FilenCloudDienste/filen-rs

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

50 of your 162 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.69s · analysis 18.02s · 7.5 MB · GitHub API rate-limit (preflight)

https://github.com/FilenCloudDienste/filen-rs · scanned 2026-06-05 13:28 UTC (5 days, 6 hours ago) · 10 languages

240 raw signals (150 security + 90 graph) 0th percentile · Rust · medium (20-100K LoC) System graph score 63 (lower by 9)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 6 hours ago · v2 · 116 actionable findings from 2 signal sources. 79 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 21 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	45.3	0.25	11.32
`testing_score`	30.0	0.20	6.00
`documentation_score`	58.8	0.15	8.82
`practices_score`	87.0	0.15	13.05
`code_quality`	60.9	0.10	6.09
Overall		1.00	54.3

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 4 High 38 Medium 30 Low 26 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 95 System graph 21 Crowd 0 Layer: Quality 26 Software 65 Cicd 12 Security 4 Api 1 Frontend 3 Data 1 Hardware 4

Exclude dismissed / FP Exclude test files

Scan summary Quality grade C- (54/100). Dimensions: security 45, maintainability 60. 150 findings (76 security). 81,093 lines analyzed.

Showing 98 of 116 actionable findings. 195 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks security secrets conf 0.95 Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Gitleaks detected a committed secret or credential pattern.

.claude/skills/security/SKILL.md:192

critical Security checks software dependencies conf 0.88 vitest: GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

filen-sdk-rs/web/package-lock.json

critical System graph security Secrets conf 1.00 3 occurrences Possible secret in .github/workflows/ci.yml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 63, 104, 166

.github/workflows/ci.yml:63, 104, 166 (3 hits)

critical System graph security Secrets conf 1.00 Possible secret in filen-cli/src/auth.rs

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

filen-cli/src/auth.rs:243

high Security checks software dependencies conf 0.88 @babel/plugin-transform-modules-systemjs: GHSA-fv7c-fp4j-7gwp

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 @isaacs/brace-expansion: GHSA-7h2j-956f-4vf2

@isaacs/brace-expansion has Uncontrolled Resource Consumption

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 bytes: RUSTSEC-2026-0007

Integer overflow in `BytesMut::reserve`

Cargo.lock

high Security checks software dependencies conf 0.90 ✓ Repobility 2 occurrences Dockerfile FROM `rust:1.91.0-slim` not pinned by digest

`FROM rust:1.91.0-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

lines 3, 21

filen-cli/Dockerfile:3, 21 (2 hits)

high Security checks software dependencies conf 0.88 dotenv: RUSTSEC-2021-0141

dotenv is Unmaintained

Cargo.lock

high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6

fast-uri vulnerable to path traversal via percent-encoded dot segments

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 fxhash: RUSTSEC-2025-0057

fxhash - no longer maintained

Cargo.lock

high Security checks cicd CI/CD security conf 0.90 ✓ Repobility 7 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `dtolnay/rust-toolchain` pinned to mutable ref `@master` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

3 files, 7 locations

.github/workflows/ci.yml:20, 75, 117, 179 (4 hits)

.github/workflows/test.yml:39, 91 (2 hits)

.github/workflows/npm-publish.yml:22

CI/CD securitySupply chainGitHub Actions

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 24 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 24 locations

.github/workflows/ci.yml:17, 72, 114, 129, 176, 185, 213, 217 (10 hits)

.github/workflows/npm-publish.yml:19, 27, 55 (6 hits)

.github/workflows/release-cli.yml:136, 199, 209, 230 (4 hits)

.github/workflows/test.yml:36, 88, 109 (4 hits)

CI/CD securitySupply chainGitHub Actions

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 16 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `taiki-e/cache-cargo-install-action` pinned to mutable ref `@v2` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 16 locations

.github/workflows/ci.yml:50, 134, 140, 190 (6 hits)

.github/workflows/release-cli.yml:29, 147, 156, 174, 239 (5 hits)

.github/workflows/npm-publish.yml:32, 44, 51 (4 hits)

.github/workflows/test.yml:101

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 lodash: GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 openssl: GHSA-8c75-8mhr-p7r9

rust-openssl has incorrect bounds assertion in aes key wrap

Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-ghm9-cr32-g9qj

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-hppc-g8h3-xhp3

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-pqf5-4pqq-29f5

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

Cargo.lock

high Security checks software dependencies conf 0.88 openssl: GHSA-xp3w-r5p5-63rr

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

Cargo.lock

high Security checks software dependencies conf 0.90 ✓ Repobility package.json dep `uniffi-bindgen-react-native` pulled from URL/Git

`dependencies.uniffi-bindgen-react-native` = `github:Enduriel/uniffi-bindgen-react-native#e0282ad3eb972eaea74225dcc06247b7a67204dd` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or git host is compromised, every `npm install` pulls the new p…

filen-sdk-rs/web/package.json:1

high Security checks software dependencies conf 0.88 paste: RUSTSEC-2024-0436

paste - no longer maintained

Cargo.lock

high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 quinn-proto: RUSTSEC-2026-0037

Denial of service in Quinn endpoints

Cargo.lock

high Security checks software dependencies conf 0.88 rand: RUSTSEC-2026-0097

Rand is unsound with a custom logger using `rand::rng()`

Cargo.lock

high Security checks software dependencies conf 0.88 rollup: GHSA-mw96-cpmx-2vgc

Rollup 4 has Arbitrary File Write via Path Traversal

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 rsa: RUSTSEC-2023-0071

Marvin Attack: potential key recovery through timing sidechannels

Cargo.lock

high Security checks software dependencies conf 0.88 rustls-pemfile: RUSTSEC-2025-0134

rustls-pemfile is unmaintained

Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0049

CRLs not considered authoritative by Distribution Point due to faulty matching logic

Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0098

Name constraints for URI names were incorrectly accepted

Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0099

Name constraints were accepted for certificates asserting a wildcard name

Cargo.lock

high Security checks software dependencies conf 0.88 rustls-webpki: RUSTSEC-2026-0104

Reachable panic in certificate revocation list parsing

Cargo.lock

high Security checks software dependencies conf 0.88 serialize-javascript: GHSA-5c6j-r48x-rmvq

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

filen-sdk-rs/web/package-lock.json

high System graph cicd CI/CD security conf 1.00 GitHub Action tracks a moving branch

dtolnay/rust-toolchain@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/release-cli.yml:82 CI/CD securitySupply chainGithub actions

medium Security checks software dependencies conf 0.88 ajv: GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 bn.js: GHSA-378v-28hj-76wf

bn.js affected by an infinite loop

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

filen-sdk-rs/web/package-lock.json

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

filen-cli/Dockerfile:22 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.94 Dockerfile base image uses the latest tag

The latest tag is mutable and can change without a code review, producing different images from the same source.

filen-cli/Dockerfile:22 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore

COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts.

filen-cli/Dockerfile:9 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.90 Dockerfile installs dependencies after copying the full source tree

When dependency installation comes after COPY ., any source change invalidates the dependency layer and makes Docker rebuild much more slowly.

filen-cli/Dockerfile:11 CI/CD securitycontainers

medium Security checks software dependencies conf 0.88 lodash: GHSA-f23m-r3pf-42rh

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 lodash: GHSA-xxjr-mmjv-4gpg

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 openssl: GHSA-phqj-4mhp-q6mq

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

Cargo.lock

medium Security checks software dependencies conf 0.88 openssl: GHSA-xv59-967r-8726

rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding

Cargo.lock

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

filen-sdk-rs/web/package-lock.json

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 qs: GHSA-6rw7-vpxm-498p

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 qs: GHSA-q8mj-m7cp-5q26

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

filen-sdk-rs/web/package-lock.json

high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell

Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.

filen-cli/README.md:22

high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell

Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.

.github/workflows/release-cli.yml:119

medium Security checks software dependencies conf 0.88 serialize-javascript: GHSA-qj8w-gfj5-8c6v

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

filen-sdk-rs/web/package-lock.json

medium Security checks quality Quality conf 0.72 Service worker is present without a web app manifest

A service worker without a manifest often means the PWA install surface is incomplete or inconsistent across devices.

manifest.json

medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced

A file created as a fixed/new/final/copy variant is not referenced by imports or path-like strings in the rest of the repository. This is a strong sign that an agent produced code beside the active application path.

filen-types/src/api/v3/chat/last_focus_update.rs:1

medium Security checks software dependencies conf 0.88 uuid: GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

filen-sdk-rs/web/package-lock.json

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

filen-sdk-rs/web/package-lock.json

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — filen-sdk-rs/web/main.test.ts:579

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: alpine:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

filen-cli/Dockerfile:21 containersPinned dependencies

medium System graph hardware Security conf 1.00 Dockerfile runs as root: filen-cli/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release-cli.yml CI/CD securitySupply chainGithub actions

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

auth

medium System graph data Coverage conf 1.00 ORM models found but no DB engine detected

The repo defines tables/models but no DB connection string was found. Likely lives in env vars or a config file the scanner didn't read.

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

26 test file(s) for 559 source file(s) (ratio 0.05). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.72 Dockerfile installs recommended OS packages

Installing recommended packages often pulls in unnecessary runtime surface area.

filen-cli/Dockerfile:5 CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.74 Dockerfile leaves apt package indexes in the image layer

Package indexes increase image size and can expose stale metadata in the final image layer.

filen-cli/Dockerfile:5 CI/CD securitycontainers

low Security checks quality Quality conf 0.60 20 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 16 locations

filen-sdk-rs/src/api/v3/shared/in_uuid.rs:2, 3 (2 hits)

filen-sdk-rs/src/api/v3/shared/out_root.rs:2, 3 (2 hits)

filen-sdk-rs/src/api/v3/shared/out_uuid.rs:2, 3 (2 hits)

filen-sdk-rs/src/auth/v3.rs:37, 60 (2 hits)

filen-mobile-native-cache/src/sql/file.rs:172

filen-sdk-rs/src/api/v3/dir/download/mod.rs:5

filen-sdk-rs/src/api/v3/dir/download/shared.rs:3

filen-sdk-rs/src/api/v3/dir/link/content.rs:2

duplicationquality

low Security checks software dependencies conf 0.88 elliptic: GHSA-848j-6mx2-7j84

Elliptic Uses a Cryptographic Primitive with a Risky Implementation

filen-sdk-rs/web/package-lock.json

low Security checks software dependencies conf 0.90 2 occurrences npm package `@vitest/browser-playwright` is minor version(s) behind (4.0.14 -> 4.1.8)

`@vitest/browser-playwright` is pinned/resolved at 4.0.14 but the latest stable release on the npm registry is 4.1.8 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs…

2 occurrences

filen-sdk-rs/web/package.json (2 hits)

low Security checks software dependencies conf 0.90 npm package `vite-plugin-node-polyfills` is minor version(s) behind (0.24.0 -> 0.28.0)

`vite-plugin-node-polyfills` is pinned/resolved at 0.24.0 but the latest stable release on the npm registry is 0.28.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PR…

filen-sdk-rs/web/package.json

low Security checks software dependencies conf 0.90 npm package `vite-plugin-pwa` is minor version(s) behind (1.2.0 -> 1.3.0)

`vite-plugin-pwa` is pinned/resolved at 1.2.0 but the latest stable release on the npm registry is 1.3.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

filen-sdk-rs/web/package.json

low Security checks software dependencies conf 0.90 npm package `vite-plugin-wasm` is minor version(s) behind (3.5.0 -> 3.6.0)

`vite-plugin-wasm` is pinned/resolved at 3.5.0 but the latest stable release on the npm registry is 3.6.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

filen-sdk-rs/web/package.json

low Security checks software dependencies conf 0.88 openssl: GHSA-xmgf-hq76-4vx2

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

Cargo.lock

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt

low Security checks quality Quality conf 0.74 Public web app has no robots.txt

Public websites should publish a robots.txt file so crawlers and AI agents can discover crawl rules and sitemap locations without guessing.

robots.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml

low Security checks software dependencies conf 0.88 qs: GHSA-w7fw-mjwx-w883

qs's arrayLimit bypass in comma parsing allows denial of service

filen-sdk-rs/web/package-lock.json

low Security checks software dependencies conf 0.88 rsa: GHSA-9c48-w39g-hm26

rsa crate has potential panic on a prime being equal to 1

Cargo.lock

high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact

Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area.

filen-types/src/api/v3/chat/last_focus_update.rs:1

low System graph quality Maintenance conf 1.00 36 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: rust:1.91.0-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

filen-cli/Dockerfile:3 containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: filen-sdk-rs/web/filen-sdk-worker-thread.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: filen-sdk-rs/web/vite.config.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: filen-sdk-rs/web/vitest.config.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — filen-sdk-rs/web/main.test.ts:22

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — filen-sdk-rs/web/sw.ts:7

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph quality Complexity conf 1.00 Very large file: filen-mobile-native-cache/tests/db_tests.rs (4487 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/c5c5e713-0c21-4ec4-b223-ed492bd4a54b/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/c5c5e713-0c21-4ec4-b223-ed492bd4a54b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.