Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

OpenCut-app/OpenCut

https://github.com/OpenCut-app/OpenCut · scanned 2026-07-23 19:47 UTC (4 days, 19 hours ago)

38 raw signals (0 security + 38 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 19 hours ago · v7 · 38 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

70.0% cov · 38 findings

Severity distribution — click a segment to filter

Active filters: source: scanner × excluding tests × Reset all

Severity: Critical 2 High 10 Medium 19 Low 6 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 38 Crowd 0 Layer: Frontend 1 Security 12 Quality 5 Cicd 1 Dependencies 19

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 60.5/100 with 70.0% coverage. It contains 490 nodes across 2 cross-layer flows, written primarily in mixed languages. Engine surfaced 38 findings — concentrated in dependencies (19), security (12), quality (5). Risk profile is high: 2 critical, 10 high, 19 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 37 of 38 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Skillspector conf 0.90 SkillSpector SC4 (supply-chain) in apps/api/package.json

elysia Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits. Skill: unknown Rule: SC4 Category: supply-chain Severity: CRITICAL Confidence: 0.90 Remediation: Update the dependency to a patched version that addresses…

apps/api/package.json:11 Mcp skillSupply chainSc4

critical System graph security Skillspector conf 0.90 SkillSpector SC4 (supply-chain) in apps/web/package.json

@tanstack/react-router Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits. Skill: unknown Rule: SC4 Category: supply-chain Severity: CRITICAL Confidence: 0.90 Remediation: Update the dependency to a patched versio…

apps/web/package.json:24 Mcp skillSupply chainSc4

high System graph security Skillspector conf 0.65 SkillSpector OH1 (output-handling) in apps/web/src/components/ui/chart.tsx

dangerouslySetInnerHTML={ Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: unknown Rule: OH1 Category: output-handling Severity: HIGH Confidence: 0.65 …

apps/web/src/components/ui/chart.tsx:93 Mcp skillOutput handlingOh1

high System graph security Skillspector conf 0.60 SkillSpector PE3 (priv-esc) in moon.yml

.env.local" Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: unknown Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets mana…

moon.yml:9 Mcp skillPriv escPe3

high System graph security Skillspector conf 0.70 SkillSpector SC6 (supply-chain) in apps/web/package.json

vaul Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them. Skill: unknown Rule: SC6 Category: supply-chain Severity: HIGH Confidence: 0.70 Remediation: Verify the pa…

apps/web/package.json:49 Mcp skillSupply chainSc6

high System graph dependencies dependencies conf 0.90 Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0194

OSV.dev reports `quick-xml` at version `0.30.0` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0194. Note: `quick-xml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Quadratic run time when checking a start tag for duplicate attribute names …

Cargo.lock ScaOsvRustsec 2026 0194

high System graph dependencies dependencies conf 0.90 Vulnerable dependency quick-xml 0.30.0: RUSTSEC-2026-0195

OSV.dev reports `quick-xml` at version `0.30.0` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0195. Note: `quick-xml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Unbounded namespace-declaration allocation in `NsReader` enables memory-exh…

Cargo.lock ScaOsvRustsec 2026 0195

high System graph dependencies dependencies conf 0.90 Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194

OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0194. Note: `quick-xml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Quadratic run time when checking a start tag for duplicate attribute names …

Cargo.lock ScaOsvRustsec 2026 0194

high System graph dependencies dependencies conf 0.90 Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195

OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0195. Note: `quick-xml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Unbounded namespace-declaration allocation in `NsReader` enables memory-exh…

Cargo.lock ScaOsvRustsec 2026 0195

high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 8.0.0: GHSA-fx2h-pf6j-xcff

OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `8.0.0` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Aliases: CVE-2026-…

apps/web/package.json ScaOsvGhsa fx2h pf6j xcff

high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 8.0.0: GHSA-p9ff-h696-f583

OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363). Note: `8.0.0` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket Aliase…

apps/web/package.json ScaOsvGhsa p9ff h696 f583

high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 8.0.0: GHSA-v2wj-q39q-566r

OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-v2wj-q39q-566r (aka CVE-2026-39364). Note: `8.0.0` is the declared floor of a range — the installed version may be newer. Vite: `server.fs.deny` bypassed with queries Aliases: CVE-2026-39364 Adviso…

apps/web/package.json ScaOsvGhsa v2wj q39q 566r

medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — apps/web/src/components/ui/chart.tsx:93

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

apps/web/src/components/ui/chart.tsx:93 Fq dangerous html

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .github/copilot-instructions.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.github/copilot-instructions.md VerificationAgent instruction

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph quality Tests conf 1.00 CI is configured but no tests are detected

A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal.

CI/CDConfig theaterRepo hardening

medium System graph security Trivy conf 1.00 CVE-2026-42199: grid 0.18.0 — Cargo.lock

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storag…

VulnCve 2026 42199

medium System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/bun-ci.yml:26 CI/CD securitySupply chainGithub actions

medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ui/chart.tsx:93

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

apps/web/src/components/ui/chart.tsx:93 Dangerous innerhtml

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 65 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

Coverage

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency async-std 1.13.2: RUSTSEC-2025-0052

OSV.dev reports `async-std` at version `1.13.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0052. Note: `async-std` is a transitive dependency — pulled in by another package, not declared directly in a manifest. async-std has been discontinued Advisory: https://osv.dev/vulnerability/RU…

Cargo.lock ScaOsvRustsec 2025 0052

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency grid 0.18.0: GHSA-38c5-483c-4qqp

OSV.dev reports `grid` at version `0.18.0` (resolved in `Cargo.lock`) is affected by GHSA-38c5-483c-4qqp (aka CVE-2026-42199). Note: `grid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API …

Cargo.lock ScaOsvGhsa 38c5 483c 4qqp

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency instant 0.1.13: RUSTSEC-2024-0384

OSV.dev reports `instant` at version `0.1.13` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0384. Note: `instant` is a transitive dependency — pulled in by another package, not declared directly in a manifest. `instant` is unmaintained Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…

Cargo.lock ScaOsvRustsec 2024 0384

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436

OSV.dev reports `paste` at version `1.0.15` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0436. Note: `paste` is a transitive dependency — pulled in by another package, not declared directly in a manifest. paste - no longer maintained Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-…

Cargo.lock ScaOsvRustsec 2024 0436

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173

OSV.dev reports `proc-macro-error2` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0173. Note: `proc-macro-error2` is a transitive dependency — pulled in by another package, not declared directly in a manifest. proc-macro-error2 is unmaintained Advisory: https://osv.dev…

Cargo.lock ScaOsvRustsec 2026 0173

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency rustls-pemfile 2.2.0: RUSTSEC-2025-0134

OSV.dev reports `rustls-pemfile` at version `2.2.0` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0134. Note: `rustls-pemfile` is a transitive dependency — pulled in by another package, not declared directly in a manifest. rustls-pemfile is unmaintained Advisory: https://osv.dev/vulnerab…

Cargo.lock ScaOsvRustsec 2025 0134

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency rustybuzz 0.14.1: RUSTSEC-2026-0206

OSV.dev reports `rustybuzz` at version `0.14.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0206. Note: `rustybuzz` is a transitive dependency — pulled in by another package, not declared directly in a manifest. `rustybuzz` is unmaintained Advisory: https://osv.dev/vulnerability/RUSTSE…

Cargo.lock ScaOsvRustsec 2026 0206

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency rustybuzz 0.20.1: RUSTSEC-2026-0206

OSV.dev reports `rustybuzz` at version `0.20.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0206. Note: `rustybuzz` is a transitive dependency — pulled in by another package, not declared directly in a manifest. `rustybuzz` is unmaintained Advisory: https://osv.dev/vulnerability/RUSTSE…

Cargo.lock ScaOsvRustsec 2026 0206

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 8.0.0: GHSA-4w7w-66w2-5vf9

OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `8.0.0` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling Aliases…

apps/web/package.json ScaOsvGhsa 4w7w 66w2 5vf9

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 8.0.0: GHSA-v6wh-96g9-6wx3

OSV.dev reports `vite` at version `8.0.0` (declared in `apps/web/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `8.0.0` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Alia…

apps/web/package.json ScaOsvGhsa v6wh 96g9 6wx3

low System graph quality Production readiness conf 1.00 Composite production-readiness gap

Multiple low-cost hardening controls are missing together: tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.

Repo hardeningGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/api/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

apps/api/package.json LockfileReproducibilityGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/web/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

apps/web/package.json LockfileReproducibilityGenerated repo pattern

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in LICENSE

NOT LIMITED TO Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: unknown Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Remediat…

LICENSE:7 Mcp skillExcessive agencyEa3

low System graph security Skillspector conf 0.70 SkillSpector SC1 (supply-chain) in apps/api/package.json

"elysia": "latest" Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions. Skill: unknown Rule: SC1 Category: supply-chain Severity: LOW Confidence: 0.70 Remediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exac…

apps/api/package.json:11 Mcp skillSupply chainSc1

low System graph security Skillspector conf 0.70 SkillSpector SC1 (supply-chain) in apps/web/package.json

"@tanstack/react-devtools": "latest" Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions. Skill: unknown Rule: SC1 Category: supply-chain Severity: LOW Confidence: 0.70 Remediation: Pin all dependency versions in requirements.txt or pyproj…

apps/web/package.json:23 Mcp skillSupply chainSc1

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/a14d2c7d-9c4f-4710-aba4-aedd84f7bd1a/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/a14d2c7d-9c4f-4710-aba4-aedd84f7bd1a/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.