Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

17 of your 129 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.87s · analysis 23.75s · 3.3 MB · GitHub API rate-limit (preflight)

0Calories/hibana

https://github.com/0Calories/hibana · scanned 2026-06-16 03:37 UTC (2 months ago) · 10 languages

154 raw signals (129 security + 25 graph) 14th percentile · Typescript · small (2-20K LoC) System graph score 68 (lower by 8)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months ago · v1 · 134 actionable findings from 2 signal sources. 20 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 20 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	50.9	0.25	12.72
`testing_score`	25.0	0.20	5.00
`documentation_score`	40.1	0.15	6.01
`practices_score`	87.0	0.15	13.05
`code_quality`	76.8	0.10	7.68
Overall		1.00	59.5

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 42 Medium 58 Low 18 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 114 System graph 20 Crowd 0 Layer: Quality 26 Security 3 Software 96 Cicd 3 Frontend 6

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 67.5/100 with 88.9% coverage. It contains 738 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 25 findings — concentrated in quality (12), frontend (6), cicd (6). Risk profile is low: 0 critical, 0 high, 12 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 117 of 134 actionable findings. 154 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks software dependencies conf 0.88 @hono/node-server: GHSA-wc8c-qw6v-h7f6

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @isaacs/brace-expansion: GHSA-7h2j-956f-4vf2

@isaacs/brace-expansion has Uncontrolled Resource Consumption

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @modelcontextprotocol/sdk: GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 @modelcontextprotocol/sdk: GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6

fast-uri vulnerable to path traversal via percent-encoded dot segments

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 hono: GHSA-3vhc-576x-3qv4

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 hono: GHSA-f67f-6cw9-8mq4

Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 hono: GHSA-q5qw-h33p-qvwr

Hono vulnerable to arbitrary file access via serveStatic vulnerability

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 minimatch: GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 minimatch: GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 minimatch: GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 next: GHSA-267c-6grr-h53f

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-26hh-7cqf-hhc6

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-36qx-fr4f-26g5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-492v-c6pp-mqqv

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-8h8q-6873-q5fj

Next.js Vulnerable to Denial of Service with Server Components

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-c4j6-fc7j-m34r

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-h25m-26qc-wcjf

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-mg66-mrh9-m8jx

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

package-lock.json

high Security checks software dependencies conf 0.88 next: GHSA-q4gf-8mx6-v5v3

Next.js has a Denial of Service with Server Components

package-lock.json

high Security checks software dependencies conf 0.88 path-to-regexp: GHSA-j3q9-mxjg-w52f

path-to-regexp vulnerable to Denial of Service via sequential optional groups

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-83g3-92jg-28cx

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-8qq5-rm4j-mr97

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-9ppj-qmqm-q256

node-tar Symlink Path Traversal via Drive-Relative Linkpath

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-qffp-2rhf-9h96

tar has Hardlink Path Traversal via Drive-Relative Linkpath

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 tar: GHSA-r6q2-hw4h-h46w

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

pnpm-lock.yaml

high Security checks software dependencies conf 0.88 ws: GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 @hono/node-server: GHSA-92pp-h63x-v22m

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 @opentelemetry/core: GHSA-8988-4f7v-96qf

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

pnpm-lock.yaml

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

medium Security checks software dependencies conf 0.88 ajv: GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2

brace-expansion: Large numeric range defeats documented `max` DoS protection

pnpm-lock.yaml

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 6 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `supabase/setup-cli` pinned to mutable ref `@v2` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

3 files, 6 locations

.github/workflows/migrations-ci.yml:58 (2 hits)

.github/workflows/migrations-deploy.yml:27 (2 hits)

.github/workflows/playwright.yml:63 (2 hits)

CI/CD securitySupply chainGitHub Actions

medium Security checks software dependencies conf 0.88 hono: GHSA-26pp-8wgv-hjvm

Hono missing validation of cookie name on write path in setCookie()

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-2gcr-mfcq-wcc3

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-3hrh-pfw6-9m5x

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-458j-xx4x-4375

hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-5pq2-9x2x-5p6w

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-69xw-7hcm-h432

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-6wqw-2p9w-4vw4

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-9r54-q6cx-xmh5

Hono vulnerable to XSS through ErrorBoundary component

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-9vqf-7f2p-gf9v

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-f577-qrjj-4474

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-p6xx-57qc-3wxr

Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-p77w-8qqv-26rm

Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-qp7p-654g-cw7p

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-r354-f388-2fhh

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-r5rp-j6wh-rvv4

Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-v8w9-8mx6-g223

Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-w332-q679-j88p

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-wmmm-f939-6g9c

Hono: Middleware bypass via repeated slashes in serveStatic

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-xf4j-xp2r-rqqx

Hono: Path traversal in toSSG() allows writing files outside the output directory

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-xpcf-pg52-r92g

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 hono: GHSA-xrhx-7g5j-rcj5

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 js-yaml: GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 next-intl: GHSA-4c35-wcg5-mm9h

next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 next-intl: GHSA-8f24-v5vv-gm5j

next-intl has an open redirect vulnerability

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 next: GHSA-3x4c-7xq6-9pq8

Next.js: Unbounded next/image disk cache growth can exhaust storage

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-5f7q-jpqc-wp7h

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-9g9p-9gw9-jx7f

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-ffhc-5mcf-pf4q

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-ggv3-7p47-pfv8

Next.js: HTTP request smuggling in rewrites

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-gx5p-jg67-6x7h

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-h27x-g6w4-24gq

Next.js: Unbounded postponed resume buffering can lead to DoS

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-h64f-5h5j-jqjh

Next.js has a Denial of Service in the Image Optimization API

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-mq59-m269-xvcx

Next.js: null origin can bypass Server Actions CSRF checks

package-lock.json

medium Security checks software dependencies conf 0.88 next: GHSA-wfc6-r584-vfw7

Next.js vulnerable to cache poisoning in React Server Component responses

package-lock.json

high Security checks software dependencies conf 0.90 npm package `@vercel/analytics` is 1 major version(s) behind (^1.6.1 -> 2.0.1)

`@vercel/analytics` is pinned/resolved at ^1.6.1 but the latest stable release on the npm registry is 2.0.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@vercel/speed-insights` is 1 major version(s) behind (^1.3.1 -> 2.0.0)

`@vercel/speed-insights` is pinned/resolved at ^1.3.1 but the latest stable release on the npm registry is 2.0.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs r…

package.json

high Security checks software dependencies conf 0.90 npm package `lint-staged` is 1 major version(s) behind (^16.4.0 -> 17.0.7)

`lint-staged` is pinned/resolved at ^16.4.0 but the latest stable release on the npm registry is 17.0.7 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `shadcn` is 1 major version(s) behind (^3.6.2 -> 4.11.0)

`shadcn` is pinned/resolved at ^3.6.2 but the latest stable release on the npm registry is 4.11.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.88 path-to-regexp: GHSA-27v5-c462-wpq7

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 2 occurrences postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

2 files, 2 locations

package-lock.json

pnpm-lock.yaml

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 qs: GHSA-6rw7-vpxm-498p

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 qs: GHSA-q8mj-m7cp-5q26

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 tar: GHSA-vmf3-w455-68vh

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

pnpm-lock.yaml

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

pnpm-lock.yaml

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — app/(marketing)/page.tsx:48

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .mcp.json

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.mcp.json VerificationMcp config

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: CLAUDE.md

CLAUDE.md VerificationClaude instruction

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in app/(marketing)/page.tsx:48

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

app/(marketing)/page.tsx:48 Dangerous innerhtml

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 21 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

6 test file(s) for 157 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks software dependencies conf 0.88 @babel/core: GHSA-4x5r-pxfx-6jf8

@babel/core: Arbitrary File Read via sourceMappingURL Comment

pnpm-lock.yaml

low Security checks security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

low Security checks software dependencies conf 0.88 diff: GHSA-73rr-hh4g-fpgx

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

pnpm-lock.yaml

low Security checks quality Quality conf 0.60 5 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

5 files, 5 locations

app/(app)/flames/components/flame-card/flames/Supernova.tsx:1

app/(app)/flames/schedule/components/dialog/FuelSlider.tsx:210

app/(auth)/signup/form.tsx:6

app/(marketing)/components/ShowcaseFuelBar.tsx:97

app/(marketing)/twitter-image.tsx:1

duplicationquality

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 11 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v6` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 11 locations

.github/workflows/playwright.yml:49, 53, 77, 93, 108 (7 hits)

.github/workflows/lint.yml:14, 18 (2 hits)

.github/workflows/migrations-ci.yml:19

.github/workflows/migrations-deploy.yml:24

CI/CD securitySupply chainGitHub Actions

low Security checks software dependencies conf 0.88 hono: GHSA-gq3j-xvxp-8hrf

Hono added timing comparison hardening in basicAuth and bearerAuth

pnpm-lock.yaml

low Security checks software dependencies conf 0.88 hono: GHSA-hm8q-7f3q-5f36

Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

pnpm-lock.yaml

low Security checks software dependencies conf 0.88 next: GHSA-3g8h-86w9-wvmq

Next.js's Middleware / Proxy redirects can be cache-poisoned

package-lock.json

low Security checks software dependencies conf 0.88 next: GHSA-jcc7-9wpm-mj36

Next.js: null origin can bypass dev HMR websocket CSRF checks

package-lock.json

low Security checks software dependencies conf 0.88 next: GHSA-vfv6-92ff-j949

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

package-lock.json

low Security checks quality Documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

high Security checks software dependencies conf 0.90 npm package `@base-ui/react` is minor version(s) behind (^1.0.0 -> 1.5.0)

`@base-ui/react` is pinned/resolved at ^1.0.0 but the latest stable release on the npm registry is 1.5.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@biomejs/biome` is minor version(s) behind (2.2.0 -> 2.5.0)

`@biomejs/biome` is pinned/resolved at 2.2.0 but the latest stable release on the npm registry is 2.5.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@hookform/resolvers` is minor version(s) behind (^5.2.2 -> 5.4.0)

`@hookform/resolvers` is pinned/resolved at ^5.2.2 but the latest stable release on the npm registry is 5.4.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@supabase/ssr` is minor version(s) behind (^0.8.0 -> 0.12.0)

`@supabase/ssr` is pinned/resolved at ^0.8.0 but the latest stable release on the npm registry is 0.12.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `next-intl` is minor version(s) behind (^4.7.0 -> 4.13.0)

`next-intl` is pinned/resolved at ^4.7.0 but the latest stable release on the npm registry is 4.13.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `radix-ui` is minor version(s) behind (^1.4.3 -> 1.6.0)

`radix-ui` is pinned/resolved at ^1.4.3 but the latest stable release on the npm registry is 1.6.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `tailwind-merge` is minor version(s) behind (^3.4.0 -> 3.6.0)

`tailwind-merge` is pinned/resolved at ^3.4.0 but the latest stable release on the npm registry is 3.6.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml

low Security checks software dependencies conf 0.88 qs: GHSA-w7fw-mjwx-w883

qs's arrayLimit bypass in comma parsing allows denial of service

pnpm-lock.yaml

low System graph quality License conf 1.00 No license file detected

No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.

Repo hardeningGenerated repo pattern

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

package.json CI/CD securitySupply chainNpm

low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence

The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.

Git historyGenerated repo pattern

high Security checks software dependencies conf 0.90 npm package `resend` is patch version(s) behind (^6.12.3 -> 6.12.4)

`resend` is pinned/resolved at ^6.12.3 but the latest stable release on the npm registry is 6.12.4 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/c379bf88-31d3-42ba-9a54-669acfff8574/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/c379bf88-31d3-42ba-9a54-669acfff8574/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.