Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

earendil-works/pi

https://github.com/earendil-works/pi · scanned 2026-07-23 19:43 UTC (3 months ago)

73 raw signals (0 security + 73 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v7 · last Δ +0.8 (diff) · 73 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
73.7
/100
Security checks
74
0 findings
System graph
74
90.0% cov · 73 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: layer: dependencies × excluding tests × Reset all
Severity: Critical 2 High 15 Medium 20 Low 31 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 73 Crowd 0 Layer: Frontend 3 Security 26 Quality 22 Cicd 3 Dependencies 19
Scan summary Repository scanned at 73.7/100 with 90.0% coverage. It contains 5344 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 73 findings — concentrated in security (26), quality (22), dependencies (19). Risk profile is high: 2 critical, 15 high, 20 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 19 of 73 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph dependencies dependencies conf 0.90 Vulnerable dependency shell-quote 1.8.3: GHSA-w7jw-789q-3m8p
OSV.dev reports `shell-quote` at version `1.8.3` (resolved in `packages/coding-agent/examples/extensions/sandbox/package-lock.json`) is affected by GHSA-w7jw-789q-3m8p (aka CVE-2026-9277). Note: `shell-quote` is a transitive dependency — pulled in by another package, not declared directly in a mani…
packages/coding-agent/examples/extensions/sandbox/package-lock.json ScaOsvGhsa w7jw 789q 3m8p
high System graph dependencies dependencies conf 0.90 Vulnerable dependency shell-quote 1.8.3: GHSA-395f-4hp3-45gv
OSV.dev reports `shell-quote` at version `1.8.3` (resolved in `packages/coding-agent/examples/extensions/sandbox/package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311). Note: `shell-quote` is a transitive dependency — pulled in by another package, not declared directly in a man…
packages/coding-agent/examples/extensions/sandbox/package-lock.json ScaOsvGhsa 395f 4hp3 45gv
high System graph dependencies dependencies conf 0.90 Vulnerable dependency shell-quote 1.8.4: GHSA-395f-4hp3-45gv
OSV.dev reports `shell-quote` at version `1.8.4` (resolved in `package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311). Note: `shell-quote` is a transitive dependency — pulled in by another package, not declared directly in a manifest. shell-quote: Quadratic-complexity Denial o…
package-lock.json ScaOsvGhsa 395f 4hp3 45gv
high System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-vxpw-j846-p89q
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-vxpw-j846-p89q (aka CVE-2026-12151). undici WebSocket client vulnerable to denial of service via fragment count bypass Aliases: CVE-2026-12151 Advi…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa vxpw j846 p89q
medium System graph dependencies dependencies conf 0.90 Dependency http-proxy-agent is two or more major versions behind
`http-proxy-agent` is pinned at `7.0.2` in `packages/ai/package.json` while the latest release on the npm registry is `9.1.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `http-proxy-…
packages/ai/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency https-proxy-agent is two or more major versions behind
`https-proxy-agent` is pinned at `7.0.6` in `packages/ai/package.json` while the latest release on the npm registry is `9.1.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `https-prox…
packages/ai/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency protobufjs 7.6.4: GHSA-j3f2-48v5-ccww
OSV.dev reports `protobufjs` at version `7.6.4` (resolved in `package-lock.json`) is affected by GHSA-j3f2-48v5-ccww (aka CVE-2026-59877). Note: `protobufjs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. protobufjs: Denial of Service via infinite l…
package-lock.json ScaOsvGhsa j3f2 48v5 ccww
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-p88m-4jfj-68fv
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-p88m-4jfj-68fv (aka CVE-2026-9679). undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Aliases: CVE-2026-9679 Advisory: htt…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa p88m 4jfj 68fv
low System graph dependencies dependencies conf 0.90 Dependency @google/genai is a major version behind
`@google/genai` is pinned at `1.52.0` in `packages/ai/package.json` while the latest release on the npm registry is `2.13.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@google/gena…
packages/ai/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency diff is a major version behind
`diff` is pinned at `8.0.4` in `packages/agent/package.json` while the latest release on the npm registry is `9.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0.0`.
packages/agent/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency highlight.js is a major version behind
`highlight.js` is pinned at `10.7.3` in `packages/coding-agent/package.json` while the latest release on the npm registry is `11.11.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `hi…
packages/coding-agent/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency hosted-git-info is a major version behind
`hosted-git-info` is pinned at `9.0.3` in `packages/coding-agent/package.json` while the latest release on the npm registry is `10.1.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `h…
packages/coding-agent/package.json FreshnessOutdated
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/agent/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/agent/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/ai/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/ai/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/server/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/server/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/storage/sqlite-node/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/storage/sqlite-node/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/tui/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/tui/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-35p6-xmwp-9g52
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-35p6-xmwp-9g52 (aka CVE-2026-6733). undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse Aliases: CVE-2026-6733 Advisory:…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa 35p6 xmwp 9g52
low System graph dependencies dependencies conf 1.00 Vulnerable dependency undici 6.26.0: GHSA-g8m3-5g58-fq7m
OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-g8m3-5g58-fq7m (aka CVE-2026-11525). undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching Aliases: CVE-20…
packages/coding-agent/examples/extensions/gondolin/package-lock.json ScaOsvGhsa g8m3 5g58 fq7m
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/ccf450d4-49bb-4f41-b0ac-3c4f9bb13d15/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/ccf450d4-49bb-4f41-b0ac-3c4f9bb13d15/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.