← Back to scan
File as GitHub Issue repo: latchbio/latch

Push this scan report to latchbio/latch

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

JS: child_process.exec with non-literal

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 Missing import: `queue` used but not imported src/latch_cli/services/k8s/develop.py:199
CRIT MINED107 Missing import: `queue` used but not imported src/latch_cli/centromere/ast_parsing.py:92
CRIT MINED107 Missing import: `array` used but not imported src/latch_cli/nextflow/parse_schema.py:439
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… src/latch_cli/services/launch/launch.py:49
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… src/latch_cli/services/k8s/execute.py:57
HIGH SEC113 [SEC113] SSH host-key verification disabled (MITM): Accepting any SSH host key on first c… src/latch_cli/services/k8s/develop.py:154
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… src/latch_cli/services/preview.py:206
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… src/latch_cli/menus.py:317
HIGH SEC032 [SEC032] Unrestricted File Upload — no extension/MIME validation: File upload accepts the… src/latch_cli/exceptions/traceback.py:24
HIGH MINED021 [MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can co… src/latch_cli/centromere/utils.py:139
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … src/latch_cli/nextflow/forch_register.py:106
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … src/latch/ldata/_transfer/progress.py:103
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… src/latch_cli/services/k8s/develop.py:217
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… src/latch/resources/launch_plan.py:62
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… src/latch/ldata/_transfer/download.py:82
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … src/latch_cli/services/get.py:51
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … src/latch_cli/nextflow/forch_register.py:162
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … src/latch/functions/messages.py:56
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/latch/ldata/_transfer/download.py:101
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/latch/functions/messages.py:56
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/latch/executions.py:174
HIGH MINED108 `self.load` used but never assigned in __init__ src/latch/registry/table.py:401
HIGH MINED108 `self.get_columns` used but never assigned in __init__ src/latch/registry/table.py:369
HIGH MINED108 `self.list_records` used but never assigned in __init__ src/latch/registry/table.py:361
HIGH MINED108 `self.get_columns` used but never assigned in __init__ src/latch/registry/table.py:257
HIGH MINED108 `self.load` used but never assigned in __init__ src/latch/registry/table.py:240
HIGH MINED108 `self.load` used but never assigned in __init__ src/latch/registry/table.py:212
HIGH MINED108 `self.load` used but never assigned in __init__ src/latch/registry/table.py:183
HIGH MINED108 `self.workspace_path` used but never assigned in __init__ src/latch_sdk_config/user.py:95
HIGH MINED108 `self.token_path` used but never assigned in __init__ src/latch_sdk_config/user.py:91
HIGH MINED108 `self.workspace_path` used but never assigned in __init__ src/latch_sdk_config/user.py:80
HIGH MINED108 `self.workspace_path` used but never assigned in __init__ src/latch_sdk_config/user.py:59
HIGH MINED108 `self.token_path` used but never assigned in __init__ src/latch_sdk_config/user.py:51
HIGH MINED108 `self.root` used but never assigned in __init__ src/latch_sdk_config/user.py:38
HIGH MINED108 `self.root` used but never assigned in __init__ src/latch_sdk_config/user.py:29
HIGH MINED108 `self._add_registry_projects_delete_selection` used but never assigned in __init__ src/latch/account.py:336
HIGH MINED108 `self._add_registry_projects_upsert_selection` used but never assigned in __init__ src/latch/account.py:334
HIGH MINED108 `self.clear` used but never assigned in __init__ src/latch/account.py:366
HIGH MINED108 `self.load` used but never assigned in __init__ src/latch/account.py:201
HIGH MINED108 `self.load` used but never assigned in __init__ src/latch/account.py:173
HIGH MINED106 Phantom test coverage: test_data_ls src/latch_cli/main.py:1749
HIGH MINED106 Phantom test coverage: test_data_remove src/latch_cli/main.py:1735
HIGH MINED106 Phantom test coverage: test_data_upload src/latch_cli/main.py:1720
HIGH MINED106 Phantom test coverage: test_data src/latch_cli/main.py:1703
HIGH MINED108 `self.url` used but never assigned in __init__ src/latch_cli/tinyrequests.py:59
HIGH MINED108 `self.status_code` used but never assigned in __init__ src/latch_cli/tinyrequests.py:59
HIGH MINED108 `self.status_code` used but never assigned in __init__ src/latch_cli/tinyrequests.py:55
HIGH MINED108 `self.status_code` used but never assigned in __init__ src/latch_cli/tinyrequests.py:57
HIGH MINED108 `self.status_code` used but never assigned in __init__ src/latch_cli/tinyrequests.py:54
HIGH MINED108 `self.content` used but never assigned in __init__ src/latch_cli/tinyrequests.py:28
HIGH MINED106 Phantom test coverage: test_account_jwt tests/fixtures.py:10
HIGH COMP001 [COMP001] High cognitive complexity: Function `combine` has cognitive complexity 28 (Sona… src/latch/functions/operators.py:142
HIGH DKR014 Dockerfile copies the entire context without .dockerignore src/latch_cli/services/init/example_sna…:19
HIGH DKR014 Dockerfile copies the entire context without .dockerignore src/latch_cli/services/init/example_nfc…:14
HIGH DKR006 Dockerfile pipes a remote script into a shell src/latch_cli/services/init/example_nfc…:10
HIGH MINED118 Dockerfile FROM `812206152185.dkr.ecr.us-west-2.amazonaws.com/latch-base:fe0b-main` not p… src/latch_cli/services/init/example_sna…:1
HIGH MINED118 Dockerfile FROM `812206152185.dkr.ecr.us-west-2.amazonaws.com/latch-base:fe0b-main` not p… src/latch_cli/services/init/example_nfc…:2
HIGH MINED115 Action `astral-sh/setup-uv` pinned to mutable ref `@v3` .github/workflows/test.yaml:16
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v2` .github/workflows/test.yaml:14
HIGH MINED118 Dockerfile FROM `alpine:3.12` not pinned by digest Dockerfile.docs:1
HIGH GHSA-8rrh-rw8j-w5fx wheel: GHSA-8rrh-rw8j-w5fx uv.lock
HIGH GHSA-gm62-xv2j-4w53 urllib3: GHSA-gm62-xv2j-4w53 uv.lock
HIGH GHSA-38jv-5279-wg99 urllib3: GHSA-38jv-5279-wg99 uv.lock
HIGH GHSA-2xpw-w6gg-jr37 urllib3: GHSA-2xpw-w6gg-jr37 uv.lock
HIGH PYSEC-2026-141 urllib3: PYSEC-2026-141 uv.lock
HIGH PYSEC-2026-179 pyjwt: PYSEC-2026-179 uv.lock
HIGH PYSEC-2026-178 pyjwt: PYSEC-2026-178 uv.lock
HIGH PYSEC-2026-177 pyjwt: PYSEC-2026-177 uv.lock
HIGH PYSEC-2026-176 pyjwt: PYSEC-2026-176 uv.lock
HIGH PYSEC-2026-175 pyjwt: PYSEC-2026-175 uv.lock
HIGH PYSEC-2026-120 pyjwt: PYSEC-2026-120 uv.lock
HIGH PYSEC-2025-183 pyjwt: PYSEC-2025-183 uv.lock
HIGH GHSA-jr27-m4p2-rc6r pyasn1: GHSA-jr27-m4p2-rc6r uv.lock
HIGH GHSA-63vm-454h-vhhq pyasn1: GHSA-63vm-454h-vhhq uv.lock
HIGH PYSEC-2022-42969 py: PYSEC-2022-42969 uv.lock
HIGH GHSA-8qvm-5x2c-j2w7 protobuf: GHSA-8qvm-5x2c-j2w7 uv.lock
HIGH GHSA-7gcm-g887-7qv7 protobuf: GHSA-7gcm-g887-7qv7 uv.lock
HIGH PYSEC-2026-107 orjson: PYSEC-2026-107 uv.lock
HIGH GHSA-58pv-8j8x-9vj2 jaraco-context: GHSA-58pv-8j8x-9vj2 uv.lock
HIGH GHSA-x2qx-6953-8485 gitpython: GHSA-x2qx-6953-8485 uv.lock
HIGH GHSA-v87r-6q3f-2j67 gitpython: GHSA-v87r-6q3f-2j67 uv.lock
HIGH GHSA-mv93-w799-cj2w gitpython: GHSA-mv93-w799-cj2w uv.lock
HIGH GHSA-7545-fcxq-7j24 gitpython: GHSA-7545-fcxq-7j24 uv.lock
HIGH GHSA-2mqj-m65w-jghx gitpython: GHSA-2mqj-m65w-jghx uv.lock
HIGH PYSEC-2024-4 gitpython: PYSEC-2024-4 uv.lock
HIGH GHSA-r6ph-v2qm-q3c2 cryptography: GHSA-r6ph-v2qm-q3c2 uv.lock
HIGH PYSEC-2026-36 cryptography: PYSEC-2026-36 uv.lock
HIGH PYSEC-2026-35 cryptography: PYSEC-2026-35 uv.lock
HIGH PYSEC-2023-239 asyncssh: PYSEC-2023-239 uv.lock
HIGH PYSEC-2023-237 asyncssh: PYSEC-2023-237 uv.lock
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… src/latch_cli/services/launch/launch.py:45
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… src/latch_cli/services/login.py:109
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … src/latch_cli/services/launch/launch.py:49
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … src/latch_cli/services/k8s/execute.py:57
MED SEC127 [SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as T… src/latch_cli/services/init/template/ta…:7
MED MINED111 Bare except continues silently src/latch_cli/services/launch/type_conv…:340
MED MINED109 Mutable default argument in `transform_types_in_variable_map` (dict) src/latch_cli/snakemake/workflow.py:269
MED MINED111 Bare except continues silently src/latch_cli/utils/__init__.py:259
MED MINED111 Bare except continues silently src/latch_cli/centromere/ctx.py:167
MED MINED111 Bare except continues silently src/latch_cli/services/local_dev_old.py:423
MED MINED111 Bare except continues silently src/latch_cli/nextflow/config.py:38
MED MINED109 Mutable default argument in `deseq2_wf` (list) src/latch/verified/deseq2.py:16
MED MINED111 Bare except continues silently src/latch_cli/main.py:1678
MED MINED109 Mutable default argument in `post` (dict) src/latch_cli/tinyrequests.py:198
MED MINED109 Mutable default argument in `put` (dict) src/latch_cli/tinyrequests.py:176
MED MINED109 Mutable default argument in `get` (dict) src/latch_cli/tinyrequests.py:154
MED MINED109 Mutable default argument in `request` (dict) src/latch_cli/tinyrequests.py:117
MED MINED109 Mutable default argument in `_req` (dict) src/latch_cli/tinyrequests.py:70
MED MINED111 Bare except continues silently src/latch_sdk_gql/execute.py:55
MED COMP001 [COMP001] High cognitive complexity: Function `group_tuple` has cognitive complexity 18 (… src/latch/functions/operators.py:79
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DEPCUR-GHA GitHub Action `astral-sh/setup-uv@v3` is 5 major version(s) behind (latest v8.2.0) .github/workflows/test.yaml:16
MED DEPCUR-GHA GitHub Action `actions/checkout@v2` is 4 major version(s) behind (latest v6.0.3) .github/workflows/test.yaml:14
MED GHSA-pq67-6m6q-mj2v urllib3: GHSA-pq67-6m6q-mj2v uv.lock
MED GHSA-gc5v-m9x4-r6x2 requests: GHSA-gc5v-m9x4-r6x2 uv.lock
MED GHSA-6w46-j5rx-g56g pytest: GHSA-6w46-j5rx-g56g uv.lock
MED GHSA-mrfv-m5wm-5w6w pynacl: GHSA-mrfv-m5wm-5w6w uv.lock
MED GHSA-428g-f7cq-pgp5 marshmallow: GHSA-428g-f7cq-pgp5 uv.lock
MED GHSA-65pc-fj4g-8rjx idna: GHSA-65pc-fj4g-8rjx uv.lock
MED GHSA-w8v5-vhqr-4h9v diskcache: GHSA-w8v5-vhqr-4h9v uv.lock
MED GHSA-hfmc-7525-mj55 asyncssh: GHSA-hfmc-7525-mj55 uv.lock
MED DKR001 Docker final stage has no non-root USER src/latch_cli/services/init/example_sna…:1
MED DKR001 Docker final stage has no non-root USER src/latch_cli/services/init/example_nfc…:2
MED DKR001 Docker final stage has no non-root USER Dockerfile.docs:1
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 12.5% of discovered … —
LOW COMP001 [COMP001] High cognitive complexity: Function `to_idl` has cognitive complexity 9 (SonarS… src/latch/idl/admin/launch_plan.py:107
LOW GHSA-5239-wwwm-4pmq pygments: GHSA-5239-wwwm-4pmq uv.lock
LOW GHSA-r374-rxx8-8654 paramiko: GHSA-r374-rxx8-8654 uv.lock
LOW AIC003 Duplicated implementation block across source files src/latch_cli/services/preview.py:86
LOW AIC003 Duplicated implementation block across source files src/latch_cli/services/k8s/execute.py:32
LOW AIC003 Duplicated implementation block across source files src/latch_cli/services/init/example_r/_…:7
LOW AIC003 Duplicated implementation block across source files src/latch/registry/table.py:158
LOW AIC003 Duplicated implementation block across source files src/latch/registry/project.py:194
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
LOW DKR010 Dockerfile leaves apt package indexes in the image layer src/latch_cli/services/init/example_nfc…:7
LOW DKR012 Dockerfile keeps pip download cache src/latch_cli/services/init/example_sna…:16
LOW DKR011 Dockerfile installs recommended OS packages src/latch_cli/services/init/example_nfc…:7
LOW DKR012 Dockerfile keeps pip download cache src/latch_cli/services/init/example_nfc…:3
LOW AIC005 Duplicate top-level symbol appears in a patch-style file src/latch_cli/services/local_dev_old.py:1
LOW AIC002 Source file name looks like an AI patch artifact src/latch_cli/services/local_dev_old.py:1
LOW AIC002 Source file name looks like an AI patch artifact src/latch/ldata/_transfer/remote_copy.py:1
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. src/latch_cli/snakemake/single_task_sna…:108
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. src/latch_cli/snakemake/serialize_utils…:139
INFO MINED077 [MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles. src/latch_cli/services/register/utils.py:201
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/latch/ldata/_transfer/utils.py:22
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… src/latch_cli/services/get.py:51
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… src/latch_cli/nextflow/forch_register.py:162
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… src/latch/functions/messages.py:56
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/latch/resources/launch_plan.py:63
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/latch/ldata/_transfer/download.py:83
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/latch/functions/messages.py:32
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. src/latch/idl/admin/launch_plan.py:18
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. src/latch/idl/admin/common.py:11
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. src/latch/account.py:54
Reset to top 5 155 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `latchbio/latch`

**Score: 60/100 (D+)**  ·  156 findings  ·  scanned 2026-06-05 19:37 UTC  ·  31,409 LOC

| Severity | Count |
|---|---|
| CRITICAL | 3 |
| HIGH | 88 |
| MEDIUM | 35 |
| LOW | 16 |

📊 [Full filterable report](https://repobility.com/scan/b86e022c-e18c-4345-8a54-afd7dc1b481d/)  ·  ![scorecard](https://repobility.com/scan/b86e022c-e18c-4345-8a54-afd7dc1b481d/report.png?v=1780688252-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `queue` used but not imported
   `src/latch_cli/services/k8s/develop.py:199` · ✓ Repobility
2. **CRITICAL** `MINED107` — Missing import: `queue` used but not imported
   `src/latch_cli/centromere/ast_parsing.py:92` · ✓ Repobility
3. **CRITICAL** `MINED107` — Missing import: `array` used but not imported
   `src/latch_cli/nextflow/parse_schema.py:439` · ✓ Repobility
4. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `src/latch_cli/services/launch/launch.py:49`
5. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `src/latch_cli/services/k8s/execute.py:57`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/b86e022c-e18c-4345-8a54-afd7dc1b481d/_
Megaproject â high spam risk
Could not determine 'latchbio/latch' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.