Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Scan timing: clone 4.63s · analysis 4.63s · 2.8 MB · GitHub preflight 418ms

headlesshq/headlessmc

https://github.com/headlesshq/headlessmc · scanned 2026-05-21 20:49 UTC (2 weeks ago) · 10 languages

154 findings (76 legacy + 78 scanner) 50th percentile · Java · medium (20-100K LoC) Scanner says 80 (lower by 9)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 weeks ago · v2 · 115 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
71.5
/100
Repobility
63
76 legacy
9-layer
80
88.9% cov · 39 gaps
Critical
7
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 40.0 0.15 6.00
security_score 78.2 0.25 19.55
testing_score 80.0 0.20 16.00
documentation_score 64.0 0.15 9.60
practices_score 80.0 0.15 12.00
code_quality 78.7 0.10 7.87
Overall 1.00 71.0
Severity distribution — click a segment to filter
Active filters: layer: software × excluding tests × Reset all
Severity: Critical 7 High 40 Medium 15 Low 32 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 76 9-layer 39 Crowd 0 Layer: Cicd 32 Security 3 Software 42 Quality 30 Api 1 Hardware 6 Frontend 1
Scan summary Repository scanned at 79.9/100 with 88.9% coverage. It contains 950 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 39 findings — concentrated in cicd (29), hardware (6), quality (2). Risk profile is low: 0 critical, 0 high, 13 medium. Recommended next step: open the cicd layer findings first — that's where the highest-impact wins live.

Showing 33 of 115 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_TOKEN` on a `pull_request` trigger
This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted co…
.github/workflows/lifecycle.yml:747 dependencylegacy
critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_TOKEN` on a `pull_request` trigger
This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted co…
.github/workflows/lifecycle.yml:684 dependencylegacy
critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_USERNAME` on a `pull_request` trigger
This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_USERNAME }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted…
.github/workflows/lifecycle.yml:746 dependencylegacy
critical Legacy software dependency conf 0.90 ✓ Repobility Workflow uses `secrets.DOCKERHUB_USERNAME` on a `pull_request` trigger
This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKERHUB_USERNAME }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted…
.github/workflows/lifecycle.yml:683 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/cache` pinned to mutable ref `@v5`
`uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:148 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:216 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:61 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:31 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/run-matrix-in-memory.yml:17 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/deploy-pages` pinned to mutable ref `@v4`
`uses: actions/deploy-pages@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:204 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/download-artifact` pinned to mutable ref `@v8`
`uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:196 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/download-artifact` pinned to mutable ref `@v8`
`uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/run-matrix-in-memory.yml:106 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`
`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:62 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`
`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:32 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`
`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/run-matrix-in-memory.yml:102 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-java` pinned to mutable ref `@v5`
`uses: actions/setup-java@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/run-matrix-in-memory.yml:18 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-python` pinned to mutable ref `@v6`
`uses: actions/setup-python@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:143 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-artifact` pinned to mutable ref `@v7`
`uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:125 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-artifact` pinned to mutable ref `@v7`
`uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:50 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-artifact` pinned to mutable ref `@v7`
`uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/run-matrix-in-memory.yml:40 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/upload-pages-artifact` pinned to mutable ref `@v4.0.0`
`uses: actions/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:182 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `graalvm/setup-graalvm` pinned to mutable ref `@v1`
`uses: graalvm/setup-graalvm@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:217 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `headlesshq/mc-runtime-test` pinned to mutable ref `@4.1.0`
`uses: headlesshq/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/run-matrix-in-memory.yml:113 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `madrapps/jacoco-report` pinned to mutable ref `@v1.7.2`
`uses: madrapps/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/lifecycle.yml:75 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Binary file `gradle/wrapper/gradle-wrapper.jar` committed in source repo
`gradle/wrapper/gradle-wrapper.jar` is a .jar binary (43,764 bytes) committed to a repo that otherwise has 526 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
gradle/wrapper/gradle-wrapper.jar:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:17-jre-noble` not pinned by digest
`FROM eclipse-temurin:17-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Fast.Dockerfile:12 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:17-jre-noble` not pinned by digest
`FROM eclipse-temurin:17-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Dockerfile:16 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jdk-noble` not pinned by digest
`FROM eclipse-temurin:21-jdk-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Fast.Dockerfile:6 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jdk-noble` not pinned by digest
`FROM eclipse-temurin:21-jdk-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Dockerfile:3 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jre-noble` not pinned by digest
`FROM eclipse-temurin:21-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Fast.Dockerfile:13 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:21-jre-noble` not pinned by digest
`FROM eclipse-temurin:21-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Dockerfile:17 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:8-jre-noble` not pinned by digest
`FROM eclipse-temurin:8-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Fast.Dockerfile:10 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `eclipse-temurin:8-jre-noble` not pinned by digest
`FROM eclipse-temurin:8-jre-noble` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Dockerfile:14 dependencylegacy
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/aacccc06-97b5-40f6-a398-8d90565325f3/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/aacccc06-97b5-40f6-a398-8d90565325f3/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.