Apicurio/apicurio-registry

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

100 of your 471 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 22.3s · analysis 27.5s · 42.1 MB · GitHub API rate-limit (preflight)

https://github.com/Apicurio/apicurio-registry · scanned 2026-06-05 13:09 UTC (1 week, 2 days ago) · 10 languages

1045 raw signals (429 security + 616 graph) 11/13 scanners ran 93rd percentile · Java · large (100-500K LoC) System graph score 73 (higher by 12)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 week, 2 days ago · v2 · 223 actionable findings from 2 signal sources. 513 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 152 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	100.0	0.25	25.00
`testing_score`	80.0	0.20	16.00
`documentation_score`	88.0	0.15	13.20
`practices_score`	73.0	0.15	10.95
`code_quality`	78.0	0.10	7.80
Overall		1.00	85.7

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: severity: high × excluding tests × Reset all

Severity: Critical 9 High 17 Medium 36 Low 89 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 71 System graph 152 Crowd 0 Layer: Security 24 Cicd 26 Quality 58 Software 56 Frontend 42 Network 1 Hardware 16

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Ranks in the 38th percentile among large-sized repos. Strongest testing (75), documentation (72); weakest security (55), practices (58). 100 findings (8 critical, 2 high). Most common pattern: cpp-new-without-delete.

Showing 16 of 223 actionable findings. 736 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /agents/{groupId}/{artifactId}.

Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.

app/src/main/java/io/apicurio/registry/rest/wellknown/WellKnownResource.java:62

Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.

app/src/main/java/io/apicurio/registry/rest/wellknown/WellKnownResource.java:103

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED036] Python Os System Call: os.system() invokes shell with no escaping.

Review and fix per the pattern semantics. See CWE-78 / for context.

python-sdk/kiota-gen.py:86

high Security checks software dependencies conf 0.90 ✓ Repobility 17 occurrences [MINED118] Dockerfile FROM `registry.access.redhat.com/ubi10/openjdk-21-runtime:latest` not pinned by digest: `FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:latest` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Replace with: `FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:latest@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).

12 files, 14 locations

support-chat/huggingface/Dockerfile:1, 2, 3 (3 hits)

distro/docker/src/main/docker/Dockerfile.jvm:1

distro/gitops/Dockerfile:1

docs-playbook/Dockerfile:4

examples/debezium-otel-tracing/cdc-consumer/Dockerfile:3

examples/debezium-otel-tracing/debezium-server/Dockerfile:1

examples/debezium-otel-tracing/order-service/Dockerfile:3

examples/otel-tracing/consumer/Dockerfile:3

high Security checks software dependencies conf 0.90 ✓ Repobility [MINED134] Binary file `.mvn/wrapper/maven-wrapper.jar` committed in source repo: `.mvn/wrapper/maven-wrapper.jar` is a .jar binary (50,710 bytes) committed to a repo that otherwise has 2958 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

.mvn/wrapper/maven-wrapper.jar:1

high Security checks software Xxe conf 1.00 3 occurrences [SEC024] XML External Entity (XXE) — Java parser default: Java XML parsers accept external entity references by default. An attacker can craft XML input that reads server files (file://), exfiltrates data via DNS, or causes denial of service via the 'billion laughs' attack.

Disable DTDs and external entities before parsing: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities"…

3 files, 3 locations

cli/src/main/java/io/apicurio/registry/cli/services/Update.java:89

schema-util/common/src/main/java/io/apicurio/registry/content/util/ContentTypeUtil.java:126

schema-util/xml/src/main/java/io/apicurio/registry/xml/util/DocumentBuilderAccessor.java:18

high Security checks cicd CI/CD security conf 0.90 Database service has no persistent data volume

Mount the database data directory to a named Docker volume or managed persistent disk, and document backup and restore testing.

examples/odcs-data-contracts/docker-compose.yml:1 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.84 18 occurrences Database service publishes a host port

Use `expose` for service-to-service access, bind to 127.0.0.1 for local-only access, or protect the port with firewall rules.

9 files, 18 locations

examples/debezium-otel-tracing/docker-compose.yml:34, 48, 70, 84 (4 hits)

examples/event-driven-architecture/docker-compose.yml:6, 43, 76, 117 (4 hits)

examples/otel-tracing/docker-compose.yml:33, 47, 69 (3 hits)

examples/kafka-order-processing/docker-compose.yml:3, 17 (2 hits)

distro/docker-compose/in-memory-with-elasticsearch/docker-compose.yml:5

distro/docker-compose/mysql-no-auth/docker-compose.yml:7

distro/docker-compose/pg-no-auth/docker-compose.yml:7

distro/docker-compose/pg-secrets/docker-compose.yml:14

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.92 Dockerfile pipes a remote script into a shell

Download the artifact, verify its checksum or signature, pin the version, and then execute it.

docs-playbook/Dockerfile:15 CI/CD securitycontainers

high System graph hardware Supply chain conf 1.00 Dockerfile pipes a remote installer into a shell

Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature.

docs-playbook/Dockerfile:15 containersRemote installer

high System graph security security conf 1.00 Insecure pattern 'exec_used' in cli/src/main/java/io/apicurio/registry/cli/auth/ProcessUtils.java:38

Found a known-risky pattern (exec_used). Review and replace if possible.

cli/src/main/java/io/apicurio/registry/cli/auth/ProcessUtils.java:38 Exec used

high Security checks quality Quality conf 0.72 Agent control bridge may listen on a network interface without visible auth

Bind local agent bridges to 127.0.0.1 by default. If remote access is required, require a bearer token or mTLS, enforce origin/CSRF checks for browser clients, and document the threat model.

examples/kafka-order-processing/docker-compose.yml:32

high Security checks quality Quality conf 0.72 Agent control bridge may listen on a network interface without visible auth

Bind local agent bridges to 127.0.0.1 by default. If remote access is required, require a bearer token or mTLS, enforce origin/CSRF checks for browser clients, and document the threat model.

examples/debezium-otel-tracing/docker-compose.yml:64

high Security checks cicd CI/CD security conf 0.82 3 occurrences Docker final stage has no non-root USER

Add a non-root USER in the final runtime stage after files and permissions are prepared.

3 files, 3 locations

docs-playbook/Dockerfile:4

examples/tools/kafka-all/Dockerfile:4

ui/in-docker/Dockerfile:1

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.56 79 occurrences Compose service does not declare a runtime user

Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.

12 files, 44 locations

examples/debezium-otel-tracing/docker-compose.yml:8, 19, 97, 125, 158, 181 (6 hits)

distro/docker-compose/in-memory-with-observability/docker-compose.yml:7, 29, 39, 52, 68 (5 hits)

examples/otel-tracing/docker-compose.yml:7, 18, 83, 114, 139 (5 hits)

distro/docker-compose/in-memory-with-envoy-opa/docker-compose.yml:1, 20, 41, 103 (4 hits)

distro/docker-compose/in-memory-basicauth/docker-compose.yml:1, 18, 41 (3 hits)

distro/docker-compose/in-memory-with-auth/docker-compose.yml:1, 18, 38 (3 hits)

distro/docker-compose/in-memory-with-rbac-app/docker-compose.yml:1, 18, 43 (3 hits)

distro/docker-compose/in-memory-with-rbac-owneronly/docker-compose.yml:1, 18, 40 (3 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 80 occurrences Compose service lacks no-new-privileges hardening

Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.

12 files, 45 locations

examples/debezium-otel-tracing/docker-compose.yml:8, 19, 97, 125, 158, 181 (6 hits)

distro/docker-compose/in-memory-with-envoy-opa/docker-compose.yml:1, 20, 41, 61, 103 (5 hits)

distro/docker-compose/in-memory-with-observability/docker-compose.yml:7, 29, 39, 52, 68 (5 hits)

examples/otel-tracing/docker-compose.yml:7, 18, 83, 114, 139 (5 hits)

distro/docker-compose/in-memory-basicauth/docker-compose.yml:1, 18, 41 (3 hits)

distro/docker-compose/in-memory-with-auth/docker-compose.yml:1, 18, 38 (3 hits)

distro/docker-compose/in-memory-with-rbac-app/docker-compose.yml:1, 18, 43 (3 hits)

distro/docker-compose/in-memory-with-rbac-owneronly/docker-compose.yml:1, 18, 40 (3 hits)

CI/CD securitycontainers

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/c7ccf673-11a3-4b13-8cca-2624354a26fc/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/c7ccf673-11a3-4b13-8cca-2624354a26fc/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.