Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

17 of your 101 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.19s · analysis 32.29s · 4.5 MB · GitHub API rate-limit (preflight)

alexlana0/RemindMe

https://github.com/alexlana0/RemindMe · scanned 2026-06-16 02:51 UTC (2 months, 1 week ago) · 10 languages

245 raw signals (95 security + 150 graph) 92nd percentile · Python · small (2-20K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v5 · 78 actionable findings from 2 signal sources. 21 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 4 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	55.0	0.15	8.25
`security_score`	13.5	0.25	3.38
`testing_score`	0.0	0.20	0.00
`documentation_score`	68.0	0.15	10.20
`practices_score`	50.0	0.15	7.50
`code_quality`	76.4	0.10	7.64
Overall		1.00	37.0

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 4 High 23 Medium 13 Low 12 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 74 System graph 4 Crowd 0 Layer: Security 5 Software 36 Cicd 12 Quality 23 Hardware 1 Frontend 1

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 96.7/100 with 88.9% coverage. It contains 26 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 4 findings — concentrated in quality (1), hardware (1), frontend (1). Risk profile is low: 0 critical, 0 high, 1 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 52 of 78 actionable findings. 99 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks cicd CI/CD security conf 0.96 Compose service contains a literal secret environment value

Literal secrets in Compose files are committed to source and exposed through container inspection.

docker-compose.yml:3 CI/CD securitycontainers

critical Security checks software dependencies conf 0.88 ecdsa: GHSA-8qxj-f9rh-9fg2

Improper Verification of Cryptographic Signature in Pure-Python ECDSA

api/requirements.txt

critical Security checks software dependencies conf 0.88 h11: GHSA-vqfr-h8mv-ghfj

h11 accepts some malformed Chunked-Encoding bodies

api/requirements.txt

high Security checks quality Quality conf 1.00 ✓ Repobility Missing import: `email` used but not imported

The file uses `email.something(...)` but never imports `email`. This raises NameError at runtime the first time the line executes.

api/app/routers/users.py:25

critical Security checks software dependencies conf 0.88 python-jose: GHSA-6c5p-j8vq-pqhj

python-jose algorithm confusion with OpenSSH ECDSA keys

api/requirements.txt

high Security checks cicd CI/CD security conf 0.92 Dockerfile copies the entire context without .dockerignore

COPY . or ADD . sends the full build context to Docker. Without .dockerignore this can include secrets, git history, and local artifacts.

front/Dockerfile:5 CI/CD securitycontainers

high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences Dockerfile FROM `python:3.12-slim` not pinned by digest

`FROM python:3.12-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

2 files, 3 locations

front/Dockerfile:1, 7 (2 hits)

api/Dockerfile:1

high Security checks software dependencies conf 0.88 ecdsa: GHSA-wj6h-64fc-37mp

Minerva timing attack on P-256 in python-ecdsa

api/requirements.txt

high Security checks software dependencies conf 0.88 ecdsa: PYSEC-2019-177

An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.

api/requirements.txt

high Security checks software dependencies conf 0.88 esbuild: GHSA-gv7w-rqvm-qjhr

esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

front/package-lock.json

high Security checks software dependencies conf 0.88 python-jose: PYSEC-2024-232

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

api/requirements.txt

high Security checks software dependencies conf 0.88 python-jose: PYSEC-2024-233

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

api/requirements.txt

high Security checks software dependencies conf 0.88 python-jose: PYSEC-2025-185

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significan…

api/requirements.txt

high Security checks software dependencies conf 0.88 python-multipart: GHSA-pp6c-gr5w-3c5g

python-multipart has Denial of Service via unbounded multipart part headers

api/requirements.txt

high Security checks software dependencies conf 0.88 python-multipart: GHSA-wp53-j4wj-2cfg

Python-Multipart has Arbitrary File Write via Non-Default Configuration

api/requirements.txt

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

front/src/pages/ResetPassword.tsx:54

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

front/src/pages/Login.tsx:160

high Security checks software dependencies conf 0.88 starlette: GHSA-7f5h-v6xp-fcq8

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

api/requirements.txt

high Security checks software dependencies conf 0.88 starlette: PYSEC-2026-161

BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks

api/requirements.txt

low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

api/app/tasks.py:130 Error handlingquality

high Security checks security auth conf 0.82 3 occurrences Browser storage is used for session token material

localStorage and sessionStorage are readable by injected JavaScript. For sensitive sessions, this turns XSS into account compromise.

2 files, 3 locations

front/src/auth.tsx:44, 49 (2 hits)

front/src/api.ts:6

medium Security checks cicd CI/CD security conf 0.94 2 occurrences Compose service `mailpit` image uses the latest tag

The latest tag is mutable and can change without a code review, producing different images from the same source.

lines 22, 82

docker-compose.yml:22, 82 (2 hits)

CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.74 Database service has no persistent data volume

Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state.

docker-compose.yml:18 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.90 Docker build context has no .dockerignore

Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts.

.dockerignore CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

front/Dockerfile:8 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

api/Dockerfile:1 CI/CD securitycontainers

medium Security checks software dependencies conf 0.88 ecdsa: GHSA-9f5j-8jwj-x28g

python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

api/requirements.txt

medium Security checks software dependencies conf 0.88 esbuild: GHSA-67mh-4wv8-2f99

esbuild enables any website to send any requests to the development server and read the response

front/package-lock.json

medium Security checks software dependencies conf 0.88 idna: GHSA-65pc-fj4g-8rjx

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

api/requirements.txt

high Security checks software dependencies conf 0.90 npm package `@types/react-dom` is 1 major version(s) behind (18.3.7 -> 19.2.3)

`@types/react-dom` is pinned/resolved at 18.3.7 but the latest stable release on the npm registry is 19.2.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

front/package.json

high Security checks software dependencies conf 0.90 npm package `@vitejs/plugin-react` is 2 major version(s) behind (4.7.0 -> 6.0.2)

`@vitejs/plugin-react` is pinned/resolved at 4.7.0 but the latest stable release on the npm registry is 6.0.2 (2 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rais…

front/package.json

medium Security checks software dependencies conf 0.90 Python package `bcrypt` is 1 major version(s) behind (4.0.1 -> 5.0.0)

`bcrypt==4.0.1` is 1 major version(s) behind the latest stable release on PyPI (5.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:9

medium Security checks software dependencies conf 0.90 Python package `redis` is 3 major version(s) behind (5.2.1 -> 8.0.0)

`redis==5.2.1` is 3 major version(s) behind the latest stable release on PyPI (8.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:12

medium Security checks software dependencies conf 0.88 python-jose: GHSA-cjwg-qfpm-7377

python-jose denial of service via compressed JWE content

api/requirements.txt

medium Security checks software dependencies conf 0.88 python-multipart: GHSA-mj87-hwqh-73pj

python-multipart affected by Denial of Service via large multipart preamble or epilogue data

api/requirements.txt

medium Security checks software dependencies conf 0.88 starlette: GHSA-2c2j-9gv5-cj73

Starlette has possible denial-of-service vector when parsing large files in multipart forms

api/requirements.txt

medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

front/package-lock.json

medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

CI/CD securityCoverage

low Security checks cicd CI/CD security conf 0.68 3 occurrences App service does not wait for database health

depends_on controls startup order, but without condition: service_healthy an app can start while the database is still initializing and fail intermittently.

lines 28, 45, 60

docker-compose.yml:28, 45, 60 (3 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.56 6 occurrences Compose service does not declare a runtime user

If the image does not define USER internally, this service may run as root.

lines 22, 28, 45, 60, 72, 82

docker-compose.yml:22, 28, 45, 60, 72, 82 (6 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 6 occurrences Compose service lacks no-new-privileges hardening

no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.

lines 22, 28, 45, 60, 72, 82

docker-compose.yml:22, 28, 45, 60, 72, 82 (6 hits)

CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.72 Database service has no healthcheck

Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy.

docker-compose.yml:18 CI/CD securitycontainers

low Security checks quality Quality conf 0.60 Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

front/src/pages/Login.tsx:128 duplicationquality

high Security checks software dependencies conf 0.90 npm package `axios` is minor version(s) behind (1.17.0 -> 1.18.0)

`axios` is pinned/resolved at 1.17.0 but the latest stable release on the npm registry is 1.18.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

front/package.json

low Security checks software dependencies conf 0.90 Python package `celery` is minor version(s) behind (5.4.0 -> 5.6.3)

`celery==5.4.0` is minor version(s) behind the latest stable release on PyPI (5.6.3). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:11

low Security checks software dependencies conf 0.90 Python package `email-validator` is minor version(s) behind (2.2.0 -> 2.3.0)

`email-validator==2.2.0` is minor version(s) behind the latest stable release on PyPI (2.3.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:13

low Security checks software dependencies conf 0.90 Python package `fastapi` is minor version(s) behind (0.115.5 -> 0.137.0)

`fastapi==0.115.5` is minor version(s) behind the latest stable release on PyPI (0.137.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:1

low Security checks software dependencies conf 0.90 Python package `pydantic-settings` is minor version(s) behind (2.6.1 -> 2.14.1)

`pydantic-settings==2.6.1` is minor version(s) behind the latest stable release on PyPI (2.14.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:6

low Security checks software dependencies conf 0.90 Python package `pydantic` is minor version(s) behind (2.10.3 -> 2.13.4)

`pydantic==2.10.3` is minor version(s) behind the latest stable release on PyPI (2.13.4). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:5

low Security checks software dependencies conf 0.90 Python package `python-jose` is minor version(s) behind (3.3.0 -> 3.5.0)

`python-jose==3.3.0` is minor version(s) behind the latest stable release on PyPI (3.5.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:7

low Security checks software dependencies conf 0.90 Python package `uvicorn` is minor version(s) behind (0.32.1 -> 0.49.0)

`uvicorn==0.32.1` is minor version(s) behind the latest stable release on PyPI (0.49.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

api/requirements.txt:2

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/d164b146-9ae7-4351-90e2-3c358bd9a2cb/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/d164b146-9ae7-4351-90e2-3c358bd9a2cb/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.