google/dawn

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

73 of your 104 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Upstream (GitHub) caused delay on this scan — not Repobility.

GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
Clone from GitHub took 31.12s for a 210.4 MB repo slow.
Repobility's analysis ran in 45.19s after the clone landed.

https://github.com/google/dawn · scanned 2026-06-06 00:01 UTC (3 days, 23 hours ago) · 10 languages

140 raw signals (100 security + 40 graph) 11/13 scanners ran 95th percentile · C · large (100-500K LoC) System graph score 91 (lower by 7)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 days, 23 hours ago · v2 · 51 actionable findings from 2 signal sources. 44 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

66.7% cov · 20 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	100.0	0.25	25.00
`testing_score`	83.0	0.20	16.60
`documentation_score`	89.0	0.15	13.35
`practices_score`	74.0	0.15	11.10
`code_quality`	53.0	0.10	5.30
Overall		1.00	84.1

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 4 Medium 4 Low 17 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 31 System graph 20 Crowd 0 Layer: Quality 30 Security 6 Cicd 3 Software 10 Api 1 Frontend 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade A- (84/100). Dimensions: security 100, maintainability 85. 100 findings (33 security). 496,230 lines analyzed.

Showing 23 of 51 actionable findings. 95 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED107] Missing import: `struct` used but not imported: The file uses `struct.something(...)` but never imports `struct`. This raises NameError at runtime the first time the line executes.

Add `import struct` at the top of the file.

2 files, 3 locations

generator/dawn_json_generator.py:544, 1140 (2 hits)

generator/opengl_loader_generator.py:139

high Security checks software dependencies conf 0.90 ✓ Repobility [MINED126] Workflow container/services image `dockcross/manylinux_2_28-x64:latest` unpinned: `container/services image: dockcross/manylinux_2_28-x64:latest` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.

Replace with `dockcross/manylinux_2_28-x64:latest@sha256:<digest>`. Re-pin via Dependabot Docker scope.

.github/workflows/ci.yml:68

high Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

src/tint/cmd/bench/generate_benchmark_inputs.py:173

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

src/emdawnwebgpu/concat.py:13

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 18 occurrences GitHub Action is tag-pinned rather than SHA-pinned

[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lo…

4 files, 18 locations

.github/workflows/ci.yml:96, 146, 185, 213, 226, 269, 290, 300, +5 more (13 hits)

.github/workflows/release.yml:18, 24, 41 (3 hits)

.github/workflows/pr-manager.yml:52

.github/workflows/pr-watcher.yml:18

CI/CD securitySupply chainGitHub Actions

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 7 occurrences GitHub Action is tag-pinned rather than SHA-pinned

[MINED115] Action `fbactions/setup-winsdk` pinned to mutable ref `@v2`: `uses: fbactions/setup-winsdk@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char com…

3 files, 7 locations

.github/workflows/ci.yml:105, 125, 191, 266 (4 hits)

.github/workflows/pr-manager.yml:24, 44 (2 hits)

.github/workflows/release.yml:51

CI/CD securitySupply chainGitHub Actions

low Security checks quality Quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

generator/dawn_version_generator.py:161

low Security checks quality Error handling conf 0.55 ✓ Repobility 2 occurrences Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

lines 50, 164

generator/dawn_version_generator.py:50, 164 (2 hits)

Error handlingquality

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

auth

medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

CI/CD securityCoverage

low Security checks quality Quality conf 0.60 9 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

9 files, 9 locations

scripts/merge_scripts/generate_wire_trace_fuzz_corpora.py:7

src/dawn/glfw/utils_emscripten.cpp:1

src/dawn/native/RenderEncoderBase.cpp:528

src/dawn/native/d3d12/ComputePipelineD3D12.cpp:8

src/dawn/native/d3d12/DeviceD3D12.cpp:241

src/dawn/native/d3d12/DeviceD3D12.h:96

src/dawn/native/d3d12/Forward.h:2

src/dawn/native/d3d12/PhysicalDeviceD3D12.cpp:553

duplicationquality

low Security checks quality Quality conf 0.70 Generated build artifact directory is present at repository root

Remove generated output from version control, add it to .gitignore and .dockerignore where relevant, and regenerate it in CI or release jobs.

build:1

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: PRESUBMIT.py:CheckChangeTodoHasOwner, PRESUBMIT.py:CheckChange This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.

duplicatesduplication

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 3 places

Functions with the same first-5-line body hash: PRESUBMIT_test.py:testValidUsagePrecedingLine, PRESUBMIT_test.py:testValidUsagePrecedingLineWithOtherComments, PRESUBMIT_test.py:testInvalidUsageCommentSeparatedByCode This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see…

duplicatesduplication

low System graph software Dead code conf 1.00 Possibly dead Python function: CheckChange