-7vfj
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-m99w-x7hq-7vfj (aka CVE-2026-64641). Next.js: Denial of Service in App Router using Server Actions Aliases: CVE-2026-64641 Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade …
web/package.json ScaOsvGhsa m99w x7hq 7vfj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-mg66-mrh9-m8jx
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-mg66-mrh9-m8jx (aka CVE-2026-44579). Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components Aliases: CVE-2026-44579 Advisory: https://osv.dev/vuln…
web/package.json ScaOsvGhsa mg66 mrh9 m8jx
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-p9j2-gv94-2wf4
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-p9j2-gv94-2wf4 (aka CVE-2026-64645). Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname Aliases: CVE-2026-64645 Advisory: https://osv.dev/vulnerability/G…
web/package.json ScaOsvGhsa p9j2 gv94 2wf4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.4.31` (resolved in `web/package-lock.json`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Aliases: CVE-2026-45623 Advisory: https://o…
web/package.json ScaOsvGhsa 6g55 p6wh 862q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.5.6` (resolved in `web/package-lock.json`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Aliases: CVE-2026-45623 Advisory: https://os…
web/package-lock.json ScaOsvGhsa 6g55 p6wh 862q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency uuid 8.3.2: GHSA-w5hq-g745-h8pq
OSV.dev reports `uuid` at version `8.3.2` (resolved in `web/package-lock.json`) is affected by GHSA-w5hq-g745-h8pq (aka CVE-2026-41907, CVE-2026-41988). Note: `uuid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. uuid: Missing buffer bounds check in…
web/package-lock.json ScaOsvGhsa w5hq g745 h8pq
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — web/components/Mermaid.tsx:174
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
web/components/Mermaid.tsx:174 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — web/components/ThemeScript.tsx:45
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
web/components/ThemeScript.tsx:45 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — web/components/visualize/VisualizationViewer.tsx:333
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
web/components/visualize/VisualizationViewer.tsx:333 Fq dangerous html
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2026-41148: mermaid 11.14.0 — web/package-lock.json
mermaid: Mermaid: CSS injection vulnerability allows page defacement and information disclosure Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS inj…
VulnCve 2026 41148
medium System graph security Trivy conf 1.00 CVE-2026-41149: mermaid 11.14.0 — web/package-lock.json
mermaid: Mermaid: HTML injection via classDef directive in state diagrams Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the defau…
VulnCve 2026 41149
medium System graph security Trivy conf 1.00 CVE-2026-41150: mermaid 11.14.0 — web/package-lock.json
mermaid: Mermaid: Denial of Service via specially crafted gantt charts Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attr…
VulnCve 2026 41150
medium System graph security Trivy conf 1.00 CVE-2026-41159: mermaid 11.14.0 — web/package-lock.json
mermaid: Mermaid: Information disclosure and page defacement via CSS injection Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Merm…
VulnCve 2026 41159
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.31 — web/package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 11.1.0 — web/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — web/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-44576: next 16.2.3 — web/package-lock.json
Next.js: Next.js: Cache poisoning vulnerability in React Server Components Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not corr…
VulnCve 2026 44576
medium System graph security Trivy conf 1.00 CVE-2026-44577: next 16.2.3 — web/package-lock.json
Next.js: Next.js: Denial of Service via Image Optimization API Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into mem…
VulnCve 2026 44577
medium System graph security Trivy conf 1.00 CVE-2026-44580: next 16.2.3 — web/package-lock.json
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can b…
VulnCve 2026 44580
medium System graph security Trivy conf 1.00 CVE-2026-44581: next 16.2.3 — web/package-lock.json
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scrip…
VulnCve 2026 44581
medium System graph security Trivy conf 1.00 CVE-2026-49458: dompurify 3.4.0 — web/package-lock.json
dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks us…
VulnCve 2026 49458
medium System graph security Trivy conf 1.00 CVE-2026-49459: dompurify 3.4.0 — web/package-lock.json
dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form…
VulnCve 2026 49459
medium System graph security Trivy conf 1.00 CVE-2026-49978: dompurify 3.4.0 — web/package-lock.json
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing att…
VulnCve 2026 49978
medium System graph security Trivy conf 1.00 CVE-2026-64643: next 16.2.3 — web/package-lock.json
Next.js: Unauthenticated disclosure of internal Server Function endpoints ## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action ID…
VulnCve 2026 64643
medium System graph security Trivy conf 1.00 CVE-2026-64644: next 16.2.3 — web/package-lock.json
Next.js: Denial of Service in the Image Optimization API using SVGs ### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause …
VulnCve 2026 64644
medium System graph security Trivy conf 1.00 CVE-2026-64646: next 16.2.3 — web/package-lock.json
Next.js: Unbounded Server Action payload in Edge runtime ## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hos…
VulnCve 2026 64646
medium System graph security Trivy conf 1.00 CVE-2026-64647: next 16.2.3 — web/package-lock.json
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **r…
VulnCve 2026 64647
medium System graph security Trivy conf 1.00 CVE-2026-64648: next 16.2.3 — web/package-lock.json
Next.js: Cache confusion of response bodies for requests with bodies ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauth…
VulnCve 2026 64648
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: deeptutor.services.config
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:358 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: deeptutor.services.setup
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:347 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: pathlib
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:346 containersPinned dependencies
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — deeptutor/runtime/launcher.py:429
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
deeptutor/runtime/launcher.py:429 SecurityPython
medium System graph security Trivy conf 1.00 GHSA-76mc-f452-cxcm: dompurify 3.4.0 — web/package-lock.json
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` # Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` **CWE**: CWE-501 (Tr…
VulnGhsa 76mc f452 cxcm
medium System graph security Trivy conf 1.00 GHSA-cmwh-pvxp-8882: dompurify 3.4.0 — web/package-lock.json
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) ## Summary DOMPurify 3.4.7 shipped a security fix ("permanent hook pollution") that makes a registered `uponSanitizeAttribute` hook's mutation of `data…
VulnGhsa cmwh pvxp 8882
medium System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 2 locations
.github/workflows/docker-release.yml:28
.github/workflows/pypi-release.yml:38
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/pypi-release.yml CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/docker-release.yml CI/CD securitySupply chainGithub actions
medium System graph security Semgrep conf 0.75 insecure hash algorithm sha1 — deeptutor/partners/channels/manager.py:158
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. Rule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 Severity: WARNING OWASP: A03:2017 - Se…
deeptutor/partners/channels/manager.py:158 SecurityPython
medium System graph security Semgrep conf 0.75 insecure hash algorithm sha1 — deeptutor/services/memory/snapshot/adapters.py:33
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. Rule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 Severity: WARNING OWASP: A03:2017 - Se…
deeptutor/services/memory/snapshot/adapters.py:33 SecurityPython
medium System graph security Semgrep conf 0.75 insecure hash algorithm sha1 — deeptutor/services/partners/manager.py:116
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. Rule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 Severity: WARNING OWASP: A03:2017 - Se…
deeptutor/services/partners/manager.py:116 SecurityPython
medium System graph security Semgrep conf 0.75 insecure hash algorithm sha1 — deeptutor/services/partners/runtime.py:519
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. Rule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 Severity: WARNING OWASP: A03:2017 - Se…
deeptutor/services/partners/runtime.py:519 SecurityPython
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in web/components/Mermaid.tsx:174
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
web/components/Mermaid.tsx:174 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in web/components/ThemeScript.tsx:45
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
web/components/ThemeScript.tsx:45 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in web/components/visualize/VisualizationViewer.tsx:333
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
web/components/visualize/VisualizationViewer.tsx:333 Dangerous innerhtml
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — deeptutor/runtime/launcher.py:122
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
deeptutor/runtime/launcher.py:122 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — scripts/docker_compose.py:107
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
scripts/docker_compose.py:107 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — scripts/prepare_web_package.py:33
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
scripts/prepare_web_package.py:33 runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 220 placeholder/mock markers across 83 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph network Security conf 1.00 Privileged port 10 in use
Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
docker-compose.ghcr.yml Ports
medium System graph quality Placeholder conf 1.00 Runtime service client appears to use placeholder configuration
A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured.
Runtime configService clientGenerated repo pattern
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-76mc-f452-cxcm
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-76mc-f452-cxcm (aka CVE-2026-65902). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Hook mutation of `data.allowedT…
web/package-lock.json ScaOsvGhsa 76mc f452 cxcm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-cmwh-pvxp-8882
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-cmwh-pvxp-8882 (aka CVE-2026-65898). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Permanent `ALLOWED_ATTR` pollut…
web/package-lock.json ScaOsvGhsa cmwh pvxp 8882
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-hpcv-96wg-7vj8
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-hpcv-96wg-7vj8 (aka CVE-2026-49458). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Cross-realm IN_PLACE sanitizati…
web/package-lock.json ScaOsvGhsa hpcv 96wg 7vj8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-r47g-fvhr-h676
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-r47g-fvhr-h676 (aka CVE-2026-49459). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: IN_PLACE mode preserves attribu…
web/package-lock.json ScaOsvGhsa r47g fvhr h676
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-rp9w-3fw7-7cwq
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-rp9w-3fw7-7cwq. Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
web/package-lock.json ScaOsvGhsa rp9w 3fw7 7cwq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-vxr8-fq34-vvx9
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-vxr8-fq34-vvx9. Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
web/package-lock.json ScaOsvGhsa vxr8 fq34 vvx9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-x4vx-rjvf-j5p4
OSV.dev reports `dompurify` at version `3.4.0` (resolved in `web/package-lock.json`) is affected by GHSA-x4vx-rjvf-j5p4. Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
web/package-lock.json ScaOsvGhsa x4vx rjvf j5p4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-6m6c-36f7-fhxh
OSV.dev reports `mermaid` at version `11.14.0` (resolved in `web/package-lock.json`) is affected by GHSA-6m6c-36f7-fhxh (aka CVE-2026-41150). Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Aliases: CVE-2026-41150 Advisory: https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh Fix: upgrad…
web/package.json ScaOsvGhsa 6m6c 36f7 fhxh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-87f9-hvmw-gh4p
OSV.dev reports `mermaid` at version `11.14.0` (resolved in `web/package-lock.json`) is affected by GHSA-87f9-hvmw-gh4p (aka CVE-2026-41159). Mermaid: Improper sanitization of configuration leads to CSS injection Aliases: CVE-2026-41159 Advisory: https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p …
web/package.json ScaOsvGhsa 87f9 hvmw gh4p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-ghcm-xqfw-q4vr
OSV.dev reports `mermaid` at version `11.14.0` (resolved in `web/package-lock.json`) is affected by GHSA-ghcm-xqfw-q4vr (aka CVE-2026-41149). Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection Aliases: CVE-2026-41149 Advisory: https://osv.dev/vulnerability/GHSA…
web/package.json ScaOsvGhsa ghcm xqfw q4vr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-xcj9-5m2h-648r
OSV.dev reports `mermaid` at version `11.14.0` (resolved in `web/package-lock.json`) is affected by GHSA-xcj9-5m2h-648r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r Fix: upgrade `mermaid` past the affected range per the advisory.
web/package.json ScaOsvGhsa xcj9 5m2h 648r
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-4633-3j49-mh5q
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647). Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Aliases: CVE-2026-64647 Advisory: https://osv.dev/…
web/package.json ScaOsvGhsa 4633 3j49 mh5q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-4c39-4ccg-62r3
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646). Next.js: Unbounded Server Action payload in Edge runtime Aliases: CVE-2026-64646 Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `next…
web/package.json ScaOsvGhsa 4c39 4ccg 62r3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-68g3-v927-f742
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648). Next.js: Cache confusion of response bodies for requests with bodies Aliases: CVE-2026-64648 Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix: u…
web/package.json ScaOsvGhsa 68g3 v927 f742
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-955p-x3mx-jcvp
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643). Next.js: Unauthenticated disclosure of internal Server Function endpoints Aliases: CVE-2026-64643 Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp F…
web/package.json ScaOsvGhsa 955p x3mx jcvp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-ffhc-5mcf-pf4q
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-ffhc-5mcf-pf4q (aka CVE-2026-44581). Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces Aliases: CVE-2026-44581 Advisory: https://osv.dev/vulnerability/GHSA-ffh…
web/package.json ScaOsvGhsa ffhc 5mcf pf4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-gx5p-jg67-6x7h
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-gx5p-jg67-6x7h (aka CVE-2026-44580). Next.js has cross-site scripting in beforeInteractive scripts with untrusted input Aliases: CVE-2026-44580 Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg…
web/package.json ScaOsvGhsa gx5p jg67 6x7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-h64f-5h5j-jqjh
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-h64f-5h5j-jqjh (aka CVE-2026-44577). Next.js has a Denial of Service in the Image Optimization API Aliases: CVE-2026-44577 Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade …
web/package.json ScaOsvGhsa h64f 5h5j jqjh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-q8wf-6r8g-63ch
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-q8wf-6r8g-63ch (aka CVE-2026-64644). Next.js: Denial of Service in the Image Optimization API using SVGs Aliases: CVE-2026-64644 Advisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch Fix: up…
web/package.json ScaOsvGhsa q8wf 6r8g 63ch
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-vfv6-92ff-j949
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-vfv6-92ff-j949. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Fix: upgrade `next` past the affected range per the advisory.
web/package.json ScaOsvGhsa vfv6 92ff j949
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.3: GHSA-wfc6-r584-vfw7
OSV.dev reports `next` at version `16.2.3` (resolved in `web/package-lock.json`) is affected by GHSA-wfc6-r584-vfw7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: upgrade `next` past the affected range per the advisory.
web/package.json ScaOsvGhsa wfc6 r584 vfw7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.4.31` (resolved in `web/package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305). PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Aliases: CVE-2026-41305 Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: …
web/package.json ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.5.6` (resolved in `web/package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305). PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Aliases: CVE-2026-41305 Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: u…
web/package-lock.json ScaOsvGhsa qx2v qp2m jg93
low System graph quality Integrity conf 1.00 32 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `AUTH_ENABLED`, `BACKEND_PORT`, `CI`, `CODEX_HOME`, `DEEPTUTOR_API_BASE_URL`, `DEEPTUTOR_AUTH_ENABLED`, `DEEPTUTOR_HUB_TOKEN`, `DEEPTUTOR_MODE` + 24 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break.
config drift
low System graph security Trivy conf 1.00 CVE-2026-44572: next 16.2.3 — web/package-lock.json
next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path ha…
VulnCve 2026 44572
low System graph security Trivy conf 1.00 CVE-2026-44582: next 16.2.3 — web/package-lock.json
Next.js: Next.js: Cache poisoning allows incorrect response delivery Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with…
VulnCve 2026 44582
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 196 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency i18next is a major version behind
`i18next` is pinned at `25.8.0` in `web/package.json` while the latest release on the npm registry is `26.3.6` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `i18next` to `26.3.6`.
web/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency lucide-react is a major version behind
`lucide-react` is pinned at `0.562.0` in `web/package.json` while the latest release on the npm registry is `1.26.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `lucide-react` to `1.…
web/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency react-i18next is a major version behind
`react-i18next` is pinned at `16.5.3` in `web/package.json` while the latest release on the npm registry is `17.0.11` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-i18next` to `…
web/package.json FreshnessOutdated
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:23 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:64 containersPinned dependencies
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.runner
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.runner
Misconfig
low System graph security Trivy conf 1.00 GHSA-c2j3-45gr-mqc4: dompurify 3.4.0 — web/package-lock.json
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. ## Summary There is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`. When a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it app…
VulnGhsa c2j3 45gr mqc4
low System graph security Trivy conf 1.00 GHSA-gvmj-g25r-r7wr: dompurify 3.4.0 — web/package-lock.json
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes ## Summary When DOMPurify is configured with both `SAFE_FOR_TEMPLATES: true` and `RETURN_DOM: true` (or `IN_PLACE: true`), an attacker can inject template express…
VulnGhsa gvmj g25r r7wr
low System graph security Trivy conf 1.00 GHSA-vxr8-fq34-vvx9: dompurify 3.4.0 — web/package-lock.json
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output ## Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_TYPES_POLICY` even after `clearConfig()` is called. A later caller that…
VulnGhsa vxr8 fq34 vvx9
low System graph security Trivy conf 1.00 GHSA-x4vx-rjvf-j5p4: dompurify 3.4.0 — web/package-lock.json
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects ## Summary When `DOMPurify.sanitize(root, { IN_PLACE: true })` is called on an attacker-supplied live DOM node, `DOMPurify` still trusts `cu…
VulnGhsa x4vx rjvf j5p4
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same substantial AST body hash: deeptutor/services/rag/pipelines/graphrag/storage.py:65:write_meta, deeptutor/services/rag/pipelines/lightrag/storage.py:145:write_meta This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygien…
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_migrated_legacy` in deeptutor/services/partners/manager.py:286
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `baidu_search_v2` in deeptutor/services/search/providers/baidu.py:37
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `data_copy` in deeptutor/agents/research/data_structures.py:229
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `files_upload_v2` in deeptutor/partners/channels/slack.py:154
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `isLegacy` in web/components/knowledge/KbIndexVersionsSection.tsx:230
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `migrateLegacy` in web/lib/chat-import/agent-store.ts:49
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in deeptutor/services/llm/config.py:120
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in deeptutor/services/llm/factory.py:230
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in deeptutor/services/partners/model_runtime.py:32
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `mOld` in web/lib/memory-graph.ts:165
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `nested_legacy` in deeptutor/services/rag/index_versioning.py:135
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `nested_legacy` in deeptutor/services/rag/pipelines/llamaindex/storage.py:41
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `no_backup` in deeptutor/knowledge/manager.py:1754
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `receive_v1` in deeptutor/partners/channels/feishu.py:274
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: advance_stage
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
deeptutor/learning/service.py:77
low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_old_tasks
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
deeptutor/api/utils/task_id_manager.py:82
low System graph software Dead code conf 1.00 Possibly dead Python function: do_GET
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
deeptutor_cli/skill_login.py:81
low System graph software Dead code conf 1.00 Possibly dead Python function: do_POST
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
deeptutor/partners/channels/msteams.py:170
low System graph software Dead code conf 1.00 Possibly dead Python function: ensure_root
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
deeptutor/co_writer/storage.py:119
low System graph software Dead code conf 1.00 Possibly dead Python function: fetch_messages_between_dates
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
deeptutor/partners/channels/email.py:239

Showing first 300 of 341. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/a1236bde-3ad5-4291-9711-6c240f595989/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/a1236bde-3ad5-4291-9711-6c240f595989/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.