UNIFIED
Repobility · multi-layer engine · AI coders
Complete repo analysis
Last scanned 1 day, 10 hours ago
·
v3
·
119 findings from
2 sources.
Findings combine the legacy security pipeline AND the multi-layer engine
(atlas, wiring, flows, ranked) AND verified AI agent contributions.
{# ── 2026-05-17 R27 #5: score breakdown panel ──────────────────────
Surfaces the score_breakdown JSON that's been silently stored on
Repository for months. Turns hidden math into a trust signal. #}
Severity distribution — click a segment to filter
Top 10 actions, ranked by impact × ease.
Severity drives impact; tag-based fix-clarity drives ease.
#1
Possible secret in liquibase/src/main/java/org/openmrs/liquibase/CoreDataTuner.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in liquibase/src/main/java/org/openmrs/liquibase/CoreDataTuner.java:33; move to env var / secrets manager.
liquibase/src/main/java/org/openmrs/liquibase/CoreDataTuner.java:33
#2
Possible secret in api/src/main/java/org/openmrs/util/OpenmrsConstants.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in api/src/main/java/org/openmrs/util/OpenmrsConstants.java:1070; move to env var / secrets manager.
api/src/main/java/org/openmrs/util/OpenmrsConstants.java:1070
#3
Possible secret in api/src/main/java/org/openmrs/util/databasechange/SourceMySqldiffFile.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in api/src/main/java/org/openmrs/util/databasechange/SourceMySqldiffFile.java:53; move to env var / secrets manager.
api/src/main/java/org/openmrs/util/databasechange/SourceMySqldiffFile.java:53
#4
Possible secret in api/src/main/java/org/openmrs/api/db/hibernate/HibernateContextDAO.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in api/src/main/java/org/openmrs/api/db/hibernate/HibernateContextDAO.java:92; move to env var / secrets manager.
api/src/main/java/org/openmrs/api/db/hibernate/HibernateContextDAO.java:92
#5
Possible secret in web/src/main/java/org/openmrs/web/filter/initialization/DatabaseDetective.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in web/src/main/java/org/openmrs/web/filter/initialization/DatabaseDetective.java:28; move to env var / secrets manager.
web/src/main/java/org/openmrs/web/filter/initialization/DatabaseDetective.java:28
#6
Possible secret in web/src/main/java/org/openmrs/web/filter/initialization/TestInstallUtil.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in web/src/main/java/org/openmrs/web/filter/initialization/TestInstallUtil.java:71; move to env var / secrets manager.
web/src/main/java/org/openmrs/web/filter/initialization/TestInstallUtil.java:71
#7
Possible secret in web/src/main/java/org/openmrs/web/filter/initialization/InitializationWizardModel.java
GapSeverity.CRITICAL
Layer.SECURITY
score 1.000
Why: critical severity · a leaked credential is a worst-case bug · fix is short / mechanical
Fix: Rotate the credential and remove it from in web/src/main/java/org/openmrs/web/filter/initialization/InitializationWizardModel.java:40; move to env var / secrets manager.
web/src/main/java/org/openmrs/web/filter/initialization/InitializationWizardModel.java:40
#8
Insecure pattern 'eval_used' in api/src/main/java/org/openmrs/logic/Rule.java:33
GapSeverity.HIGH
Layer.SECURITY
score 0.413
Why: high severity · OWASP-class risk
api/src/main/java/org/openmrs/logic/Rule.java:33
#9
Insecure pattern 'eval_used' in webapp/src/main/webapp/WEB-INF/view/scripts/jquery/dataTables/js/jquery.dataTables.min.js:363
GapSeverity.HIGH
Layer.SECURITY
score 0.413
Why: high severity · OWASP-class risk
webapp/src/main/webapp/WEB-INF/view/scripts/jquery/dataTables/js/jquery.dataTables.min.js:363
#10
Insecure pattern 'eval_used' in webapp/src/main/webapp/WEB-INF/view/scripts/jquery-ui/js/jquery-ui.custom.min.js:726
GapSeverity.HIGH
Layer.SECURITY
score 0.413
Why: high severity · OWASP-class risk
webapp/src/main/webapp/WEB-INF/view/scripts/jquery-ui/js/jquery-ui.custom.min.js:726
Click "Find this gap" on any action above to jump to it on the Findings tab.
Adjust the chip bar to filter by impact (severity), layer, or source.
{# ── 2026-05-17 Round 14: AI-agent bridge footer ──────────────────────
Discoverability: the /agents/voting/ guide + MCP manifest exist but
aren't linked from anywhere users actually land. Small, opt-in footer. #}