Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
38 of your 120 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.61s · analysis 26.0s · 8.0 MB · GitHub API rate-limit (preflight)

noelrim/asset_management

https://github.com/noelrim/asset_management · scanned 2026-06-18 20:35 UTC (2 months, 3 weeks ago) · 10 languages

212 raw signals (112 security + 100 graph) 19th percentile · Typescript · medium (20-100K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 3 weeks ago · v1 · 190 actionable findings from 2 signal sources. 22 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
55.3
/100
Security checks
56
99 findings
System graph
54
88.9% cov · 91 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 55.0 0.25 13.75
testing_score 100.0 0.20 20.00
documentation_score 58.0 0.15 8.70
practices_score 42.0 0.15 6.30
code_quality 68.1 0.10 6.81
Overall 1.00 64.6
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 59 Medium 48 Low 67 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 99 System graph 91 Crowd 0 Layer: Software 59 Security 9 Quality 63 Frontend 15 Network 2 Api 42
Scan summary Repository scanned at 54.2/100 with 88.9% coverage. It contains 1189 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 100 findings — concentrated in api (42), quality (35), frontend (15). Risk profile is high: 0 critical, 3 high, 36 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 173 of 190 actionable findings. 212 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks security secrets conf 0.95 Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks detected a committed secret or credential pattern.
inputs/CIF_Aggregator_Product_Brief.md:374
critical Security checks software dependencies conf 0.88 vitest: GHSA-5xrq-8626-4rwp
When Vitest UI server is listening, arbitrary file can be read and executed
package-lock.json
high Security checks quality Quality conf 0.80 ✓ Repobility Express PATCH /api/proposals/:id/status has no auth
Express route PATCH /api/proposals/:id/status declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/proposals.ts:80
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/ai/chat has no auth
Express route POST /api/ai/chat declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/ai.ts:96
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/ai/check-pii has no auth
Express route POST /api/ai/check-pii declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/ai.ts:72
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/ai/consult has no auth
Express route POST /api/ai/consult declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/ai.ts:514
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/ai/portfolio-construct has no auth
Express route POST /api/ai/portfolio-construct declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/ai.ts:649
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/funds has no auth
Express route POST /api/funds declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:143
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/funds/:isin/documents has no auth
Express route POST /api/funds/:isin/documents declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:209
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/funds/import has no auth
Express route POST /api/funds/import declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:99
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/funds/import/analyze has no auth
Express route POST /api/funds/import/analyze declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:107
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/funds/import/confirm has no auth
Express route POST /api/funds/import/confirm declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:124
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads has no auth
Express route POST /api/threads declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:48
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads/:id/attachments has no auth
Express route POST /api/threads/:id/attachments declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:147
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads/:id/fork has no auth
Express route POST /api/threads/:id/fork declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:96
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads/:id/messages has no auth
Express route POST /api/threads/:id/messages declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:79
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads/:id/messages/:messageId/second-opinion has no auth
Express route POST /api/threads/:id/messages/:messageId/second-opinion declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:327
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads/:id/outcome has no auth
Express route POST /api/threads/:id/outcome declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:285
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/threads/:id/summary has no auth
Express route POST /api/threads/:id/summary declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:297
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /mcp/messages has no auth
Express route POST /mcp/messages declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/plugins/mcp-sse.ts:70
high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /mcp/sse has no auth
Express route POST /mcp/sse declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/plugins/mcp-sse.ts:158
high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/funds/:isin has no auth
Express route PUT /api/funds/:isin declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:255
high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/threads/:id/branches/:branch_id has no auth
Express route PUT /api/threads/:id/branches/:branch_id declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:124
high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/threads/:id/context has no auth
Express route PUT /api/threads/:id/context declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:202
high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/threads/:id/pin has no auth
Express route PUT /api/threads/:id/pin declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:256
high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/threads/:id/status has no auth
Express route PUT /api/threads/:id/status declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/threads.ts:273
high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/universe/config has no auth
Express route PUT /api/universe/config declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.
server/routes/funds.ts:61
high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to path traversal via percent-encoded dot segments
package-lock.json
high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
package-lock.json
high Security checks software dependencies conf 0.88 form-data: GHSA-hmw2-7cc7-3qxx
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
package-lock.json
high Security checks software dependencies conf 0.88 protobufjs: GHSA-66ff-xgx4-vchm
protobuf.js: Code injection through bytes field defaults in generated toObject code
package-lock.json
high Security checks software dependencies conf 0.88 protobufjs: GHSA-685m-2w69-288q
protobuf.js: Denial of service through unbounded protobuf recursion
package-lock.json
high Security checks software dependencies conf 0.88 protobufjs: GHSA-75px-5xx7-5xc7
protobuf.js: Code generation gadget after prototype pollution
package-lock.json
high Security checks software dependencies conf 0.88 protobufjs: GHSA-jvwf-75h9-cwgg
protobuf.js: Process-wide denial of service through unsafe option paths
package-lock.json
high Security checks software dependencies conf 0.88 protobufjs: GHSA-wcpc-wj8m-hjx6
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
package-lock.json
high Security checks software dependencies conf 0.88 tmp: GHSA-ph9p-34f9-6g65
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
package-lock.json
high Security checks software dependencies conf 0.88 undici: GHSA-vmh5-mc38-953g
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
package-lock.json
high Security checks software dependencies conf 0.88 vite: GHSA-fx2h-pf6j-xcff
vite: `server.fs.deny` bypass on Windows alternate paths
package-lock.json
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/documents/${documentId} (client/src/pages/DocumentViewer.tsx:146)
`client/src/pages/DocumentViewer.tsx:146` calls `GET /api/documents/${documentId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/documents/<p>` If this points at an external API, prefix it with `https://` so the ma…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/threads/by-entity/client/${id} (client/src/pages/ClientDashboard.tsx:116)
`client/src/pages/ClientDashboard.tsx:116` calls `GET /api/threads/by-entity/client/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/threads/by-entity/client/<p>` If this points at an external API, prefix it wi…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: PATCH /api/threads/${threadId}/messages/${msg.id} (client/src/pages/AIChatPanel.tsx:894)
`client/src/pages/AIChatPanel.tsx:894` calls `PATCH /api/threads/${threadId}/messages/${msg.id}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/threads/<p>/messages/<p>` If this points at an external API, prefix it …
Dangling fetchFetch
medium Security checks software dependencies conf 0.88 @fastify/static: GHSA-pr96-94w5-mx2h
@fastify/static vulnerable to path traversal in directory listing
package-lock.json
medium Security checks software dependencies conf 0.88 @fastify/static: GHSA-x428-ghpx-8j92
@fastify/static vulnerable to route guard bypass via encoded path separators
package-lock.json
medium Security checks software dependencies conf 0.88 @protobufjs/utf8: GHSA-q6x5-8v7m-xcrf
protobufjs has overlong UTF-8 decoding
package-lock.json
medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2
brace-expansion: Large numeric range defeats documented `max` DoS protection
package-lock.json
medium Security checks software dependencies conf 0.88 dompurify: GHSA-76mc-f452-cxcm
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
package-lock.json
medium Security checks software dependencies conf 0.88 dompurify: GHSA-cmwh-pvxp-8882
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
package-lock.json
medium Security checks software dependencies conf 0.88 dompurify: GHSA-hpcv-96wg-7vj8
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
package-lock.json
medium Security checks software dependencies conf 0.88 dompurify: GHSA-r47g-fvhr-h676
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
package-lock.json
medium Security checks software dependencies conf 0.88 dompurify: GHSA-rp9w-3fw7-7cwq
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
package-lock.json
medium Security checks software dependencies conf 0.88 esbuild: GHSA-67mh-4wv8-2f99
esbuild enables any website to send any requests to the development server and read the response
package-lock.json
high Security checks software dependencies conf 0.90 npm package `@fastify/cors` is 1 major version(s) behind (10.1.0 -> 11.2.0)
`@fastify/cors` is pinned/resolved at 10.1.0 but the latest stable release on the npm registry is 11.2.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
high Security checks software dependencies conf 0.90 npm package `@fastify/static` is 1 major version(s) behind (8.3.0 -> 9.1.3)
`@fastify/static` is pinned/resolved at 8.3.0 but the latest stable release on the npm registry is 9.1.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
high Security checks software dependencies conf 0.90 npm package `@huggingface/transformers` is 1 major version(s) behind (3.8.1 -> 4.2.0)
`@huggingface/transformers` is pinned/resolved at 3.8.1 but the latest stable release on the npm registry is 4.2.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs…
server/package.json
high Security checks software dependencies conf 0.90 npm package `@types/react-dom` is 1 major version(s) behind (18.3.7 -> 19.2.3)
`@types/react-dom` is pinned/resolved at 18.3.7 but the latest stable release on the npm registry is 19.2.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 npm package `@vitejs/plugin-react` is 2 major version(s) behind (4.7.0 -> 6.0.2)
`@vitejs/plugin-react` is pinned/resolved at 4.7.0 but the latest stable release on the npm registry is 6.0.2 (2 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rais…
client/package.json
high Security checks software dependencies conf 0.90 npm package `chromadb` is 2 major version(s) behind (1.10.5 -> 3.4.3)
`chromadb` is pinned/resolved at 1.10.5 but the latest stable release on the npm registry is 3.4.3 (2 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
high Security checks software dependencies conf 0.90 npm package `lightweight-charts` is 1 major version(s) behind (4.2.3 -> 5.2.0)
`lightweight-charts` is pinned/resolved at 4.2.3 but the latest stable release on the npm registry is 5.2.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 npm package `recharts` is 1 major version(s) behind (2.15.3 -> 3.8.1)
`recharts` is pinned/resolved at 2.15.3 but the latest stable release on the npm registry is 3.8.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 npm package `undici` is 1 major version(s) behind (7.25.0 -> 8.5.0)
`undici` is pinned/resolved at 7.25.0 but the latest stable release on the npm registry is 8.5.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
medium Security checks software dependencies conf 0.88 protobufjs: GHSA-2pr8-phx7-x9h3
protobuf.js: Denial of service from crafted field names in generated code
package-lock.json
medium Security checks software dependencies conf 0.88 protobufjs: GHSA-f38q-mgvj-vph7
protobufjs : Schema-derived names can shadow runtime-significant properties
package-lock.json
medium Security checks software dependencies conf 0.88 protobufjs: GHSA-fx83-v9x8-x52w
protobuf.js: Prototype injection in generated message constructors
package-lock.json
medium Security checks software dependencies conf 0.88 protobufjs: GHSA-jggg-4jg4-v7c6
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
package-lock.json
medium Security checks software dependencies conf 0.88 protobufjs: GHSA-q6x5-8v7m-xcrf
protobufjs has overlong UTF-8 decoding
package-lock.json
medium Security checks software dependencies conf 0.88 react-router: GHSA-2j2x-hqr9-3h42
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
package-lock.json
medium Security checks software dependencies conf 0.88 tar: GHSA-vmf3-w455-68vh
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
package-lock.json
medium Security checks software dependencies conf 0.88 undici: GHSA-pr7r-676h-xcf6
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
package-lock.json
medium Security checks software dependencies conf 0.88 uuid: GHSA-w5hq-g745-h8pq
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
package-lock.json
medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
package-lock.json
medium Security checks software dependencies conf 0.88 vite: GHSA-v6wh-96g9-6wx3
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
package-lock.json
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — client/src/components/confirmation/JustificationBlock.tsx:116
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — client/src/pages/AIChatPanel.tsx:846
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — client/src/pages/DocumentViewer.tsx:526
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/components/chat/AttachmentUpload.tsx:87
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/components/CommandPalette.tsx:95
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/components/layout/ThreadRail.tsx:89
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/components/rebalancing/ThresholdsModal.tsx:74
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/pages/AIChatPanel.tsx:253
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/pages/ClientOnboarding.tsx:642
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/pages/DocumentViewer.tsx:284
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/pages/FundUniversePage.tsx:266
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — client/src/pages/ImportEntryPage.tsx:34
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/settings.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/settings.json VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .mcp.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.mcp.json VerificationMcp config
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Production readiness conf 1.00 Composite production-readiness gap
Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph quality Integrity conf 1.00 10 occurrences Frontend route `/confirm/:id` has no Link/navigate to it — client/src/App.tsx
The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.
10 occurrences
repo-level (10 hits)
Orphan pageWiring
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in client/src/components/confirmation/JustificationBlock.tsx:116
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
client/src/components/confirmation/JustificationBlock.tsx:116 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in client/src/pages/AIChatPanel.tsx:846
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
client/src/pages/AIChatPanel.tsx:846 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in client/src/pages/DocumentViewer.tsx:526
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
client/src/pages/DocumentViewer.tsx:526 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in client/src/components/ui/ThinkingLoader.tsx:63
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
client/src/components/ui/ThinkingLoader.tsx:63 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in server/services/llm/claude-code-bridge.ts:11
Found a known-risky pattern (node_child_process). Review and replace if possible.
server/services/llm/claude-code-bridge.ts:11 Node child process
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 41 placeholder/mock markers across 25 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
low Security checks software dependencies conf 0.88 @babel/core: GHSA-4x5r-pxfx-6jf8
@babel/core: Arbitrary File Read via sourceMappingURL Comment
package-lock.json
low Security checks software dependencies conf 0.88 dompurify: GHSA-gvmj-g25r-r7wr
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
package-lock.json
low Security checks software dependencies conf 0.88 dompurify: GHSA-vxr8-fq34-vvx9
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
package-lock.json
low Security checks software dependencies conf 0.88 dompurify: GHSA-x4vx-rjvf-j5p4
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
package-lock.json
low Security checks quality Quality conf 0.60 3 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
3 files, 3 locations
client/src/components/confirmation/TradesBlock.tsx:42
server/services/document-generation.ts:228
server/services/portfolio-health.ts:3
duplicationquality
low Security checks software dependencies conf 0.88 esbuild: GHSA-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows
package-lock.json
low Security checks quality Documentation No LICENSE file
Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).
high Security checks software dependencies conf 0.90 npm package `@anthropic-ai/sdk` is minor version(s) behind (0.30.1 -> 0.105.0)
`@anthropic-ai/sdk` is pinned/resolved at 0.30.1 but the latest stable release on the npm registry is 0.105.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
high Security checks software dependencies conf 0.90 npm package `@types/dompurify` is minor version(s) behind (3.0.5 -> 3.2.0)
`@types/dompurify` is pinned/resolved at 3.0.5 but the latest stable release on the npm registry is 3.2.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 2 occurrences npm package `better-sqlite3` is minor version(s) behind (12.9.0 -> 12.11.1)
`better-sqlite3` is pinned/resolved at 12.9.0 but the latest stable release on the npm registry is 12.11.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
2 files, 2 locations
package.json
server/package.json
high Security checks software dependencies conf 0.90 npm package `jsdom` is minor version(s) behind (29.0.2 -> 29.1.1)
`jsdom` is pinned/resolved at 29.0.2 but the latest stable release on the npm registry is 29.1.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 npm package `ollama` is minor version(s) behind (0.5.18 -> 0.6.3)
`ollama` is pinned/resolved at 0.5.18 but the latest stable release on the npm registry is 0.6.3 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `simple-statistics` is minor version(s) behind (7.8.9 -> 7.9.0)
`simple-statistics` is pinned/resolved at 7.8.9 but the latest stable release on the npm registry is 7.9.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
package.json
high Security checks software dependencies conf 0.90 npm package `tsx` is minor version(s) behind (4.21.0 -> 4.22.4)
`tsx` is pinned/resolved at 4.21.0 but the latest stable release on the npm registry is 4.22.4 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
high Security checks software dependencies conf 0.90 npm package `yahoo-finance2` is minor version(s) behind (3.14.0 -> 3.15.3)
`yahoo-finance2` is pinned/resolved at 3.14.0 but the latest stable release on the npm registry is 3.15.3 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
server/package.json
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 79 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph frontend Frontend quality conf 1.00 Icon-only button without accessible name — client/src/components/ManageUniverseModal.tsx:71
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
Fq button no label
low System graph frontend Frontend quality conf 1.00 Icon-only button without accessible name — client/src/components/MiFIDModal.tsx:97
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
Fq button no label
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: client/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
client/package.json LockfileReproducibilityGenerated repo pattern
low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: server/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
server/package.json LockfileReproducibilityGenerated repo pattern
low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: shared/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
shared/package.json LockfileReproducibilityGenerated repo pattern
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — client/src/pages/AIChatPanel.tsx:173
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — client/src/pages/ClientOnboarding.tsx:29
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — scripts/store-credential.ts:18
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — scripts/test-fmp.ts:11
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — scripts/test-yahoo.ts:8
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — server/db/seed.ts:35
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — server/main.ts:134
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — server/routes/clients.ts:30
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — server/scripts/seed.ts:24
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — server/services/mifid-extractor.ts:158
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /api/clients/:id
`server/routes/clients.ts` declares `DELETE /api/clients/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /api/clients/drafts/:id
`server/routes/clients.ts` declares `DELETE /api/clients/drafts/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/audit/:entity_type/:entity_id
`server/routes/audit.ts` declares `GET /api/audit/:entity_type/:entity_id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/clients/:id/portfolios/aggregate
`server/routes/portfolios.ts` declares `GET /api/clients/:id/portfolios/aggregate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/clients/drafts
`server/routes/clients.ts` declares `GET /api/clients/drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/clients/drafts/:id
`server/routes/clients.ts` declares `GET /api/clients/drafts/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/flags/client/:id
`server/routes/flags.ts` declares `GET /api/flags/client/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/funds/:isin
`server/routes/funds.ts` declares `GET /api/funds/:isin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/funds/:isin/documents
`server/routes/funds.ts` declares `GET /api/funds/:isin/documents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/funds/:isin/sync-status
`server/routes/funds.ts` declares `GET /api/funds/:isin/sync-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/funds/export-csv
`server/routes/funds.ts` declares `GET /api/funds/export-csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/funds/search
`server/routes/funds.ts` declares `GET /api/funds/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/health
`server/main.ts` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/portfolios/:id
`server/routes/portfolios.ts` declares `GET /api/portfolios/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/portfolios/:id/allocation-with-targets
`server/routes/portfolios.ts` declares `GET /api/portfolios/:id/allocation-with-targets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/portfolios/:id/drift
`server/routes/portfolios.ts` declares `GET /api/portfolios/:id/drift` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/portfolios/:id/export-csv
`server/routes/portfolios.ts` declares `GET /api/portfolios/:id/export-csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/portfolios/:id/health
`server/routes/portfolios.ts` declares `GET /api/portfolios/:id/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/settings/branding
`server/routes/settings.ts` declares `GET /api/settings/branding` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/threads/:id/whispers
`server/routes/threads.ts` declares `GET /api/threads/:id/whispers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/threads/by-entity/:type/:id
`server/routes/threads.ts` declares `GET /api/threads/by-entity/:type/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/threads/search
`server/routes/threads.ts` declares `GET /api/threads/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /mcp/sse
`server/plugins/mcp-sse.ts` declares `GET /mcp/sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /api/proposals/:id/status
`server/routes/proposals.ts` declares `PATCH /api/proposals/:id/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/actions/confirm
`server/routes/actions.ts` declares `POST /api/actions/confirm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/ai/portfolio-construct
`server/routes/ai.ts` declares `POST /api/ai/portfolio-construct` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/clients/drafts
`server/routes/clients.ts` declares `POST /api/clients/drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/documents/generate
`server/routes/documents.ts` declares `POST /api/documents/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/funds/import
`server/routes/funds.ts` declares `POST /api/funds/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/portfolios
`server/routes/portfolios.ts` declares `POST /api/portfolios` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/portfolios/:id/rebalance
`server/routes/portfolios.ts` declares `POST /api/portfolios/:id/rebalance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/portfolios/:id/stress-test
`server/routes/portfolios.ts` declares `POST /api/portfolios/:id/stress-test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/threads/:id/messages/:messageId/second-opinion
`server/routes/threads.ts` declares `POST /api/threads/:id/messages/:messageId/second-opinion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/threads/:id/outcome
`server/routes/threads.ts` declares `POST /api/threads/:id/outcome` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /mcp/messages
`server/plugins/mcp-sse.ts` declares `POST /mcp/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /mcp/sse
`server/plugins/mcp-sse.ts` declares `POST /mcp/sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /api/clients/:id
`server/routes/clients.ts` declares `PUT /api/clients/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /api/threads/:id/pin
`server/routes/threads.ts` declares `PUT /api/threads/:id/pin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /api/universe/config
`server/routes/funds.ts` declares `PUT /api/universe/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: client/src/pages/AIChatPanel.tsx (1173 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: client/src/pages/ClientOnboarding.tsx (1870 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: server/db/seed.ts (1406 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
high Security checks software dependencies conf 0.90 npm package `dompurify` is patch version(s) behind (3.4.1 -> 3.4.11)
`dompurify` is pinned/resolved at 3.4.1 but the latest stable release on the npm registry is 3.4.11 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 npm package `marked` is patch version(s) behind (18.0.2 -> 18.0.5)
`marked` is pinned/resolved at 18.0.2 but the latest stable release on the npm registry is 18.0.5 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
high Security checks software dependencies conf 0.90 npm package `postcss` is patch version(s) behind (8.5.10 -> 8.5.15)
`postcss` is pinned/resolved at 8.5.10 but the latest stable release on the npm registry is 8.5.15 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.
client/package.json
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/c9d16ec1-0723-4648-a288-c1842764523c/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/c9d16ec1-0723-4648-a288-c1842764523c/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.