← Back to scan
File as GitHub Issue repo: BigBodyCobain/Shadowbroker

Push this scan report to BigBodyCobain/Shadowbroker

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

JS: new RegExp() with non-literal

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED030 [MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__. backend/services/infonet/governance/dsl…:204
CRIT MINED018 [MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLo… backend/services/infonet/governance/dsl…:204
CRIT SEC081 [SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marsh… backend/services/infonet/governance/dsl…:204
CRIT SEC001 [SEC001] Hardcoded Password: Hardcoded password found in source code. desktop-shell/tauri-skeleton/build.sh:48
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… frontend/src/components/MeshTerminal.tsx:4913
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… frontend/src/components/MeshTerminal.tsx:4819
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… frontend/scripts/vite-no-net-use.cjs:5
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … desktop-shell/tauri-skeleton/src-tauri/…:244
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … desktop-shell/tauri-skeleton/src-tauri/…:298
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … desktop-shell/tauri-skeleton/src-tauri/…:523
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… frontend/src/components/MaplibreViewer.…:5242
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… frontend/src/components/InfonetTerminal…:145
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… desktop-shell/tauri-skeleton/scripts/wr…:139
HIGH SEC080 [SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='da… backend/services/tor_hidden_service.py:112
HIGH MINED009 [MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of D… backend/services/infonet/markets/resolu…:88
HIGH MINED009 [MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of D… backend/services/infonet/markets/disput…:124
HIGH MINED009 [MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of D… backend/services/infonet/markets/data_u…:75
HIGH MINED036 [MINED036] Python Os System Call: os.system() invokes shell with no escaping. backend/services/infonet/governance/dsl…:202
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… backend/services/fetchers/satellites.py:1010
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… backend/services/fetchers/news.py:156
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… backend/services/cctv_pipeline.py:589
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … backend/services/fetchers/aircraft_data…:48
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … backend/services/feed_ingester.py:157
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … backend/services/cctv_pipeline.py:633
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… backend/routers/infonet.py:173
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… backend/services/mesh/mesh_peer_store.py:37
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… backend/services/mesh/mesh_hashchain.py:102
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… backend/routers/ai_intel.py:2681
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). backend/services/fetchers/earth_observa…:999
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). backend/main.py:3541
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/routers/data.py:229
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/node_state.py:281
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/main.py:1343
HIGH SEC100 [SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` orig… backend/routers/cctv.py:182
HIGH SEC100 [SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` orig… backend/main.py:8163
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… backend/routers/admin.py:290
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… backend/main.py:1192
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… backend/auth.py:460
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/routers/cctv.py:80
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/main.py:1382
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/auth.py:1321
HIGH COMP001 [COMP001] High cognitive complexity: Function `_refresh_node_peer_store` has cognitive co… backend/node_state.py:159
HIGH DKR006 Dockerfile pipes a remote script into a shell backend/Dockerfile:27
HIGH JRN009 Secret-like setting is echoed into a password input value frontend/src/components/MeshChat/index.…:1329
HIGH AGT002 LLM memory extraction can be prompt-injected into storing fake facts backend/services/mesh/mesh_wormhole_rat…:56
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… backend/services/mesh/mesh_wormhole_pre…:139
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/src/components/PredictionsPane…:444
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/src/components/MaplibreViewer.…:5930
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… frontend/src/components/InfonetTerminal…:380
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … frontend/src/components/MeshTerminal.tsx:2143
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … frontend/src/components/InfonetTerminal…:202
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … frontend/src/components/InfonetTerminal…:205
MED SEC119 [SEC119] World-writable / world-readable file permissions: World-writable files let any l… backend/services/updater.py:307
MED SEC119 [SEC119] World-writable / world-readable file permissions: World-writable files let any l… backend/services/tor_hidden_service.py:202
MED SEC012 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation all… backend/services/updater.py:228
MED SEC012 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation all… backend/services/tor_hidden_service.py:112
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … frontend/src/components/InfonetTerminal…:361
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … backend/services/privacy_core_client.py:387
MED SEC127 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T… backend/services/infonet/privacy/shield…:33
MED SEC127 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T… backend/services/infonet/privacy/ringct…:61
MED SEC127 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T… backend/services/infonet/privacy/dex.py:36
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … desktop-shell/src/handlers/updateHandle…:6
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … desktop-shell/src/handlers/settingsHand…:15
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … backend/services/infonet/governance/dsl…:193
MED SEC007 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code. backend/services/infonet/governance/dsl…:204
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/services/fetchers/earth_observa…:952
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/routers/mesh_public.py:442
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… backend/main.py:2818
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/routers/admin.py:290
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/main.py:1192
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… backend/auth.py:460
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. frontend/src/components/TimelinePanel.t…:93
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. frontend/src/components/SettingsPanel.t…:298
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. backend/ais_proxy.js:45
MED COMP001 [COMP001] High cognitive complexity: Function `_cctv_proxy_profile_for_url` has cognitive… backend/routers/cctv.py:85
MED DKR003 Compose service `frontend` image uses the latest tag docker-compose.yml:60
MED DKR003 Compose service `backend` image uses the latest tag docker-compose.yml:9
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR013 Dockerfile ADD downloads remote content backend/Dockerfile:36
MED AGT007 localStorage write failures are swallowed silently frontend/src/components/WorldviewLeftPa…:482
MED AGT007 localStorage write failures are swallowed silently frontend/src/components/ShodanPanel.tsx:246
MED AGT007 localStorage write failures are swallowed silently frontend/src/components/SarModeChooserM…:85
MED AGT007 localStorage write failures are swallowed silently frontend/src/components/MeshChat/useMes…:283
MED AGT007 localStorage write failures are swallowed silently frontend/src/components/InfonetTerminal…:281
MED AGT007 localStorage write failures are swallowed silently frontend/src/components/InfonetTerminal…:97
MED DKR014 Dockerfile copies broad context with incomplete .dockerignore frontend/Dockerfile:12
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/wormholeHand…:41
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/wormholeHand…:35
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/wormholeHand…:31
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/wormholeHand…:29
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/wormholeHand…:27
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/wormholeHand…:25
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/updateHandle…:6
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:39
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:33
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:31
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:30
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:25
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:23
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:17
MED JRN003 Frontend API reference is not matched by discovered backend routes desktop-shell/src/handlers/settingsHand…:15
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 28.6% of discovered … —
MED AGT012 Agent control bridge may listen on a network interface without visible auth backend/services/radio_intercept.py:25
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/[...path]/route.ts:301
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/[...path]/route.ts:297
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/[...path]/route.ts:293
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … frontend/src/app/api/[...path]/route.ts:289
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… frontend/src/app/api/admin/session/rout…:100
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… frontend/src/app/api/admin/session/rout…:87
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… frontend/src/app/api/admin/session/rout…:61
MED SEC005 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input. frontend/src/components/MeshTerminal.tsx:4819
LOW COMP001 [COMP001] High cognitive complexity: Function `api_set_meshtastic_mqtt_settings` has cogn… backend/routers/admin.py:171
LOW AIC003 Duplicated implementation block across source files frontend/src/mesh/meshGateWorkerVault.ts:31
LOW AIC003 Duplicated implementation block across source files frontend/src/mesh/meshGateLocalRuntime.…:1
LOW AIC003 Duplicated implementation block across source files frontend/src/mesh/meshDmWorkerVault.ts:2
LOW AIC003 Duplicated implementation block across source files frontend/src/mesh/meshDmRatchet.ts:186
LOW AIC003 Duplicated implementation block across source files frontend/src/components/map/staticMapLa…:117
LOW AIC003 Duplicated implementation block across source files frontend/src/components/map/hooks/useDy…:8
LOW AIC003 Duplicated implementation block across source files frontend/src/components/WorldviewRightP…:57
LOW AIC003 Duplicated implementation block across source files frontend/src/components/SarModeChooserM…:137
LOW AIC003 Duplicated implementation block across source files frontend/src/components/InfonetTerminal…:138
LOW AIC003 Duplicated implementation block across source files frontend/src/components/InfonetTerminal…:203
LOW AIC003 Duplicated implementation block across source files backend/services/tinygs_fetcher.py:135
LOW AIC003 Duplicated implementation block across source files backend/services/privacy_core_client.py:493
LOW AIC003 Duplicated implementation block across source files backend/services/infonet/schema.py:36
LOW AIC003 Duplicated implementation block across source files backend/services/infonet/governance/upg…:29
LOW AIC003 Duplicated implementation block across source files backend/services/infonet/gates/shutdown…:13
LOW AIC003 Duplicated implementation block across source files backend/routers/tools.py:12
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:60
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:9
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:60
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:9
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… wormhole-start.sh:36
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… meshnode.sh:37
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. frontend/src/components/MaplibreViewer.…:5764
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. frontend/src/components/NewsFeed.tsx:382
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. frontend/src/components/MaplibreViewer.…:791
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. frontend/src/components/AIIntelPanel.tsx:1631
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/src/components/ChangelogModal.…:322
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/src/components/AIIntelPanel.tsx:1632
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/src/app/LocateBar.tsx:223
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… desktop-shell/tauri-skeleton/src-tauri/…:363
INFO MINED068 [MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled i… privacy-core/src/lib.rs:235
INFO MINED068 [MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled i… desktop-shell/tauri-skeleton/src-tauri/…:412
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. desktop-shell/tauri-skeleton/src-tauri/…:543
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. desktop-shell/tauri-skeleton/src-tauri/…:1104
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. desktop-shell/tauri-skeleton/src-tauri/…:280
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … frontend/src/components/InfonetTerminal…:57
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … frontend/src/app/page.tsx:751
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … desktop-shell/src/nativeControlRouter.ts:52
INFO MINED077 [MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles. backend/services/wormhole_supervisor.py:483
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. backend/services/mesh/mesh_signed_event…:215
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. backend/services/mesh/mesh_peer_store.py:24
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. backend/services/infonet/gates/shutdown…:34
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. backend/services/infonet/gates/shutdown…:42
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. backend/services/infonet/gates/sacrific…:80
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… desktop-shell/tauri-skeleton/src-tauri/…:416
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… backend/services/fetchers/earth_observa…:705
INFO MINED053 [MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin… backend/services/env_check.py:185
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… backend/services/fetchers/aircraft_data…:48
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… backend/services/feed_ingester.py:157
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… backend/services/cctv_pipeline.py:633
INFO MINED063 [MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) — file can be replaced/de… backend/services/stix_exporter.py:396
INFO MINED063 [MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) — file can be replaced/de… backend/services/analysis_zone_store.py:67
INFO MINED063 [MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) — file can be replaced/de… backend/services/ai_pin_store.py:89
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. backend/scripts/rotate_secure_storage_s…:46
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… backend/services/wormhole_supervisor.py:65
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… backend/services/config.py:24
INFO MINED065 [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser o… backend/main.py:168
INFO MINED047 [MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explic… backend/services/sigint_bridge.py:632
INFO MINED047 [MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explic… backend/services/env_check.py:342
INFO MINED047 [MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explic… backend/main.py:1425
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/routers/tools.py:206
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/routers/cctv.py:123
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/main.py:2245
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… backend/routers/ai_intel.py:2686
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… backend/main.py:1193
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… backend/auth.py:461
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … desktop-shell/tauri-skeleton/scripts/bu…:104
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … desktop-shell/src/nativeControlRouter.ts:91
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … backend/ais_proxy.js:8
Reset to top 5 182 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `BigBodyCobain/Shadowbroker`

**Score: 71/100 (A-)**  ·  182 findings  ·  scanned 2026-05-18 19:19 UTC  ·  277,324 LOC

| Severity | Count |
|---|---|
| CRITICAL | 4 |
| HIGH | 42 |
| MEDIUM | 65 |
| LOW | 22 |

📊 [Full filterable report](https://www.repobility.com/scan/ace85012-9f8f-420e-9261-5db673c5b483/)  ·  ![scorecard](https://www.repobility.com/scan/ace85012-9f8f-420e-9261-5db673c5b483/report.png?v=1779131948-s2)

### Top findings

1. **CRITICAL** `MINED030` — Python Pickle Loads
   `backend/services/infonet/governance/dsl_executor.py:204` · CWE-502 · ✓ Repobility
2. **CRITICAL** `MINED018` — Unsafe Deserialization Pickle
   `backend/services/infonet/governance/dsl_executor.py:204` · CWE-502 · ✓ Repobility
3. **CRITICAL** `SEC081` — Python: pickle.loads / marshal.loads on untrusted data
   `backend/services/infonet/governance/dsl_executor.py:204` · A05:2021 Security Misconfiguration
4. **CRITICAL** `SEC001` — Hardcoded Password
   `desktop-shell/tauri-skeleton/build.sh:48` · A07:2021 Identification & Authentication Failures
5. **HIGH** `SEC083` — JS: new RegExp() with non-literal
   `frontend/src/components/MeshTerminal.tsx:4913`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://www.repobility.com/scan/ace85012-9f8f-420e-9261-5db673c5b483/_
Megaproject â high spam risk
Could not determine 'BigBodyCobain/Shadowbroker' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.