Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

4 of your 35 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 1.62s · analysis 3.6s · 0.3 MB · GitHub preflight 530ms

leadingproblemsolver/anynav

https://github.com/leadingproblemsolver/anynav/ · scanned 2026-06-19 14:52 UTC (1 month, 1 week ago) · 10 languages

44 raw signals (32 security + 12 graph) 56th percentile · Javascript · tiny (<2K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 1 week ago · v1 · 42 actionable findings from 2 signal sources. 2 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

55.6% cov · 12 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	48.7	0.25	12.18
`testing_score`	70.0	0.20	14.00
`documentation_score`	41.7	0.15	6.25
`practices_score`	72.0	0.15	10.80
`code_quality`	80.0	0.10	8.00
Overall		1.00	66.2

Severity distribution — click a segment to filter

Active filters: layer: software × excluding tests × Reset all

Severity: Critical 0 High 12 Medium 17 Low 11 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 30 System graph 12 Crowd 0 Layer: Quality 15 Software 21 Security 2 Frontend 3 Data 1

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 78.8/100 with 55.6% coverage. It contains 51 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 12 findings — concentrated in quality (7), frontend (3), data (1). Risk profile is low: 0 critical, 0 high, 6 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 21 of 42 actionable findings. 44 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks software dependencies conf 0.88 flatted: GHSA-25h7-pfq9-p65f

flatted vulnerable to unbounded recursion DoS in parse() revive phase

package-lock.json

high Security checks software dependencies conf 0.88 flatted: GHSA-rf6f-7fwh-wjgh

Prototype Pollution via parse() in NodeJS flatted

package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

package-lock.json

high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

package-lock.json

high Security checks software dependencies conf 0.88 rollup: GHSA-mw96-cpmx-2vgc

Rollup 4 has Arbitrary File Write via Path Traversal

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-fx2h-pf6j-xcff

vite: `server.fs.deny` bypass on Windows alternate paths

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

package-lock.json

high Security checks software dependencies conf 0.88 ws: GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

package-lock.json

medium Security checks software dependencies conf 0.88 ajv: GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

package-lock.json

medium Security checks software dependencies conf 0.88 js-yaml: GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

package-lock.json

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

package-lock.json

medium Security checks software dependencies conf 0.88 postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

package-lock.json

medium Security checks software dependencies conf 0.88 protocol-buffers-schema: GHSA-j452-xhg8-qg39

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

package-lock.json

medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

package-lock.json

medium Security checks software dependencies conf 0.88 vite: GHSA-v6wh-96g9-6wx3

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

package-lock.json

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

package-lock.json

low Security checks software dependencies conf 0.88 @babel/core: GHSA-4x5r-pxfx-6jf8

@babel/core: Arbitrary File Read via sourceMappingURL Comment

package-lock.json

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/b4ed8688-d9cb-4b4c-9044-457f7e25cfc5/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/b4ed8688-d9cb-4b4c-9044-457f7e25cfc5/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.