← Back to scan
File as GitHub Issue repo: Draigus/NBIAI-TEAM

Push this scan report to Draigus/NBIAI-TEAM

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Admin endpoint without auth: POST /api/admin/cleanse

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 [MINED107] Missing import: `gc` used but not imported: The file uses `gc.something(...)` … Clients/Couch Heroes/production/consoli…:406
CRIT SEC022 [SEC022] Database URL With Embedded Credential: A database connection URL contains an emb… prototypes/_fetch_data.js:2
CRIT MINED007 [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection. projects/news-aggregator/src/llm/client…:126
CRIT MINED114 [MINED114] Admin endpoint without auth: POST /api/admin/granola-sync: Express route on /a… dashboard-server/routes/admin.js:923
CRIT MINED114 [MINED114] Admin endpoint without auth: POST /api/admin/cleanse: Express route on /admin … dashboard-server/routes/admin.js:709
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… dashboard-server/routes/candidate-comme…:33
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… dashboard-server/routes/auth.js:18
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… dashboard-server/routes/attachments.js:134
HIGH SEC114 [SEC114] path.join / Path() on user-controlled segment without containment check: filepat… dashboard-server/routes/attachments.js:98
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… projects/news-aggregator/src/ingest/can…:8
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… dashboard-server/routes/attachments.js:171
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… dashboard-server/routes/milestones.js:47
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… dashboard-server/public/js/views/nbi-fo…:91
HIGH MINED021 [MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can co… _archive/nbiai_app/scripts/fix_dispatch…:5
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … scripts/fix_goals_worksage.py:5
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … fix_goals_acronyms.py:17
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … _archive/nbiai_app/scripts/fix_dispatch…:13
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… Clients/Couch Heroes/scripts/build_hour…:155
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… Clients/Couch Heroes/scripts/build_hour…:56
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… Clients/Couch Heroes/production/build_v…:18
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… .claude/skills/writing-skills/render-gr…:25
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… .agents/skills/writing-skills/render-gr…:25
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). dashboard-server/cron/dreaming/index.js:6
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). .claude/skills/brainstorming/scripts/se…:12
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). .agents/skills/brainstorming/scripts/se…:12
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … Clients/Couch Heroes/production/build_v…:260
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … .claude/skills/brainstorming/scripts/se…:190
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … .agents/skills/brainstorming/scripts/se…:190
HIGH COMP001 [COMP001] High cognitive complexity: Function `main` has cognitive complexity 54 (SonarSo… Clients/Couch Heroes/production/extract…:98
HIGH COMP001 [COMP001] High cognitive complexity: Function `build` has cognitive complexity 135 (Sonar… Clients/Couch Heroes/production/build_v…:20
HIGH DKR014 Dockerfile copies the entire context without .dockerignore _archive/nbiai_app/app/Dockerfile:13
HIGH MINED134 [MINED134] Binary file `Clients/Couch Heroes/production/__pycache__/build_v12_clean.cpyth… Clients/Couch Heroes/production/__pycac…:1
HIGH MINED134 [MINED134] Binary file `Clients/Couch Heroes/build_inputs/__pycache__/classify.cpython-31… Clients/Couch Heroes/build_inputs/__pyc…:1
HIGH MINED118 [MINED118] Dockerfile FROM `node:20-alpine` not pinned by digest: `FROM node:20-alpine` r… _archive/nbiai_app/app/Dockerfile:1
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… fix_goals_acronyms.py:21
HIGH JRN009 Secret-like setting is echoed into a password input value _archive/nbiai_app/app/client/src/pages…:380
HIGH MINED113 [MINED113] Express POST /api/expenses has no auth: Express route POST /api/expenses decla… dashboard-server/routes/expenses.js:147
HIGH MINED113 [MINED113] Express DELETE /api/expenses/categories/:id has no auth: Express route DELETE … dashboard-server/routes/expenses.js:43
HIGH MINED113 [MINED113] Express POST /api/expenses/categories has no auth: Express route POST /api/exp… dashboard-server/routes/expenses.js:34
HIGH MINED113 [MINED113] Express POST /api/leads/:id/activities has no auth: Express route POST /api/le… dashboard-server/routes/leads.js:604
HIGH MINED113 [MINED113] Express PUT /api/leads/:id/resources has no auth: Express route PUT /api/leads… dashboard-server/routes/leads.js:565
HIGH MINED113 [MINED113] Express DELETE /api/leads/:id has no auth: Express route DELETE /api/leads/:id… dashboard-server/routes/leads.js:550
HIGH MINED113 [MINED113] Express PATCH /api/leads/:id has no auth: Express route PATCH /api/leads/:id d… dashboard-server/routes/leads.js:442
HIGH MINED113 [MINED113] Express POST /api/leads has no auth: Express route POST /api/leads declared wi… dashboard-server/routes/leads.js:363
HIGH MINED113 [MINED113] Express DELETE /api/leads/field-options/:id has no auth: Express route DELETE … dashboard-server/routes/leads.js:134
HIGH MINED113 [MINED113] Express PATCH /api/leads/field-options/:id has no auth: Express route PATCH /a… dashboard-server/routes/leads.js:124
HIGH MINED113 [MINED113] Express POST /api/leads/field-options has no auth: Express route POST /api/lea… dashboard-server/routes/leads.js:111
HIGH MINED113 [MINED113] Express DELETE /api/leads/resource-types/:id has no auth: Express route DELETE… dashboard-server/routes/leads.js:98
HIGH MINED113 [MINED113] Express PATCH /api/leads/resource-types/:id has no auth: Express route PATCH /… dashboard-server/routes/leads.js:88
HIGH MINED113 [MINED113] Express POST /api/leads/resource-types has no auth: Express route POST /api/le… dashboard-server/routes/leads.js:75
HIGH MINED113 [MINED113] Express DELETE /api/leads/stages/:id has no auth: Express route DELETE /api/le… dashboard-server/routes/leads.js:65
HIGH MINED113 [MINED113] Express PATCH /api/leads/stages/:id has no auth: Express route PATCH /api/lead… dashboard-server/routes/leads.js:53
HIGH MINED113 [MINED113] Express POST /api/leads/stages has no auth: Express route POST /api/leads/stag… dashboard-server/routes/leads.js:40
HIGH MINED113 [MINED113] Express DELETE /api/teams/:id/members/:user_id has no auth: Express route DELE… dashboard-server/routes/teams.js:236
HIGH MINED113 [MINED113] Express PATCH /api/teams/:id/members/:user_id has no auth: Express route PATCH… dashboard-server/routes/teams.js:214
HIGH MINED113 [MINED113] Express POST /api/teams/:id/members has no auth: Express route POST /api/teams… dashboard-server/routes/teams.js:187
HIGH MINED113 [MINED113] Express DELETE /api/teams/:id has no auth: Express route DELETE /api/teams/:id… dashboard-server/routes/teams.js:170
HIGH MINED113 [MINED113] Express PATCH /api/teams/:id has no auth: Express route PATCH /api/teams/:id d… dashboard-server/routes/teams.js:134
HIGH MINED113 [MINED113] Express POST /api/teams has no auth: Express route POST /api/teams declared wi… dashboard-server/routes/teams.js:105
HIGH MINED113 [MINED113] Express PUT /api/settings/:key has no auth: Express route PUT /api/settings/:k… dashboard-server/routes/settings.js:25
HIGH MINED113 [MINED113] Express POST /api/internal/notifications has no auth: Express route POST /api/… dashboard-server/server.js:296
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. dashboard-server/public/js/nbi-idb.js:39
MED ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. dashboard-server/cron/dreaming/index.js:101
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … projects/news-aggregator/src/ingest/enr…:45
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … .agents/skills/writing-skills/render-gr…:25
MED COMP001 [COMP001] High cognitive complexity: Function `format_table` has cognitive complexity 23 … Clients/Couch Heroes/legal_compliance/b…:60
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED JRN002 Browser storage is used for session token material _archive/nbiai_app/app/client/src/lib/w…:36
MED DKR001 Docker final stage has no non-root USER _archive/nbiai_app/app/Dockerfile:30
MED AIC001 Parallel implementation file sits beside a canonical file Clients/Couch Heroes/production/build_v…:1
MED AGT007 localStorage write failures are swallowed silently _archive/nbiai_app/app/client/src/compo…:204
MED AIC004 Suspicious implementation file appears unreferenced dashboard-server/fix_usd_final.py:1
MED AIC004 Suspicious implementation file appears unreferenced Clients/Couch Heroes/scripts/audit_and_…:1
MED AIC004 Suspicious implementation file appears unreferenced Clients/Couch Heroes/production/_miro_s…:1
MED JRN005 Compliance or security claim is near a placeholder link company/knowledge/design-templates/web-…:529
MED AGT012 Agent control bridge may listen on a network interface without visible auth .claude/skills/brainstorming/scripts/st…:12
MED AGT012 Agent control bridge may listen on a network interface without visible auth .agents/skills/brainstorming/scripts/st…:12
MED CORE_NO_CI No CI/CD configuration found —
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… dashboard-server/cron/dreaming/achievem…:16
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… .claude/skills/brainstorming/scripts/se…:103
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… .agents/skills/brainstorming/scripts/se…:103
LOW AIC003 Duplicated implementation block across source files scripts/update_goals_fields.py:83
LOW AIC003 Duplicated implementation block across source files dashboard-server/verify_expenses.py:10
LOW AIC003 Duplicated implementation block across source files dashboard-server/verify_expenses.py:2
LOW AIC003 Duplicated implementation block across source files dashboard-server/routes/slack.js:78
LOW AIC003 Duplicated implementation block across source files dashboard-server/routes/documents.js:2
LOW AIC003 Duplicated implementation block across source files dashboard-server/redact_pdfs_v2.py:92
LOW AIC003 Duplicated implementation block across source files dashboard-server/redact_pdfs_v2.py:11
LOW AIC003 Duplicated implementation block across source files dashboard-server/public/js/nbi-themes.js:143
LOW AIC003 Duplicated implementation block across source files dashboard-server/fix_usd_dates.py:1
LOW AIC003 Duplicated implementation block across source files dashboard-server/fix_expenses.py:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/write_exce…:145
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/write_exce…:2
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/save_glen_…:56
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/save_glen_…:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/save_all_a…:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/classify.py:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/build_dedu…:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/build_ama_…:3
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/scripts/build_ama_…:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/save_glen_answers.…:1
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/production/qa_stri…:6
LOW AIC003 Duplicated implementation block across source files Clients/Couch Heroes/production/consoli…:458
LOW AIC003 Duplicated implementation block across source files .claude/harness/lib/write-guard.js:55
LOW AIC006 Archive or legacy directory is mixed into the active repository root _archive:1
LOW AIC005 Duplicate top-level symbol appears in a patch-style file Clients/Couch Heroes/scripts/audit_and_…:1
LOW AIC005 Duplicate top-level symbol appears in a patch-style file Clients/Couch Heroes/production/build_f…:1
LOW AIC005 Duplicate top-level symbol appears in a patch-style file dashboard-server/fix_usd_final.py:1
LOW AIC002 Source file name looks like an AI patch artifact dashboard-server/fix_usd_final.py:1
LOW AIC002 Source file name looks like an AI patch artifact Clients/Couch Heroes/scripts/audit_and_…:1
LOW AIC002 Source file name looks like an AI patch artifact Clients/Couch Heroes/production/build_f…:1
LOW AIC002 Source file name looks like an AI patch artifact Clients/Couch Heroes/production/_miro_s…:1
LOW CORE_NO_LICENSE No LICENSE file —
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. projects/news-aggregator/src/routes/adm…:15
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. projects/news-aggregator/src/ingest/fet…:26
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. projects/news-aggregator/src/auth/inter…:20
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. fix_goals_acronyms.py:21
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. dashboard-server/migrate-password-reset…:17
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. dashboard-server/init-db.js:197
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… _archive/nbiai_app/scripts/populate_age…:203
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… _archive/nbiai_app/scripts/fix_dispatch…:13
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… _archive/nbiai_app/scripts/create_dashb…:106
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… _archive/nbiai_app/app/client/src/pages…:196
INFO MINED077 [MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles. Clients/Couch Heroes/scripts/build_hour…:181
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… Clients/Couch Heroes/scripts/build_hour…:156
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … .claude/skills/brainstorming/scripts/se…:229
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … .agents/skills/writing-skills/render-gr…:78
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … .agents/skills/brainstorming/scripts/se…:229
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… .claude/skills/brainstorming/scripts/se…:342
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… .agents/skills/brainstorming/scripts/se…:342
INFO MINED098 [MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global win… .claude/skills/brainstorming/scripts/he…:65
INFO MINED098 [MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global win… .agents/skills/brainstorming/scripts/he…:65
Reset to top 5 132 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `Draigus/NBIAI-TEAM`

**Score: 75/100 (C+)**  ·  132 findings  ·  scanned 2026-06-16 04:21 UTC  ·  115,842 LOC

| Severity | Count |
|---|---|
| CRITICAL | 5 |
| HIGH | 56 |
| MEDIUM | 17 |
| LOW | 35 |

📊 [Full filterable report](https://repobility.com/scan/b4c7e08e-a031-4687-978b-7c5a2cef4cef/)  ·  ![scorecard](https://repobility.com/scan/b4c7e08e-a031-4687-978b-7c5a2cef4cef/report.png?v=1781583679-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `gc` used but not imported
   `Clients/Couch Heroes/production/consolidate_template_style.py:406` · ✓ Repobility
2. **CRITICAL** `SEC022` — Database URL With Embedded Credential
   `prototypes/_fetch_data.js:2` · A07:2021 Identification & Authentication Failures
3. **CRITICAL** `MINED007` — Sql String Concat
   `projects/news-aggregator/src/llm/client.ts:126` · CWE-89 · ✓ Repobility
4. **CRITICAL** `MINED114` — Admin endpoint without auth: POST /api/admin/granola-sync
   `dashboard-server/routes/admin.js:923` · ✓ Repobility
5. **CRITICAL** `MINED114` — Admin endpoint without auth: POST /api/admin/cleanse
   `dashboard-server/routes/admin.js:709` · ✓ Repobility

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/b4c7e08e-a031-4687-978b-7c5a2cef4cef/_
Megaproject â high spam risk
Could not determine 'Draigus/NBIAI-TEAM' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.