headlesshq/headlessmc

Component	Sub-score	Weight	Contribution
`structure_score`	40.0	0.15	6.00
`security_score`	78.2	0.25	19.55
`testing_score`	80.0	0.20	16.00
`documentation_score`	64.0	0.15	9.60
`practices_score`	80.0	0.15	12.00
`code_quality`	78.7	0.10	7.87
Overall		1.00	71.0

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data — RCE.

Review and fix per the pattern semantics. See CWE-502 / A08:2021 for context.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/mods/files/PaperModFileReader.java:35 qualitylegacy

critical Legacy quality quality conf 1.00 [SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader can execute arbitrary Python objects (CVE-2017-18342). Ported from bandit B506 / dlint DUO109 (Apache-2.0 / BSD-3).

Use `yaml.safe_load(data)` or `yaml.load(data, Loader=yaml.SafeLoader)`.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/mods/files/PaperModFileReader.java:35 qualitylegacy

critical Legacy security deserialization conf 1.00 [SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Marshal.load` instantiate arbitrary Ruby classes — direct RCE on untrusted input. `unsafe_load` is even more dangerous.

Use `YAML.safe_load(input, permitted_classes: [Date])` — explicit class allowlist. Never use `Marshal.load` on untrusted data; serialize as JSON instead.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/mods/files/PaperModFileReader.java:35 deserializationlegacy

critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_TOKEN` on a `pull_request` trigger

This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted co…

.github/workflows/lifecycle.yml:747 dependencylegacy

critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_TOKEN` on a `pull_request` trigger

This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted co…

.github/workflows/lifecycle.yml:684 dependencylegacy

critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_USERNAME` on a `pull_request` trigger

This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_USERNAME }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted…

.github/workflows/lifecycle.yml:746 dependencylegacy

critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_USERNAME` on a `pull_request` trigger

This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_USERNAME }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted…

.github/workflows/lifecycle.yml:683 dependencylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/version/LibraryImpl.java:22 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/version/LibraryFactory.java:52 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/mods/modrinth/ModrinthFile.java:21 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED011] Scala Get On Option: Option.get throws NoSuchElementException on None. Use getOrElse / fold / match.

Review and fix per the pattern semantics. See CWE-476 / for context.

buildSrc/src/main/groovy/io/github/headlesshq/headlessmc/gradle/GenerateModuleTask.groovy:14 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED011] Scala Get On Option: Option.get throws NoSuchElementException on None. Use getOrElse / fold / match.

Review and fix per the pattern semantics. See CWE-476 / for context.

buildSrc/src/main/groovy/io/github/headlesshq/headlessmc/gradle/Extension2ClassWriterAdapter.groovy:15 qualitylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/cache` pinned to mutable ref `@v5`

`uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:148 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`

`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:216 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`

`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:61 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`

`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:31 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`

`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/run-matrix-in-memory.yml:17 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/deploy-pages` pinned to mutable ref `@v4`

`uses: actions/deploy-pages@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:204 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/download-artifact` pinned to mutable ref `@v8`

`uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:196 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/download-artifact` pinned to mutable ref `@v8`

`uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/run-matrix-in-memory.yml:106 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`

`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:62 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`

`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:32 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`

`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/run-matrix-in-memory.yml:102 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`

`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/run-matrix-in-memory.yml:18 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-python` pinned to mutable ref `@v6`

`uses: actions/setup-python@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:143 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-artifact` pinned to mutable ref `@v7`

`uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:125 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-artifact` pinned to mutable ref `@v7`

`uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:50 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-artifact` pinned to mutable ref `@v7`

`uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/run-matrix-in-memory.yml:40 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-pages-artifact` pinned to mutable ref `@v4.0.0`

`uses: actions/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:182 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `graalvm/setup-graalvm` pinned to mutable ref `@v1`

`uses: graalvm/setup-graalvm@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:217 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `headlesshq/mc-runtime-test` pinned to mutable ref `@4.1.0`

`uses: headlesshq/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/run-matrix-in-memory.yml:113 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `madrapps/jacoco-report` pinned to mutable ref `@v1.7.2`

`uses: madrapps/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/lifecycle.yml:75 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Binary file `gradle/wrapper/gradle-wrapper.jar` committed in source repo

`gradle/wrapper/gradle-wrapper.jar` is a .jar binary (43,764 bytes) committed to a repo that otherwise has 526 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

gradle/wrapper/gradle-wrapper.jar:1 dependencylegacy

high Legacy cicd docker conf 0.92 Dockerfile copies the entire context without .dockerignore

COPY . or ADD . sends the full build context to Docker. Without .dockerignore this can include secrets, git history, and local artifacts.

Dockerfile:5 dockerlegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:17-jre-noble` not pinned by digest

`FROM eclipse-temurin:17-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Fast.Dockerfile:12 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:17-jre-noble` not pinned by digest

`FROM eclipse-temurin:17-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Dockerfile:16 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jdk-noble` not pinned by digest

`FROM eclipse-temurin:21-jdk-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Fast.Dockerfile:6 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jdk-noble` not pinned by digest

`FROM eclipse-temurin:21-jdk-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Dockerfile:3 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jre-noble` not pinned by digest

`FROM eclipse-temurin:21-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Fast.Dockerfile:13 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jre-noble` not pinned by digest

`FROM eclipse-temurin:21-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Dockerfile:17 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:8-jre-noble` not pinned by digest

`FROM eclipse-temurin:8-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Fast.Dockerfile:10 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:8-jre-noble` not pinned by digest

`FROM eclipse-temurin:8-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Dockerfile:14 dependencylegacy

low Legacy security deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.

Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/mods/files/PaperModFileReader.java:35 deserializationlegacy

medium Legacy security path_traversal conf 1.00 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.

Validate extracted paths with os.path.realpath() and ensure they stay within the target directory.

headlessmc-java/src/main/java/io/github/headlesshq/headlessmc/java/download/ArchiveExtractor.java:43 path_traversallegacy

medium Legacy cicd docker conf 0.90 Docker build context has no .dockerignore

Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts.

.dockerignore dockerlegacy

high Legacy cicd docker conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

Dockerfile:17 dockerlegacy

medium 9-layer hardware security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

securitycontainer

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

headlesshq/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/run-matrix-in-memory.yml:113 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

madrapps/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:75 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

headlesshq/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:381 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

headlesshq/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:466 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

headlesshq/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:536 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/metadata-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:664 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/setup-qemu-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:669 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/setup-buildx-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:672 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/lifecycle.yml:681 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/lifecycle.yml supply-chaingithub-actionsleast-privilege

medium 9-layer quality tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 1 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

testscoverage

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

headlessmc-auth/src/main/java/io/github/headlesshq/headlessmc/auth/AbstractLoginCommand.java:261 qualitylegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

headlessmc-api/src/main/java/io/github/headlesshq/headlessmc/api/command/impl/MemoryCommand.java:39 qualitylegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

headlessmc-api/src/main/java/io/github/headlesshq/headlessmc/api/classloading/ApiClassloadingHelper.java:46 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/server/downloader/ModLauncherCommandDownloader.java:29

qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

headlessmc-launcher/src/main/java/io/github/headlesshq/headlessmc/launcher/server/downloader/ForgeDownloader.java:43 qualitylegacy

low 9-layer quality maintenance conf 1.00 117 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

maintenance

low 9-layer hardware coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

coveragedeployment

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:17-jre-noble

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:16 supply-chaindockerpinned-dependencies

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:21-jdk-noble

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:3 supply-chaindockerpinned-dependencies

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:21-jre-noble

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:17 supply-chaindockerpinned-dependencies

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: eclipse-temurin:8-jre-noble

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:14 supply-chaindockerpinned-dependencies