Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

165 of your 228 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 6.42s · analysis 3.49s · 77.8 MB · GitHub API rate-limit (preflight)

Aider-AI/aider

https://github.com/Aider-AI/aider.git · scanned 2026-06-24 18:07 UTC (2 months, 2 weeks ago) · 10 languages

433 raw signals (220 security + 213 graph) 11/13 scanners ran 12th percentile · Python · medium (20-100K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 250 actionable findings from 2 signal sources. 183 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 165 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	100.0	0.25	25.00
`testing_score`	100.0	0.20	20.00
`documentation_score`	90.0	0.15	13.50
`practices_score`	89.0	0.15	13.35
`code_quality`	45.0	0.10	4.50
Overall		1.00	85.3

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: severity: critical × excluding tests × Reset all

Severity: Critical 8 High 42 Medium 64 Low 77 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 85 System graph 165 Crowd 0 Layer: Cicd 13 Software 35 Quality 93 Security 91 Frontend 3 Network 10 Hardware 5

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 47.7/100 with 100.0% coverage. It contains 2056 nodes across 1 cross-layer flows, written primarily in mixed languages. Engine surfaced 213 findings — concentrated in security (83), quality (53), cicd (34). Risk profile is high: 8 critical, 32 high, 70 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 8 of 250 actionable findings. 433 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2026-35030: litellm 1.82.3 — requirements.txt

litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses tok…

VulnCve 2026 35030

critical System graph security Trivy conf 1.00 CVE-2026-42208: litellm 1.82.3 — requirements.txt

LiteLLM: LiteLLM: Unauthorized data access and modification via SQL injection LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value i…

VulnCve 2026 42208

critical System graph security Trivy conf 1.00 CVE-2026-49468: litellm 1.82.3 — requirements.txt

LiteLLM: Authentication Bypass via Host Header Injection LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerability is fixed in 1.84.0. Package: litellm Installed: 1.82.3 Fixed in: 1.84.0 Severity: CRITICAL Fix: Upgrade litellm to 1.…

VulnCve 2026 49468

critical System graph security Secrets conf 1.00 Possible secret in aider/analytics.py

Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager.

aider/analytics.py:56

critical System graph security Semgrep conf 1.00 subprocess shell true — aider/commands.py:980

Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. Rule: py…

SecurityPython

critical System graph security Semgrep conf 1.00 subprocess shell true — aider/editor.py:134

Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. Rule: p…

SecurityPython

critical System graph security Semgrep conf 1.00 subprocess shell true — aider/io.py:1094

SecurityPython

critical System graph security Semgrep conf 1.00 subprocess shell true — aider/run_cmd.py:67

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. Rule: …

SecurityPython

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/bb1efda6-8d6f-4283-bc3a-3a3821e68b71/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/bb1efda6-8d6f-4283-bc3a-3a3821e68b71/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.