Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
17 of your 101 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.19s · analysis 32.29s · 4.5 MB · GitHub API rate-limit (preflight)

alexlana0/RemindMe

https://github.com/alexlana0/RemindMe · scanned 2026-06-16 02:51 UTC (2 months, 1 week ago) · 10 languages

245 raw signals (95 security + 150 graph) 92nd percentile · Python · small (2-20K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v5 · 78 actionable findings from 2 signal sources. 21 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
75.9
/100
Security checks
55
74 findings
System graph
97
88.9% cov · 4 findings
Critical
4
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 55.0 0.15 8.25
security_score 13.5 0.25 3.38
testing_score 0.0 0.20 0.00
documentation_score 68.0 0.15 10.20
practices_score 50.0 0.15 7.50
code_quality 76.4 0.10 7.64
Overall 1.00 37.0
Severity distribution — click a segment to filter
Active filters: severity: info × excluding tests × Reset all
Severity: Critical 4 High 23 Medium 13 Low 12 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 74 System graph 4 Crowd 0 Layer: Security 5 Software 36 Cicd 12 Quality 23 Hardware 1 Frontend 1
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 96.7/100 with 88.9% coverage. It contains 26 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 4 findings — concentrated in quality (1), hardware (1), frontend (1). Risk profile is low: 0 critical, 0 high, 1 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 26 of 78 actionable findings. 99 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

info Security checks quality Quality conf 1.00 3 occurrences [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes — DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production.
Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint.
3 files, 3 locations
api/app/celery_app.py:11
api/app/routers/connections.py:230
api/app/routers/notes.py:78
info Security checks quality Quality conf 1.00 3 occurrences [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected — attackers can call it directly.
Add the project's auth decorator/middleware: `@login_required` (Django/Flask), `@permission_classes([IsAuthenticated])` (DRF), `Depends(get_current_user)` (FastAPI), `requireAuth` middleware (Express). For genuinely public endpoints, add a `# public-endpoint` marker comment so future scans skip the…
3 files, 3 locations
api/app/routers/auth.py:138
api/app/routers/calendar.py:39
api/app/routers/connections.py:85
info Security checks quality Testing No test files found
Add a test directory (tests/ or __tests__/) with unit tests for core functionality. Use pytest (Python), Jest (JS/TS), or go test (Go). Start with tests for critical business logic and security-sensitive functions.
info Security checks quality Quality conf 0.95 [COMP001] High cognitive complexity: Function `calendar_feed` has cognitive complexity 16 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=1, for=3, if=4, nested_bonus=7, ternary=1.
Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 — yours is 16.
api/app/routers/calendar.py:62
info Security checks security Crypto conf 1.00 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.
Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness.
api/app/security.py:19
info Security checks security Crypto conf 1.00 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.
Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness.
api/app/routers/calendar.py:40
info Security checks quality Practices No CI/CD configuration found
Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request.
info Security checks quality Quality conf 0.95 [COMP001] High cognitive complexity: Function `request_connection` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, if=5, nested_bonus=2.
Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 — yours is 8.
api/app/routers/connections.py:97
info Security checks quality Quality conf 0.95 [COMP001] High cognitive complexity: Function `visible_items` has cognitive complexity 10 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: and=1, else=2, for=1, if=4, nested_bonus=2.
Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 — yours is 10.
api/app/privacy.py:93
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
front/vite.config.ts:11
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
front/nginx.conf:8
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explicitly requested.
Review and fix per the pattern semantics.
api/app/holidays.py:75
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.
Review and fix per the pattern semantics. See CWE-1188 / for context.
api/app/routers/auth.py:134
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.
Review and fix per the pattern semantics. See CWE-1188 / for context.
api/app/database.py:11
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.
Review and fix per the pattern semantics. See CWE-704 / for context.
front/src/pages/Login.tsx:115
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.
Review and fix per the pattern semantics. See CWE-704 / for context.
front/src/pages/ForgotPassword.tsx:19
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.
Review and fix per the pattern semantics. See CWE-682 / for context.
front/src/theme.tsx:51
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.
Review and fix per the pattern semantics. See CWE-682 / for context.
front/src/pages/Welcome.tsx:14
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints.
Review and fix per the pattern semantics. See CWE-942,CWE-346 / A05:2021 for context.
api/app/main.py:32
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints.
Review and fix per the pattern semantics. See CWE-942,CWE-346 / A05:2021 for context.
api/app/config.py:27
info Security checks quality Quality conf 1.00 ✓ Repobility [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.
Review and fix per the pattern semantics. See CWE-1188 / for context.
api/app/database.py:10
info Security checks software dependencies conf 0.90 Python package `psycopg2-binary` is patch version(s) behind (2.9.10 -> 2.9.12)
`psycopg2-binary==2.9.10` is patch version(s) behind the latest stable release on PyPI (2.9.12). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
api/requirements.txt:4
info Security checks software dependencies conf 0.90 Python package `python-multipart` is patch version(s) behind (0.0.18 -> 0.0.32)
`python-multipart==0.0.18` is patch version(s) behind the latest stable release on PyPI (0.0.32). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
api/requirements.txt:10
info Security checks software dependencies conf 0.90 Python package `slowapi` is patch version(s) behind (0.1.9 -> 0.1.10)
`slowapi==0.1.9` is patch version(s) behind the latest stable release on PyPI (0.1.10). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.
api/requirements.txt:14
info System graph quality Git conf 1.00 git log failed — history analysis incomplete
fatal: not a git repository (or any parent up to mount point /data) Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
Tooling
info System graph frontend Coverage conf 1.00 No frontend routes/components detected
No React/Vue/Next routes were found. This is fine for backend-only repos.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/d164b146-9ae7-4351-90e2-3c358bd9a2cb/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/d164b146-9ae7-4351-90e2-3c358bd9a2cb/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.