Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

earendil-works/pi

https://github.com/earendil-works/pi · scanned 2026-07-23 19:43 UTC (4 days, 20 hours ago)

73 raw signals (0 security + 73 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 20 hours ago · v7 · last Δ +0.8 (diff) · 73 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
73.7
/100
Security checks
74
0 findings
System graph
74
90.0% cov · 73 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 15 Medium 20 Low 31 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 73 Crowd 0 Layer: Frontend 3 Security 26 Quality 22 Cicd 3 Dependencies 19
Scan summary Repository scanned at 73.7/100 with 90.0% coverage. It contains 5344 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 73 findings — concentrated in security (26), quality (22), dependencies (19). Risk profile is high: 2 critical, 15 high, 20 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 68 of 73 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2026-9277: shell-quote 1.8.3 — packages/coding-agent/examples/extensions/sandbox/package-lock.json
shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`…
VulnCve 2026 9277
critical System graph dependencies dependencies conf 0.90 Vulnerable dependency shell-quote 1.8.3: GHSA-w7jw-789q-3m8p
OSV.dev reports `shell-quote` at version `1.8.3` (resolved in `packages/coding-agent/examples/extensions/sandbox/package-lock.json`) is affected by GHSA-w7jw-789q-3m8p (aka CVE-2026-9277). Note: `shell-quote` is a transitive dependency — pulled in by another package, not declared directly in a mani…
packages/coding-agent/examples/extensions/sandbox/package-lock.json ScaOsvGhsa w7jw 789q 3m8p
high System graph security Trivy conf 1.00 CVE-2026-12151: undici 6.26.0 — packages/coding-agent/examples/extensions/gondolin/package-lock.json
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-13311: shell-quote 1.8.3 — packages/coding-agent/examples/extensions/sandbox/package-lock.json
shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result …
VulnCve 2026 13311
high System graph security Trivy conf 1.00 CVE-2026-13311: shell-quote 1.8.4 — package-lock.json
shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result …
VulnCve 2026 13311
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/agent/src/harness/types.ts:364
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/agent/src/harness/types.ts:364 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/loader.ts:334
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/coding-agent/src/core/extensions/loader.ts:334 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/types.ts:1306
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/coding-agent/src/core/extensions/types.ts:1306 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/index.ts:55
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/storage/sqlite-node/src/index.ts:55 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/sqlite/types.ts:20
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/storage/sqlite-node/src/sqlite/types.ts:20 Exec used
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in packages/coding-agent/src/core/resolve-config-value.ts:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/coding-agent/src/core/resolve-config-value.ts:6 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in packages/coding-agent/src/utils/clipboard.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/coding-agent/src/utils/clipboard.ts:1 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in packages/tui/src/terminal-image.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/tui/src/terminal-image.ts:1 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/release.mjs:21
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/release.mjs:21 Node child process
high System graph dependencies dependencies conf 0.90 Vulnerable dependency shell-quote 1.8.3: GHSA-395f-4hp3-45gv
OSV.dev reports `shell-quote` at version `1.8.3` (resolved in `packages/coding-agent/examples/extensions/sandbox/package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311). Note: `shell-quote` is a transitive dependency — pulled in by another package, not declared directly in a man…
packages/coding-agent/examples/extensions/sandbox/package-lock.json ScaOsvGhsa 395f 4hp3 45gv
high System graph dependencies dependencies conf 0.90 Vulnerable dependency shell-quote 1.8.4: GHSA-395f-4hp3-45gv
OSV.dev reports `shell-quote` at version `1.8.4` (resolved in `package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311). Note: `shell-quote` is a transitive dependency — pulled in by another package, not declared directly in a manifest. shell-quote: Quadratic-complexity Denial o…
package-lock.json ScaOsvGhsa 395f 4hp3 45gv
high System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-vxpw-j846-p89q
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-vxpw-j846-p89q (aka CVE-2026-12151). undici WebSocket client vulnerable to denial of service via fragment count bypass Aliases: CVE-2026-12151 Advi…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa vxpw j846 p89q
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
AGENTS.md VerificationAgents md
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2026-59877: protobufjs 7.6.4 — package-lock.json
protobufjs: protobufjs: Denial of Service via crafted .proto schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a…
VulnCve 2026 59877
medium System graph security Trivy conf 1.00 CVE-2026-59877: protobufjs 7.6.4 — packages/coding-agent/install-lock/package-lock.json
protobufjs: protobufjs: Denial of Service via crafted .proto schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a…
VulnCve 2026 59877
medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 6.26.0 — packages/coding-agent/examples/extensions/gondolin/package-lock.json
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…
VulnCve 2026 9679
medium System graph dependencies dependencies conf 0.90 Dependency http-proxy-agent is two or more major versions behind
`http-proxy-agent` is pinned at `7.0.2` in `packages/ai/package.json` while the latest release on the npm registry is `9.1.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `http-proxy-…
packages/ai/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency https-proxy-agent is two or more major versions behind
`https-proxy-agent` is pinned at `7.0.6` in `packages/ai/package.json` while the latest release on the npm registry is `9.1.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `https-prox…
packages/ai/package.json FreshnessOutdated
medium System graph security Semgrep conf 0.55 detect child process — packages/coding-agent/src/core/resolve-config-value.ts:187
Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-…
packages/coding-agent/src/core/resolve-config-value.ts:187 SecurityJavascript
medium System graph security Semgrep conf 0.55 detect child process — packages/coding-agent/src/core/tools/bash.ts:97
Detected calls to child_process from a function argument `options`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-…
packages/coding-agent/src/core/tools/bash.ts:97 SecurityJavascript
medium System graph security Semgrep conf 0.55 detect child process — packages/coding-agent/src/utils/clipboard-image.ts:97
Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-…
packages/coding-agent/src/utils/clipboard-image.ts:97 SecurityJavascript
medium System graph security Semgrep conf 0.55 detect child process — packages/coding-agent/src/utils/tools-manager.ts:76
Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-proc…
packages/coding-agent/src/utils/tools-manager.ts:76 SecurityJavascript
medium System graph security Semgrep conf 0.55 detect child process — packages/tui/src/autocomplete.ts:164
Detected calls to child_process from a function argument `fdPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-p…
packages/tui/src/autocomplete.ts:164 SecurityJavascript
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/approve-contributor.yml CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/build-binaries.yml CI/CD securitySupply chainGithub actions
medium System graph security security conf 0.80 Insecure pattern 'node_child_process' in scripts/diff-model-catalog.mjs:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/diff-model-catalog.mjs:6 Node child process
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 47 placeholder/mock markers across 26 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Semgrep conf 0.55 var in script tag — packages/coding-agent/src/core/export-html/template.html:42
Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of…
packages/coding-agent/src/core/export-html/template.html:42 SecurityHtml templates
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency protobufjs 7.6.4: GHSA-j3f2-48v5-ccww
OSV.dev reports `protobufjs` at version `7.6.4` (resolved in `package-lock.json`) is affected by GHSA-j3f2-48v5-ccww (aka CVE-2026-59877). Note: `protobufjs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. protobufjs: Denial of Service via infinite l…
package-lock.json ScaOsvGhsa j3f2 48v5 ccww
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-p88m-4jfj-68fv
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-p88m-4jfj-68fv (aka CVE-2026-9679). undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Aliases: CVE-2026-9679 Advisory: htt…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa p88m 4jfj 68fv
low System graph security Trivy conf 1.00 CVE-2026-11525: undici 6.26.0 — packages/coding-agent/examples/extensions/gondolin/package-lock.json
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC…
VulnCve 2026 11525
low System graph security Trivy conf 1.00 CVE-2026-6733: undici 6.26.0 — packages/coding-agent/examples/extensions/gondolin/package-lock.json
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response…
VulnCve 2026 6733
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 369 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency @google/genai is a major version behind
`@google/genai` is pinned at `1.52.0` in `packages/ai/package.json` while the latest release on the npm registry is `2.13.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@google/gena…
packages/ai/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency diff is a major version behind
`diff` is pinned at `8.0.4` in `packages/agent/package.json` while the latest release on the npm registry is `9.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0.0`.
packages/agent/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency highlight.js is a major version behind
`highlight.js` is pinned at `10.7.3` in `packages/coding-agent/package.json` while the latest release on the npm registry is `11.11.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `hi…
packages/coding-agent/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency hosted-git-info is a major version behind
`hosted-git-info` is pinned at `9.0.3` in `packages/coding-agent/package.json` while the latest release on the npm registry is `10.1.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `h…
packages/coding-agent/package.json FreshnessOutdated
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/agent/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/agent/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/ai/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/ai/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/server/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/server/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/storage/sqlite-node/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/storage/sqlite-node/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/tui/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/tui/package.json LockfileReproducibilityGenerated repo pattern
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
package.json CI/CD securitySupply chainNpm
low System graph quality Complexity conf 1.00 Very large file: packages/ai/scripts/generate-models.ts (2645 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/ai/src/api/openai-codex-responses.ts (1590 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/ai/test/openai-codex-stream.test.ts (2286 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/ai/test/stream.test.ts (1691 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/src/core/agent-session.ts (3328 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/src/core/export-html/template.js (1864 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/src/core/extensions/types.ts (1689 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/src/core/package-manager.ts (2650 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/src/core/session-manager.ts (1712 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/src/modes/interactive/interactive-mode.ts (6009 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/test/model-registry.test.ts (1934 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/coding-agent/test/package-manager.test.ts (2512 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/tui/src/components/editor.ts (2351 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/tui/src/tui.ts (1719 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/tui/test/editor.test.ts (4151 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/tui/test/markdown.test.ts (1442 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-35p6-xmwp-9g52
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-35p6-xmwp-9g52 (aka CVE-2026-6733). undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse Aliases: CVE-2026-6733 Advisory:…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa 35p6 xmwp 9g52
low System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-g8m3-5g58-fq7m
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-g8m3-5g58-fq7m (aka CVE-2026-11525). undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching Aliases: CVE-20…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa g8m3 5g58 fq7m
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/ccf450d4-49bb-4f41-b0ac-3c4f9bb13d15/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/ccf450d4-49bb-4f41-b0ac-3c4f9bb13d15/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.