2anki/server

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	3.0	0.25	0.75
`testing_score`	100.0	0.20	20.00
`documentation_score`	88.4	0.15	13.26
`practices_score`	78.0	0.15	11.70
`code_quality`	64.5	0.10	6.45
Overall		1.00	64.9

critical Security checks security secrets conf 0.95 6 occurrences Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Gitleaks detected a committed secret or credential pattern.

5 files, 6 locations

src/controllers/DownloadController.test.ts:80, 93 (2 hits)

src/controllers/ResumeCheckoutController.test.ts:7

src/services/AuthenticationService.test.ts:486

src/services/ops/BusinessMetricsService.ts:428

src/templates/README.html:672

critical Security checks security secrets conf 0.95 12 occurrences Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.

Gitleaks detected a committed secret or credential pattern.

10 files, 12 locations

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/9f96d8fb-5b10-4b65-8655-15d3b0ba4f07.json:178, 269 (2 hits)

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/e673858e-5371-4ddf-84c6-b04a3bbd5c34.json:206, 281 (2 hits)

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/05a5b1e6-eef3-483b-b8da-b16b84fd50d1.json:72

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/282720db-142b-4606-b230-bb75d1be1a4b.json:54

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/3a3591d9-ece2-47e3-8653-8cde6665ba6e.json:29

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/4de52a2c-c4a3-4a33-98e3-1402c290712e.json:90

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/7c24b0b0-3cbd-444e-95e7-348893c00f9c.json:94

src/services/NotionService/_mock/payloads/ListBlockChildrenResponse/8d316348-8a7e-481a-8a54-b621c1d8e16f.json:161

high Security checks security auth conf 0.88 Token handoff appears to use a callback URL or fragment

A frontend flow appears to combine a caller-controlled callback/redirect parameter with a token-bearing URL or fragment. This can exfiltrate sessions when callback validation is incomplete.

web/src/pages/AccountClaimPage/AccountClaimPage.tsx:23

low Security checks cicd CI/CD security conf 0.35 ✓ Repobility Workflow references repository secrets in a pull_request workflow

Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.

.github/workflows/claude-code-review.yml:36 CI/CD securityworkflow secretsGitHub Actions

high Security checks software dependencies conf 0.88 @babel/plugin-transform-modules-systemjs: GHSA-fv7c-fp4j-7gwp

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

web/pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-2v35-w6hq-6mfw

xmldom: Uncontrolled recursion in XML serialization leads to DoS

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-f6ww-3ggp-fr8h

xmldom has XML injection through unvalidated DocumentType serialization

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-j759-j44w-7fr8

xmldom has XML node injection through unvalidated comment serialization

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @xmldom/xmldom: GHSA-x6wf-f3px-wcqx

xmldom has XML node injection through unvalidated processing instruction serialization

pnpm-lock.yaml

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /api/ankify/clients/:id.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /api/ankify/clients/:id.

src/routes/AnkifyRouter.ts:476

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /api/notion/render-block/:id.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /api/notion/render-block/:id.

src/routes/NotionRouter.ts:576

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /api/users/r/:id.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /api/users/r/:id.

src/routes/UserRouter.ts:371

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /download/:id.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /download/:id.

src/routes/DownloadRouter.ts:89

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /download/:id/:filename.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /download/:id/:filename.

src/routes/DownloadRouter.ts:161

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /download/:id/bulk.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /download/:id/bulk.

src/routes/DownloadRouter.ts:122

low Security checks quality Quality conf 1.00 ✓ Repobility [MINED012] Curl Pipe Bash: curl ... | sh / bash — runs unverified network code.

Review and fix per the pattern semantics. See CWE-494 / A08:2021 for context.

.claude/hooks/pre-bash-curl-pipe.py:3

high Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

src/controllers/OpsErrorsController.ts:103

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/ops/errors/:messageHash/resolve has no auth

Express route DELETE /api/ops/errors/:messageHash/resolve declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/OpsErrorsRouter.ts:128

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/rules/:id has no auth

Express route DELETE /api/rules/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ParserRulesRouter.ts:181

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/upload/dropbox/mine/:id has no auth

Express route DELETE /api/upload/dropbox/mine/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:666

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/upload/google_drive/mine/:id has no auth

Express route DELETE /api/upload/google_drive/mine/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:767

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/upload/jobs/:id has no auth

Express route DELETE /api/upload/jobs/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:454

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/upload/mine/:key has no auth

Express route DELETE /api/upload/mine/:key declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:572

high Security checks quality Quality conf 0.80 ✓ Repobility Express PATCH /api/chat/conversations/:id has no auth

Express route PATCH /api/chat/conversations/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ChatRouter.ts:430

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/chat/consent has no auth

Express route POST /api/chat/consent declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ChatRouter.ts:55

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/chat/deck has no auth

Express route POST /api/chat/deck declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ChatRouter.ts:267

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/chat/message has no auth

Express route POST /api/chat/message declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ChatRouter.ts:193

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/chat/tag-cards has no auth

Express route POST /api/chat/tag-cards declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ChatRouter.ts:312

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/contact-us has no auth

Express route POST /api/contact-us declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/DefaultRouter.ts:158

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/favorite/create has no auth

Express route POST /api/favorite/create declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/FavoriteRouter.ts:72

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/favorite/remove has no auth

Express route POST /api/favorite/remove declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/FavoriteRouter.ts:124

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/feedback/interview has no auth

Express route POST /api/feedback/interview declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/FeedbackRouter.ts:51

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/ops/errors/:messageHash/resolve has no auth

Express route POST /api/ops/errors/:messageHash/resolve declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/OpsErrorsRouter.ts:125

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/rules/create/:id has no auth

Express route POST /api/rules/create/:id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/ParserRulesRouter.ts:144

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/surveys/post-login has no auth

Express route POST /api/surveys/post-login declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UserSurveyRouter.ts:36

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/upload/dropbox has no auth

Express route POST /api/upload/dropbox declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:252

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/upload/file has no auth

Express route POST /api/upload/file declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:122

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/upload/google_drive has no auth

Express route POST /api/upload/google_drive declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:293

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/upload/jobs/:jobId/restart has no auth

Express route POST /api/upload/jobs/:jobId/restart declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:531

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/upload/retry-with-credential has no auth

Express route POST /api/upload/retry-with-credential declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:192

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/upload/save has no auth

Express route POST /api/upload/save declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/UploadRouter.ts:177

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /webhook has no auth

Express route POST /webhook declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/WebhookRouter.ts:86

high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6

fast-uri vulnerable to path traversal via percent-encoded dot segments

web/pnpm-lock.yaml

high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

web/pnpm-lock.yaml

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 22 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v6` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

7 files, 22 locations

.github/workflows/playwright.yml:38, 42, 51, 63 (6 hits)

.github/workflows/web.yml:24, 35, 43, 57 (5 hits)

.github/workflows/create_deck.yml:17, 18, 41, 42 (4 hits)

.github/workflows/claude-code-review.yml:28 (2 hits)

.github/workflows/claude.yml:29 (2 hits)

.github/workflows/server.yml:22, 38 (2 hits)

.github/workflows/weekly-retro.yml:18

CI/CD securitySupply chainGitHub Actions

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 6 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `anthropics/claude-code-action` pinned to mutable ref `@v1` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

3 files, 6 locations

.github/workflows/claude-code-review.yml:34 (2 hits)

.github/workflows/claude.yml:35 (2 hits)

.github/workflows/deploy.2anki.net.yml:19 (2 hits)

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 lodash-es: GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

pnpm-lock.yaml

high Security checks software dependencies conf 0.90 ✓ Repobility package.json dep `xlsx` pulled from URL/Git

`dependencies.xlsx` = `https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or git host is compromised, every `npm install` pulls the new payload.

package.json:1

high Security checks software dependencies conf 0.88 protobufjs: GHSA-66ff-xgx4-vchm

protobuf.js: Code injection through bytes field defaults in generated toObject code

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 protobufjs: GHSA-685m-2w69-288q

protobuf.js: Denial of service through unbounded protobuf recursion

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 protobufjs: GHSA-75px-5xx7-5xc7

protobuf.js: Code generation gadget after prototype pollution

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 protobufjs: GHSA-jvwf-75h9-cwgg

protobuf.js: Process-wide denial of service through unsafe option paths

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 react-router: GHSA-8x6r-g9mw-2r78

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

web/pnpm-lock.yaml

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

web/src/pages/LoginPage/components/LoginForm/index.tsx:177

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

web/src/components/forms/RegisterForm.tsx:186

high Security checks software dependencies conf 0.88 xlsx: GHSA-4r6h-8v6p-xvw6

Prototype Pollution in sheetJS

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 xlsx: GHSA-5pgg-2g8v-p4x9

SheetJS Regular Expression Denial of Service (ReDoS)

pnpm-lock.yaml

high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${port}/login (src/routes/middleware/denyFraming.wireup.test.ts:16)

`src/routes/middleware/denyFraming.wireup.test.ts:16` calls `GET http://127.0.0.1:${port}/login` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/login` If this points at an external API, prefix i…

Dangling fetchFetch

high System graph security security conf 1.00 Insecure pattern 'exec_used' in src/services/observability/instrumentedAxios.ts:303

Found a known-risky pattern (exec_used). Review and replace if possible.

src/services/observability/instrumentedAxios.ts:303 Exec used

medium Security checks software dependencies conf 0.88 @protobufjs/utf8: GHSA-q6x5-8v7m-xcrf

protobufjs has overlong UTF-8 decoding

pnpm-lock.yaml

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: DELETE /api/users/me/settings.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: DELETE /api/users/me/settings.

src/routes/SettingsRouter.ts:317

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/card-options.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/card-options.

src/routes/SettingsRouter.ts:246

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/default.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/default.

src/routes/SettingsRouter.ts:209

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/find/:id.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/find/:id.

src/routes/SettingsRouter.ts:183

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/list.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /api/settings/list.

src/routes/SettingsRouter.ts:293

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /api/settings/create/:id.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /api/settings/create/:id.

src/routes/SettingsRouter.ts:91

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /api/settings/delete/:id.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /api/settings/delete/:id.

src/routes/SettingsRouter.ts:132

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /api/ops/errors/:messageHash/resolve.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /api/ops/errors/:messageHash/resolve.

src/routes/OpsErrorsRouter.ts:128

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /api/upload/jobs/:id.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /api/upload/jobs/:id.

src/routes/UploadRouter.ts:454

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/checks.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/checks.

src/routes/ChecksRouter.ts:44

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/ops/errors.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/ops/errors.

src/routes/OpsErrorsRouter.ts:57

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/ops/errors/export.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/ops/errors/export.

src/routes/OpsErrorsRouter.ts:84

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/showcase.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/showcase.

src/routes/ShowcaseRouter.ts:26

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/users/debug/locals.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/users/debug/locals.

web/mock-server/server.js:161

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/favorite/remove.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/favorite/remove.

src/routes/FavoriteRouter.ts:124

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/ops/errors/:messageHash/resolve.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/ops/errors/:messageHash/resolve.

src/routes/OpsErrorsRouter.ts:125

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/users/link_email.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/users/link_email.

web/mock-server/server.js:201

medium Security checks quality Error handling conf 1.00 3 occurrences [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

3 files, 3 locations

.claude/caveman/hooks/caveman-activate.js:22

.claude/caveman/hooks/caveman-mode-tracker.js:97

src/usecases/apkg/ImportApkgToNotionUseCase.ts:158

medium Security checks software Open redirect conf 1.00 3 occurrences [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.

Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …

3 files, 3 locations

web/src/components/UpsellCard/UpsellCard.tsx:89

web/src/pages/DownloadsPage/components/DeckFeedbackPrompt.tsx:111

web/src/pages/DownloadsPage/components/PaywallBanner.tsx:39

medium Security checks quality Quality conf 1.00 [SEC105] Cookie missing HttpOnly/Secure flag: Session cookie missing HttpOnly (allows JS reads), Secure (transmitted over plain HTTP), or SameSite (CSRF). Each on its own is a finding.

Always set HttpOnly=true, Secure=true (in production), SameSite=Lax or Strict. For Express: `res.cookie(name, val, { httpOnly: true, secure: true, sameSite: 'lax' })`.

src/routes/middleware/anonIdMiddleware.ts:25

low Security checks quality Quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

.claude/hooks/pre-push-typecheck.py:63

low Security checks quality Quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

.claude/caveman/hooks/caveman-config.js:165

low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

.claude/hooks/pre-push-typecheck.py:72 Error handlingquality

low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

.claude/hooks/safety.py:70 Error handlingquality

medium Security checks software dependencies conf 0.88 dompurify: GHSA-39q2-94rc-95cp

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-cj63-jhhr-wcxv

DOMPurify USE_PROFILES prototype pollution allows event handlers

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-cjmm-f4jc-qw8r

DOMPurify ADD_ATTR predicate skips URI validation

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-crv5-9vww-q3g8

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-h7mw-gpvr-xq4m

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-h8r8-wccr-v5f2

DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-v2wj-7wpq-c8vv

DOMPurify contains a Cross-site Scripting vulnerability

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 dompurify: GHSA-v9jr-rg53-9pgp

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

pnpm-lock.yaml

high Security checks quality Quality conf 0.74 15 occurrences Frontend API reference is not matched by discovered backend routes

A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys.

4 files, 15 locations

src/routes/AnkifyRouter.ts:539, 585, 625, 630, 635, 679, 712, 743, +4 more (12 hits)

src/config/swagger.ts:574

src/routes/AnkifyWebhookRouter.ts:53

src/routes/ApkgRouter.ts:152

medium Security checks software dependencies conf 0.88 lodash-es: GHSA-f23m-r3pf-42rh

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 lodash-es: GHSA-xxjr-mmjv-4gpg

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 nanoid: GHSA-mwcw-c2x4-8c55

Predictable results in nanoid generation when given non-integer values

pnpm-lock.yaml

medium Security checks software dependencies conf 0.90 npm package `pdf-parse` is 1 major version(s) behind (1.1.1 -> 2.4.5)

`pdf-parse` is pinned/resolved at 1.1.1 but the latest stable release on the npm registry is 2.4.5 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.88 protobufjs: GHSA-2pr8-phx7-x9h3

protobuf.js: Denial of service from crafted field names in generated code

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 protobufjs: GHSA-fx83-v9x8-x52w

protobuf.js: Prototype injection in generated message constructors

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 protobufjs: GHSA-jggg-4jg4-v7c6

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 protobufjs: GHSA-q6x5-8v7m-xcrf

protobufjs has overlong UTF-8 decoding

pnpm-lock.yaml

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 2 occurrences qs: GHSA-q8mj-m7cp-5q26

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

2 files, 2 locations

pnpm-lock.yaml

web/pnpm-lock.yaml

medium Security checks quality Quality conf 0.78 3 occurrences React interval is created without an explicit cleanup

Intervals created in React hooks or components should be cleared on unmount. Missing cleanup can keep stale callbacks alive after recording, polling, or overlay components close.

3 files, 3 locations

src/lib/ankify/jobs/scheduleAnkifyPolling.ts:53

src/lib/inactivity/jobs/scheduleInactiveUserDeletions.ts:29

src/lib/inactivity/jobs/scheduleInactivityWarnings.ts:29

medium Security checks software dependencies conf 0.90 ✓ Repobility 2 occurrences requirements.txt: `pytest` has no version pin

Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins.

lines 7, 8

create_deck/requirements.txt:7, 8 (2 hits)

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — src/services/NotionService/blocks/BlockParagraph.tsx:20

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — src/services/NotionService/blocks/lists/BlockToggleList.tsx:39

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — src/services/NotionService/helpers/getListItems.tsx:47

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — src/ui/pages/DownloadPage.tsx:39

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — web/src/pages/HomePage/ShowcaseSection.tsx:13

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — web/src/pages/PreviewPage/BlockNode.tsx:51

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/lib/mountWebBuild.test.ts:44

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/CheckoutRouter.test.ts:66

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/EmailRedirectRouter.test.ts:57

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/HealthRouter.test.ts:96

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/MindmapRouter.test.ts:123

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/ReEngagementRouter.test.ts:55

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/TransformRouter.test.ts:71

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/routes/WebhookRouter.test.ts:153

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/services/GA4Service.ts:22

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/generated/http-client.ts:71

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/lib/backend/api.ts:45

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/lib/backend/Backend.ts:385

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/lib/backend/getSharedDeck.ts:19

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/lib/backend/templates.ts:101

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/DownloadsPage/hooks/useActiveShares.ts:5

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/ImageOcclusionPage/ImageOcclusionPage.tsx:53

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/MindmapsPage/useMindmap.ts:109

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/FlagsTab.tsx:40

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/InterviewsTab.tsx:73

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/resolveErrorGroup.ts:2

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/useBusinessMetrics.ts:8

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/useConversionMetrics.ts:9

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/useOpsMetrics.ts:10

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/usePerformanceMetrics.ts:9

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/usePricingAbFunnel.ts:34

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/OpsPage/useUploadFunnel.ts:34

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/PhotoToFlashcardsPage/PhotoToFlashcardsPage.tsx:235

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/SuccessfulCheckout/hooks/useSubscriptionStatus.ts:24

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/TransformPage/TransformPage.tsx:186

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/UploadPage/components/RecentSources/getRecentSources.ts:16

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — web/src/pages/UploadPage/components/UploadForm/UploadForm.tsx:442

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Frontend route `/account/claim` has no Link/navigate to it — web/src/pages/AccountClaimPage/AccountClaimPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/answers/:slug` has no Link/navigate to it — web/src/pages/AnswersPage/AnswersPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/convert/:slug` has no Link/navigate to it — web/src/pages/ConvertLandingPage/ConvertLandingPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/documentation/*` has no Link/navigate to it — web/src/pages/DocsPage/DocContent.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/preview/:id` has no Link/navigate to it — web/src/pages/PreviewPage/PreviewPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/preview/database/:id` has no Link/navigate to it — web/src/pages/DatabasePreviewPage/DatabasePreviewPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/rules/:id` has no Link/navigate to it — web/src/pages/RulesPage/RulesPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/s/:token` has no Link/navigate to it — web/src/pages/SharedDeckPage/SharedDeckPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/templates/edit/:id` has no Link/navigate to it — web/src/pages/TemplatesPage/EditorPage.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 23 occurrences Frontend route `/uploads` has no Link/navigate to it — web/src/App.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

23 occurrences

repo-level (23 hits)

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `business` has no Link/navigate to it — web/src/pages/OpsPage/OpsLayout.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

3 files, 3 locations

.github/workflows/claude-code-review.yml

.github/workflows/claude.yml

.github/workflows/weekly-retro.yml

CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in src/services/NotionService/blocks/BlockParagraph.tsx:20

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/services/NotionService/blocks/BlockParagraph.tsx:20 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in src/services/NotionService/blocks/lists/BlockToggleList.tsx:39

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/services/NotionService/blocks/lists/BlockToggleList.tsx:39 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in src/services/NotionService/helpers/getListItems.tsx:47

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/services/NotionService/helpers/getListItems.tsx:47 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in src/ui/pages/DownloadPage.tsx:39

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/ui/pages/DownloadPage.tsx:39 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in web/src/pages/HomePage/ShowcaseSection.tsx:13

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

web/src/pages/HomePage/ShowcaseSection.tsx:13 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in web/src/pages/PreviewPage/BlockNode.tsx:51

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

web/src/pages/PreviewPage/BlockNode.tsx:51 Dangerous innerhtml

medium System graph network Security conf 1.00 Privileged port 16 in use

Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

.github/workflows/weekly-retro.yml Ports

medium System graph network Security conf 1.00 Privileged port 17 in use

Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

.github/workflows/weekly-retro.yml Ports

medium System graph network Security conf 1.00 Privileged port 18 in use

Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

.github/workflows/weekly-retro.yml Ports

low Security checks quality Quality conf 0.60 14 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

10 files, 14 locations

.claude/hooks/pre-write-secret-scan.py:5, 9, 10 (3 hits)

.claude/hooks/pre-bash-curl-pipe.py:10, 11 (2 hits)

.claude/hooks/safety.py:5, 11 (2 hits)

.claude/hooks/check-commit-message.py:27

.claude/hooks/check-duplicate-commit-message.py:13

.claude/hooks/check-merge-status.py:13

.claude/hooks/pre-push-typecheck.py:23

src/controllers/ShareController.ts:13

duplicationquality

low Security checks software dependencies conf 0.90 npm package `@anthropic-ai/sdk` is minor version(s) behind (^0.100.1 -> 0.101.0)

`@anthropic-ai/sdk` is pinned/resolved at ^0.100.1 but the latest stable release on the npm registry is 0.101.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rais…

package.json

low Security checks software dependencies conf 0.90 npm package `@notionhq/client` is minor version(s) behind (^5.18.0 -> 5.22.0)

`@notionhq/client` is pinned/resolved at ^5.18.0 but the latest stable release on the npm registry is 5.22.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `axios` is minor version(s) behind (^1.13.5 -> 1.17.0)

`axios` is pinned/resolved at ^1.13.5 but the latest stable release on the npm registry is 1.17.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `better-sqlite3` is minor version(s) behind (^12.9.0 -> 12.10.0)

`better-sqlite3` is pinned/resolved at ^12.9.0 but the latest stable release on the npm registry is 12.10.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `cheerio` is minor version(s) behind (^1.0.0 -> 1.2.0)

`cheerio` is pinned/resolved at ^1.0.0 but the latest stable release on the npm registry is 1.2.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `dotenv` is minor version(s) behind (17.2.3 -> 17.4.2)

`dotenv` is pinned/resolved at 17.2.3 but the latest stable release on the npm registry is 17.4.2 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `express` is minor version(s) behind (^5.1.0 -> 5.2.1)

`express` is pinned/resolved at ^5.1.0 but the latest stable release on the npm registry is 5.2.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `find-remove` is minor version(s) behind (^5.0.0 -> 5.1.1)

`find-remove` is pinned/resolved at ^5.0.0 but the latest stable release on the npm registry is 5.1.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `google-auth-library` is minor version(s) behind (^10.6.2 -> 10.7.0)

`google-auth-library` is pinned/resolved at ^10.6.2 but the latest stable release on the npm registry is 10.7.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rais…

package.json

low Security checks software dependencies conf 0.90 npm package `knex` is minor version(s) behind (^3.1.0 -> 3.2.10)

`knex` is pinned/resolved at ^3.1.0 but the latest stable release on the npm registry is 3.2.10 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `mammoth` is minor version(s) behind (^1.8.0 -> 1.12.0)

`mammoth` is pinned/resolved at ^1.8.0 but the latest stable release on the npm registry is 1.12.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `markdown-it` is minor version(s) behind (^14.1.1 -> 14.2.0)

`markdown-it` is pinned/resolved at ^14.1.1 but the latest stable release on the npm registry is 14.2.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `multer` is minor version(s) behind (^2.0.1 -> 2.1.1)

`multer` is pinned/resolved at ^2.0.1 but the latest stable release on the npm registry is 2.1.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `pg` is minor version(s) behind (^8.11.3 -> 8.21.0)

`pg` is pinned/resolved at ^8.11.3 but the latest stable release on the npm registry is 8.21.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `sql.js` is minor version(s) behind (^1.13.0 -> 1.14.1)

`sql.js` is pinned/resolved at ^1.13.0 but the latest stable release on the npm registry is 1.14.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt

low System graph software Dead code candidate conf 1.00 File has no detected symbols: .kanelrc.js