BigBodyCobain/Shadowbroker

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	100.0	0.25	25.00
`testing_score`	97.0	0.20	19.40
`documentation_score`	81.0	0.15	12.15
`practices_score`	87.0	0.15	13.05
`code_quality`	45.0	0.10	4.50
Overall		1.00	83.1

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data — RCE.

Review and fix per the pattern semantics. See CWE-502 / A08:2021 for context.

backend/services/infonet/governance/dsl_executor.py:204 qualitylegacy

critical Legacy quality quality conf 1.00 ✓ Repobility [MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__.

Review and fix per the pattern semantics. See CWE-502 / for context.

backend/services/infonet/governance/dsl_executor.py:204 qualitylegacy

low Legacy security credential_exposure conf 0.90 [SEC001] Hardcoded Password: Hardcoded password found in source code.

Use environment variables or a secrets manager.

desktop-shell/tauri-skeleton/build.sh:48 credential_exposurelegacy

critical Legacy quality quality conf 1.00 [SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marshal.load(s) execute arbitrary code on untrusted input. Ported from dlint DUO103 / DUO120 (BSD-3).

Use json, msgpack, or protobuf for untrusted data. If pickle is required, sign the payload with HMAC.

backend/services/infonet/governance/dsl_executor.py:204 qualitylegacy

critical 9-layer security secrets conf 1.00 Possible secret in desktop-shell/tauri-skeleton/build.sh

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

desktop-shell/tauri-skeleton/build.sh:48 secrets

critical 9-layer security secrets conf 1.00 Possible secret in desktop-shell/tauri-skeleton/build.sh

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

desktop-shell/tauri-skeleton/build.sh:136 secrets

low Legacy quality quality conf 1.00 ✓ Repobility [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

Review and fix per the pattern semantics. See CWE-755 / for context.

backend/routers/admin.py:290 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

Review and fix per the pattern semantics. See CWE-755 / for context.

backend/main.py:1192 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

Review and fix per the pattern semantics. See CWE-755 / for context.

backend/auth.py:460 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

backend/services/fetchers/earth_observation.py:999 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

backend/main.py:3541 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

Review and fix per the pattern semantics. See CWE-705 / for context.

backend/services/mesh/mesh_peer_store.py:37 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

Review and fix per the pattern semantics. See CWE-705 / for context.

backend/services/mesh/mesh_hashchain.py:102 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

Review and fix per the pattern semantics. See CWE-705 / for context.

backend/routers/ai_intel.py:2681 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED036] Python Os System Call: os.system() invokes shell with no escaping.

Review and fix per the pattern semantics. See CWE-78 / for context.

backend/services/infonet/governance/dsl_executor.py:202 qualitylegacy

high Legacy security path_traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

backend/services/mesh/mesh_wormhole_prekey.py:139 path_traversallegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

frontend/src/components/MaplibreViewer.tsx:5242 xsslegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

frontend/src/components/InfonetTerminal/AIQueryView.tsx:145 xsslegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

desktop-shell/tauri-skeleton/scripts/write-release-manifest.cjs:139 xsslegacy

high Legacy quality quality conf 1.00 [SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='data' allows path-traversal (CVE-2007-4559, fixed via PEP 706 in 3.12). Ported from bandit B202 (Apache-2.0).

Add `filter='data'` (Python ≥ 3.12) or manually validate member paths against `os.path.abspath`.

backend/services/tor_hidden_service.py:112 qualitylegacy

low Legacy quality quality conf 1.00 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).

Use a literal RegExp or whitelist-validate user input before constructing patterns.

frontend/src/components/MeshTerminal.tsx:4913 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

frontend/src/components/MeshTerminal.tsx:4819 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

frontend/scripts/vite-no-net-use.cjs:5 qualitylegacy

high Legacy security injection conf 1.00 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders).

backend/services/fetchers/satellites.py:1010 injectionlegacy

high Legacy security injection conf 1.00 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders).

backend/services/fetchers/news.py:156 injectionlegacy

high Legacy security injection conf 1.00 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders).

backend/services/cctv_pipeline.py:589 injectionlegacy

high Legacy cicd docker conf 0.92 Dockerfile pipes a remote script into a shell

Download the artifact, verify its checksum or signature, pin the version, and then execute it.

backend/Dockerfile:27 dockerlegacy

high Legacy security llm_injection conf 0.82 LLM memory extraction can be prompt-injected into storing fake facts

Validate extracted facts with a schema, enforce length and count limits, reject code-fence/prompt-looking content, and discard facts that contain instruction-like phrases or raw JSON prompt fragments.

backend/services/mesh/mesh_wormhole_ratchet.py:56 llm_injectionlegacy

high Legacy security auth conf 0.83 Secret-like setting is echoed into a password input value

Never prefill secret fields with stored values. Show a masked status such as configured/not configured, require explicit rotation to replace the value, and return the raw key only once at creation time.

frontend/src/components/MeshChat/index.tsx:1329 authlegacy

high 9-layer quality integrity conf 1.00 Blocking `time.sleep(...)` inside `async def lifespan` — backend/main.py:2320

Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

backend/main.py:2320 integritysync-io-in-asyncperformance

high 9-layer quality integrity conf 1.00 Blocking `time.sleep(...)` inside `async def lifespan` — backend/main.py:2331

Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

backend/main.py:2331 integritysync-io-in-asyncperformance

high 9-layer quality integrity conf 1.00 Blocking `time.sleep(...)` inside `async def lifespan` — backend/main.py:2333

Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

backend/main.py:2333 integritysync-io-in-asyncperformance

high 9-layer quality integrity conf 1.00 Blocking `time.sleep(...)` inside `async def lifespan` — backend/main.py:2426

Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

backend/main.py:2426 integritysync-io-in-asyncperformance

high 9-layer api wiring conf 1.00 Dangling fetch: GET https://en.wikipedia.org/api/rest_v1/page/summary/${encodeURIComponent(title)} (frontend/src/components/WikiImage.tsx:39)

`frontend/src/components/WikiImage.tsx:39` calls `GET https://en.wikipedia.org/api/rest_v1/page/summary/${encodeURIComponent(title)}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/en.wikipedia.org/api/rest_v…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: GET https://en.wikipedia.org/api/rest_v1/page/summary/${encodeURIComponent(wikiTitle)} (frontend/src/components/NewsFeed.tsx:219)

`frontend/src/components/NewsFeed.tsx:219` calls `GET https://en.wikipedia.org/api/rest_v1/page/summary/${encodeURIComponent(wikiTitle)}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/en.wikipedia.org/api/re…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: GET https://nominatim.openstreetmap.org/search?q=${encodeURIComponent(q)}&format=json&limit=5 (frontend/src/app/LocateBar.tsx:103)

`frontend/src/app/LocateBar.tsx:103` calls `GET https://nominatim.openstreetmap.org/search?q=${encodeURIComponent(q)}&format=json&limit=5` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/nominatim.openstreetma…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: GET https://nominatim.openstreetmap.org/search?q=${encodeURIComponent(q)}&format=json&limit=5 (frontend/src/app/LocateBar.tsx:86)

`frontend/src/app/LocateBar.tsx:86` calls `GET https://nominatim.openstreetmap.org/search?q=${encodeURIComponent(q)}&format=json&limit=5` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/nominatim.openstreetmap…

wiringdangling-fetchfetch

high 9-layer api wiring conf 1.00 Dangling fetch: POST https://planetarycomputer.microsoft.com/api/stac/v1/search (frontend/src/hooks/useRegionDossier.ts:184)

`frontend/src/hooks/useRegionDossier.ts:184` calls `POST https://planetarycomputer.microsoft.com/api/stac/v1/search` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/planetarycomputer.microsoft.com/api/stac/v1/…

wiringdangling-fetchfetch

high 9-layer security auth conf 1.00 FastAPI POST `api_sentinel_tile` without auth dependency — backend/routers/tools.py:126

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/tools.py:126 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `api_sentinel_token` without auth dependency — backend/routers/tools.py:100

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/tools.py:100 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `api_wormhole_join` without auth dependency — backend/routers/wormhole.py:592

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/wormhole.py:592 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `api_wormhole_leave` without auth dependency — backend/routers/wormhole.py:649

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/wormhole.py:649 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `append_event` without auth dependency — backend/routers/infonet.py:493

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/infonet.py:493 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_block` without auth dependency — backend/routers/mesh_dm.py:410

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:410 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_count_secure` without auth dependency — backend/routers/mesh_dm.py:383

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:383 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_key_witness` without auth dependency — backend/routers/mesh_dm.py:449

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:449 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_poll_secure` without auth dependency — backend/routers/mesh_dm.py:356

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:356 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_prekey_peer_lookup` without auth dependency — backend/routers/mesh_dm.py:299

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:299 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_register_key` without auth dependency — backend/routers/mesh_dm.py:235

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:235 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `dm_send` without auth dependency — backend/routers/mesh_dm.py:349

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:349 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `gate_create` without auth dependency — backend/routers/mesh_public.py:1359

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1359 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `gate_message` without auth dependency — backend/routers/mesh_public.py:1446

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1446 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `gate_peer_pull` without auth dependency — backend/routers/mesh_peer_sync.py:202

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_peer_sync.py:202 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `gate_peer_push` without auth dependency — backend/routers/mesh_peer_sync.py:88

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_peer_sync.py:88 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `infonet_peer_push` without auth dependency — backend/routers/mesh_peer_sync.py:58

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_peer_sync.py:58 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `infonet_sync_post` without auth dependency — backend/routers/mesh_public.py:1521

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1521 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `mesh_identity_revoke` without auth dependency — backend/routers/mesh_public.py:1294

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1294 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `mesh_identity_rotate` without auth dependency — backend/routers/mesh_public.py:1209

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1209 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `mesh_report` without auth dependency — backend/routers/mesh_public.py:1105

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1105 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `mesh_send` without auth dependency — backend/routers/mesh_public.py:597

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:597 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `mesh_vote` without auth dependency — backend/routers/mesh_public.py:1033

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1033 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `oracle_predict` without auth dependency — backend/routers/mesh_oracle.py:69

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_oracle.py:69 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `oracle_resolve_stakes` without auth dependency — backend/routers/mesh_oracle.py:330

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_oracle.py:330 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `oracle_resolve` without auth dependency — backend/routers/mesh_oracle.py:226

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_oracle.py:226 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `oracle_stake` without auth dependency — backend/routers/mesh_oracle.py:255

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_oracle.py:255 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `preview_petition_payload` without auth dependency — backend/routers/infonet.py:173

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/infonet.py:173 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `satellite_overflights` without auth dependency — backend/routers/data.py:614

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/data.py:614 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `sigint_transmit` without auth dependency — backend/routers/sigint.py:38

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/sigint.py:38 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `trust_vouch` without auth dependency — backend/routers/mesh_dm.py:514

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_dm.py:514 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI POST `validate_event` without auth dependency — backend/routers/infonet.py:190

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/infonet.py:190 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI PUT `set_gate_envelope_policy` without auth dependency — backend/routers/mesh_public.py:1893

`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1893 authowaspauth.fastapi.unauth_mutation

high 9-layer security auth conf 1.00 FastAPI PUT `set_gate_legacy_envelope_fallback` without auth dependency — backend/routers/mesh_public.py:1922

`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

backend/routers/mesh_public.py:1922 authowaspauth.fastapi.unauth_mutation

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in backend/services/infonet/governance/dsl_executor.py:193

Found a known-risky pattern (eval_used). Review and replace if possible.

backend/services/infonet/governance/dsl_executor.py:193 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in backend/services/infonet/governance/dsl_executor.py:194

Found a known-risky pattern (exec_used). Review and replace if possible.

backend/services/infonet/governance/dsl_executor.py:194 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in desktop-shell/src/handlers/settingsHandlers.ts:15

Found a known-risky pattern (exec_used). Review and replace if possible.

desktop-shell/src/handlers/settingsHandlers.ts:15 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in desktop-shell/src/handlers/updateHandlers.ts:6

Found a known-risky pattern (exec_used). Review and replace if possible.

desktop-shell/src/handlers/updateHandlers.ts:6 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in desktop-shell/src/handlers/wormholeHandlers.ts:25

Found a known-risky pattern (exec_used). Review and replace if possible.

desktop-shell/src/handlers/wormholeHandlers.ts:25 owaspexec_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in frontend/src/components/MeshTerminal.tsx:4807

Found a known-risky pattern (exec_used). Review and replace if possible.

frontend/src/components/MeshTerminal.tsx:4807 owaspexec_used

medium Legacy security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.

authlegacy

high Legacy security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 28.6% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes.

authlegacy

high Legacy security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: DELETE /admin/session/route.

Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.

frontend/src/app/api/admin/session/route.ts:87 authlegacy

high Legacy security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /admin/session/route.

Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.

frontend/src/app/api/admin/session/route.ts:100 authlegacy

high Legacy security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /admin/session/route.

Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml.

frontend/src/app/api/admin/session/route.ts:61 authlegacy

high Legacy security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /:...path/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

frontend/src/app/api/[...path]/route.ts:301 authlegacy

high Legacy security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /:...path/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

frontend/src/app/api/[...path]/route.ts:289 authlegacy

high Legacy security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /:...path/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

frontend/src/app/api/[...path]/route.ts:293 authlegacy

high Legacy security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /:...path/route.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

frontend/src/app/api/[...path]/route.ts:297 authlegacy

medium Legacy quality error_handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.

backend/routers/admin.py:290 error_handlinglegacy

medium Legacy quality error_handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.

backend/main.py:1192 error_handlinglegacy

medium Legacy quality error_handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.

backend/auth.py:460 error_handlinglegacy

medium Legacy quality error_handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

frontend/src/components/TimelinePanel.tsx:93 error_handlinglegacy

medium Legacy quality error_handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

frontend/src/components/SettingsPanel.tsx:298 error_handlinglegacy

medium Legacy quality error_handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

backend/ais_proxy.js:45 error_handlinglegacy

medium Legacy security injection conf 0.50 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.

Use subprocess with shell=False and a list of args. Never eval user input.

frontend/src/components/MeshTerminal.tsx:4819 injectionlegacy

low Legacy security deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.

Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.

backend/services/infonet/governance/dsl_executor.py:204 deserializationlegacy

medium Legacy security path_traversal conf 1.00 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.

Validate extracted paths with os.path.realpath() and ensure they stay within the target directory.

backend/services/updater.py:228 path_traversallegacy

medium Legacy security path_traversal conf 1.00 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.

Validate extracted paths with os.path.realpath() and ensure they stay within the target directory.

backend/services/tor_hidden_service.py:112 path_traversallegacy

low Legacy security security conf 1.00 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and the parent tab quietly navigates to attacker-controlled content (reverse tabnabbing). OWASP-classic; modern browsers default rel='noopener' for new windows but explicit attribute is still required for compatibility.

Add rel="noopener noreferrer" to every <a target="_blank">: <a href="..." target="_blank" rel="noopener noreferrer">link</a> For dynamically generated links from JS, set rel on the element before appending. Even safe-looking subdomains should harden — costs nothing.

frontend/src/components/PredictionsPanel.tsx:444 securitylegacy

low Legacy security security conf 1.00 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and the parent tab quietly navigates to attacker-controlled content (reverse tabnabbing). OWASP-classic; modern browsers default rel='noopener' for new windows but explicit attribute is still required for compatibility.

Add rel="noopener noreferrer" to every <a target="_blank">: <a href="..." target="_blank" rel="noopener noreferrer">link</a> For dynamically generated links from JS, set rel on the element before appending. Even safe-looking subdomains should harden — costs nothing.

frontend/src/components/MaplibreViewer.tsx:5930 securitylegacy

low Legacy security security conf 1.00 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run window.opener.location = 'phishing-site' and the parent tab quietly navigates to attacker-controlled content (reverse tabnabbing). OWASP-classic; modern browsers default rel='noopener' for new windows but explicit attribute is still required for compatibility.

Add rel="noopener noreferrer" to every <a target="_blank">: <a href="..." target="_blank" rel="noopener noreferrer">link</a> For dynamically generated links from JS, set rel on the element before appending. Even safe-looking subdomains should harden — costs nothing.

frontend/src/components/InfonetTerminal/MarketView.tsx:380 securitylegacy

medium Legacy quality quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

frontend/src/components/MeshTerminal.tsx:2143 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

frontend/src/components/InfonetTerminal/MessagesView.tsx:202 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

frontend/src/components/InfonetTerminal/ExchangeView.tsx:205 qualitylegacy

medium Legacy security security conf 1.00 [SEC119] World-writable / world-readable file permissions: World-writable files let any local user (or container neighbor) tamper with data; world-readable files leak secrets.

Use 0600 (owner rw only) for secrets, 0644 for general files, 0700 for directories with secrets. Java: `setReadable(true, true)` (owner-only).

backend/services/updater.py:307 securitylegacy

medium Legacy security security conf 1.00 [SEC119] World-writable / world-readable file permissions: World-writable files let any local user (or container neighbor) tamper with data; world-readable files leak secrets.

Use 0600 (owner rw only) for secrets, 0644 for general files, 0700 for directories with secrets. Java: `setReadable(true, true)` (owner-only).

backend/services/tor_hidden_service.py:202 securitylegacy

medium Legacy quality quality conf 1.00 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass shallow CI), but invoking it crashes or silently no-ops. AI agents consistently emit these when their context window runs out mid-implementation. Production callers hitting these stubs is a classic AI-generated-incident.

Either implement the body, or fail closed at module-load time so the deploy can't ship a half-built route. A CI gate that fails build on `raise NotImplementedError` in non-abstract code catches this cleanly.

backend/services/infonet/privacy/shielded_balance.py:33 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass shallow CI), but invoking it crashes or silently no-ops. AI agents consistently emit these when their context window runs out mid-implementation. Production callers hitting these stubs is a classic AI-generated-incident.

Either implement the body, or fail closed at module-load time so the deploy can't ship a half-built route. A CI gate that fails build on `raise NotImplementedError` in non-abstract code catches this cleanly.

backend/services/infonet/privacy/ringct.py:61 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass shallow CI), but invoking it crashes or silently no-ops. AI agents consistently emit these when their context window runs out mid-implementation. Production callers hitting these stubs is a classic AI-generated-incident.

Either implement the body, or fail closed at module-load time so the deploy can't ship a half-built route. A CI gate that fails build on `raise NotImplementedError` in non-abstract code catches this cleanly.

backend/services/infonet/privacy/dex.py:36 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

backend/services/fetchers/earth_observation.py:952 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

backend/routers/mesh_public.py:442 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

backend/main.py:2818 qualitylegacy

high Legacy quality quality conf 0.72 Agent control bridge may listen on a network interface without visible auth

Bind local agent bridges to 127.0.0.1 by default. If remote access is required, require a bearer token or mTLS, enforce origin/CSRF checks for browser clients, and document the threat model.

backend/services/radio_intercept.py:25 qualitylegacy

medium Legacy cicd docker conf 0.94 Compose service `backend` image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

docker-compose.yml:9 dockerlegacy

medium Legacy cicd docker conf 0.94 Compose service `frontend` image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

docker-compose.yml:60 dockerlegacy

medium Legacy cicd docker conf 0.84 Dockerfile ADD downloads remote content

Use curl/wget with a pinned URL, verify checksum or signature, and prefer COPY for local files.

backend/Dockerfile:36 dockerlegacy

medium Legacy cicd docker conf 0.76 Dockerfile copies broad context with incomplete .dockerignore

Tighten .dockerignore or replace COPY . with explicit COPY statements.

frontend/Dockerfile:12 dockerlegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/wormholeHandlers.ts:41 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/wormholeHandlers.ts:35 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/wormholeHandlers.ts:31 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/wormholeHandlers.ts:29 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/wormholeHandlers.ts:27 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/wormholeHandlers.ts:25 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/updateHandlers.ts:6 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:39 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:33 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:31 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:30 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:25 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:23 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:17 qualitylegacy

high Legacy quality quality conf 0.74 Frontend API reference is not matched by discovered backend routes

Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.

desktop-shell/src/handlers/settingsHandlers.ts:15 qualitylegacy

high Legacy quality quality conf 0.80 localStorage write failures are swallowed silently

Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics.

frontend/src/components/WorldviewLeftPanel.tsx:482 qualitylegacy

high Legacy quality quality conf 0.80 localStorage write failures are swallowed silently

Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics.

frontend/src/components/ShodanPanel.tsx:246 qualitylegacy

high Legacy quality quality conf 0.80 localStorage write failures are swallowed silently

Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics.

frontend/src/components/SarModeChooserModal.tsx:85 qualitylegacy

high Legacy quality quality conf 0.80 localStorage write failures are swallowed silently

Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics.

frontend/src/components/MeshChat/useMeshChatController.ts:283 qualitylegacy

high Legacy quality quality conf 0.80 localStorage write failures are swallowed silently

Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics.

frontend/src/components/InfonetTerminal/MessagesView.tsx:281 qualitylegacy

high Legacy quality quality conf 0.80 localStorage write failures are swallowed silently

Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics.

frontend/src/components/InfonetTerminal/InfonetShell.tsx:97 qualitylegacy

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/api/[...path]/route.ts:34

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/LocateBar.tsx:86

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/AIIntelPanel.tsx:447

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/InfonetTerminal/AIQueryView.tsx:140

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/InfonetTerminal/GateView.tsx:484

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/InfonetTerminal/MarketView.tsx:175

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/map/panels/SigintPanels.tsx:96

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/MaplibreViewer.tsx:473

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/MeshChat/useMeshChatController.ts:1152

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/MeshTerminal.tsx:2067

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/NewsFeed.tsx:362

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/PredictionsPanel.tsx:698

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/RadioInterceptPanel.tsx:87

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/ShodanPanel.tsx:574

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/TimelinePanel.tsx:120

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/hooks/useDataPolling.ts:151

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/hooks/useRegionDossier.ts:90

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/lib/aiIntelClient.ts:32

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/lib/localControlTransport.ts:106

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/lib/sentinelHub.ts:145

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/mesh/infonetEconomyClient.ts:17

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/mesh/meshDmClient.ts:346

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/mesh/privacyCoreWasm/privacy_core.js:421

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer hardware supply-chain conf 1.00 Dockerfile ADD downloads remote content without checksum

Remote build inputs can change or be replaced upstream. Use Dockerfile ADD --checksum or download with an explicit digest/signature verification step.

backend/Dockerfile:36 supply-chaindockerchecksum

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:41 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:47 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:51 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:96 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:132 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:138 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:142 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

docker/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docker-publish.yml:188 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

astral-sh/setup-uv@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/ci.yml:39 supply-chaingithub-actionspinned-dependencies

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/docker-publish.yml supply-chaingithub-actionsleast-privilege

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — backend/services/ais_stream.py:564

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — backend/services/infonet/governance/dsl_executor.py:198

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — backend/services/updater.py:293

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

low Legacy cicd docker conf 0.72 .dockerignore misses sensitive defaults

Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases.

.dockerignore dockerlegacy

high Legacy cicd docker conf 0.56 Compose service does not declare a runtime user

Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.

docker-compose.yml:60 dockerlegacy

high Legacy cicd docker conf 0.56 Compose service does not declare a runtime user

Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.

docker-compose.yml:9 dockerlegacy

high Legacy cicd docker conf 0.62 Compose service lacks no-new-privileges hardening

Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.

docker-compose.yml:60 dockerlegacy

high Legacy cicd docker conf 0.62 Compose service lacks no-new-privileges hardening

Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.

docker-compose.yml:9 dockerlegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/mesh/meshGateWorkerVault.ts:31 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/mesh/meshGateLocalRuntime.ts:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/mesh/meshDmWorkerVault.ts:2 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/mesh/meshDmRatchet.ts:186 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/components/map/staticMapLayers.worker.ts:117 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/components/map/hooks/useDynamicMapLayersWorker.ts:8 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/components/WorldviewRightPanel.tsx:57 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/components/SarModeChooserModal.tsx:137 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/components/InfonetTerminal/UpgradeView.tsx:138 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

frontend/src/components/InfonetTerminal/MarketView.tsx:203 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

backend/services/tinygs_fetcher.py:135 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

backend/services/privacy_core_client.py:493 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

backend/services/infonet/schema.py:36 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

backend/services/infonet/governance/upgrade_hash.py:29 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

backend/services/infonet/gates/shutdown/__init__.py:13 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

backend/routers/tools.py:12 qualitylegacy

low 9-layer quality integrity conf 1.00 99 env vars used in code but missing from .env.example

Drift between code and config docs. The first few: `ALERTS_IN_UA_TOKEN`, `BACKEND_BASE_PYTHON`, `BACKEND_RELOAD`, `BACKEND_URL`, `BACKEND_VENV_DIR`, `BUNDLE_SIZE_LIMIT_KB`, `CORS_ORIGINS`, `CROWDTHREAT_ENABLED` + 91 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't b…

integrityconfig-drift

low 9-layer hardware coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

coveragedeployment

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:20-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

frontend/Dockerfile:1 supply-chaindockerpinned-dependencies

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

backend/Dockerfile:21 supply-chaindockerpinned-dependencies

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: rust:1.88-slim-bookworm

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

backend/Dockerfile:2 supply-chaindockerpinned-dependencies

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: frontend/next.config.peer-b.ts