Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

rottenfishtaco/Dropshop-V2

https://github.com/rottenfishtaco/Dropshop-V2 · scanned 2026-06-15 23:55 UTC (2 months, 3 weeks ago)

100 raw signals (0 security + 100 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 3 weeks ago · v1 · 100 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
75.9
/100
Security checks
76
0 findings
System graph
76
88.9% cov · 100 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 25 Medium 8 Low 24 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 100 Crowd 0 Layer: Frontend 10 Quality 59 Api 31

All 736 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

LabelLayerStatusPath
README.md software healthy README.md
pnpm-lock.yaml software healthy pnpm-lock.yaml
CLAUDE.md software healthy CLAUDE.md
package.json software healthy package.json
pnpm-workspace.yaml software healthy pnpm-workspace.yaml
LICENSE software healthy LICENSE
tsconfig.base.json software healthy tsconfig.base.json
package.json software healthy apps/tma/package.json
tsconfig.json software healthy apps/tma/tsconfig.json
vitest.config.ts software healthy apps/tma/vitest.config.ts
ton-connect.ts software healthy apps/tma/src/lib/ton-connect.ts
ton-connect.test.ts software healthy apps/tma/src/lib/ton-connect.test.ts
INCIDENTS.md software healthy docs/INCIDENTS.md
THREAT_MODEL.md software healthy docs/THREAT_MODEL.md
MASTER_PLAN.md software healthy docs/MASTER_PLAN.md
INVARIANTS.md software healthy docs/INVARIANTS.md
AUDITOR_CHARTER.md software healthy docs/AUDITOR_CHARTER.md
PUBLIC_VIEWS.md software healthy docs/architecture/PUBLIC_VIEWS.md
SECRETS.md software healthy docs/architecture/SECRETS.md
SENSITIVE_ACTIONS.md software healthy docs/architecture/SENSITIVE_ACTIONS.md
SCHEMA_CONVENTIONS.md software healthy docs/architecture/SCHEMA_CONVENTIONS.md
JWT_CLAIMS.md software healthy docs/architecture/JWT_CLAIMS.md
RLS_EXPECTATIONS.md software healthy docs/architecture/RLS_EXPECTATIONS.md
phase-5-handoff.md software healthy docs/audits/phase-5-handoff.md
phase-4-handoff.md software healthy docs/audits/phase-4-handoff.md
phase-3-handoff.md software healthy docs/audits/phase-3-handoff.md
phase-1-probe-results.md software healthy docs/audits/phase-1-probe-results.md
phase-1-views-probe-results.md software healthy docs/audits/phase-1-views-probe-results.md
phase-1-handoff.md software healthy docs/audits/phase-1-handoff.md
phase-3-audit-kit.md software healthy docs/audits/phase-3-audit-kit.md
phase-2-handoff.md software healthy docs/audits/phase-2-handoff.md
phase-1-findings.md software healthy docs/audits/phase-1-findings.md
phase-1-closure.md software healthy docs/audits/phase-1-closure.md
phase-3-findings.md software healthy docs/audits/phase-3-findings.md
phase-3-closure.md software healthy docs/audits/phase-3-closure.md
phase-5-e2e-runbook.md software healthy docs/audits/phase-5-e2e-runbook.md
phase-5-closure.md software healthy docs/audits/phase-5-closure.md
phase-4-findings.md software healthy docs/audits/phase-4-findings.md
phase-4-closure.md software healthy docs/audits/phase-4-closure.md
phase-0-findings.md software healthy docs/audits/phase-0-findings.md
phase-5-audit-kit.md software healthy docs/audits/phase-5-audit-kit.md
phase-2-closure.md software healthy docs/audits/phase-2-closure.md
phase-2-findings.md software healthy docs/audits/phase-2-findings.md
phase-4-audit-kit.md software healthy docs/audits/phase-4-audit-kit.md
phase-2-public-storefront-results.md software healthy docs/audits/phase-2-public-storefront-results.md
phase-5-findings.md software healthy docs/audits/phase-5-findings.md
phase-0-closure.md software healthy docs/audits/phase-0-closure.md
phase-2-probe-results.md software healthy docs/audits/phase-2-probe-results.md
phase-5-probe-results.md software healthy docs/audits/phase-5-probe-results.md
e2e-rpc.mjs software healthy scripts/e2e/e2e-rpc.mjs

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
assertBaseUnits software healthy apps/tma/src/lib/ton-connect.ts:assertBaseUnits
buildCommentCell software healthy apps/tma/src/lib/ton-connect.ts:buildCommentCell
buildTonMessage software healthy apps/tma/src/lib/ton-connect.ts:buildTonMessage
buildJettonMessage software healthy apps/tma/src/lib/ton-connect.ts:buildJettonMessage
buildPaymentRequest software healthy apps/tma/src/lib/ton-connect.ts:buildPaymentRequest
sendPayment software healthy apps/tma/src/lib/ton-connect.ts:sendPayment
decodeComment software healthy apps/tma/src/lib/ton-connect.test.ts:decodeComment
decodeJettonBody software healthy apps/tma/src/lib/ton-connect.test.ts:decodeJettonBody
resolver software healthy apps/tma/src/lib/ton-connect.test.ts:resolver
parseArgs software healthy scripts/e2e/e2e-rpc.mjs:parseArgs
buildInitData software healthy scripts/e2e/e2e-rpc.mjs:buildInitData
decodeJwt software healthy scripts/e2e/e2e-rpc.mjs:decodeJwt
main software healthy scripts/e2e/e2e-rpc.mjs:main
apiBase software healthy scripts/e2e/e2e-rpc.mjs:apiBase
buildInitData software healthy workers/api/src/index.test.ts:buildInitData
nowSec software healthy workers/api/src/index.test.ts:nowSec
name software healthy workers/api/src/index.test.ts:name
bodyWithAuth software healthy workers/api/src/index.test.ts:bodyWithAuth
bodyNoAuth software healthy workers/api/src/index.test.ts:bodyNoAuth
body software healthy workers/api/src/index.test.ts:body
makeTgLimiter software healthy workers/api/src/index.test.ts:makeTgLimiter
n software healthy workers/api/src/index.test.ts:n
flush software healthy workers/api/src/index.test.ts:flush
findAuthLogCall software healthy workers/api/src/index.test.ts:findAuthLogCall
parseClaimedTelegramId software healthy workers/api/src/index.ts:parseClaimedTelegramId
id software healthy workers/api/src/index.ts:id
logAuthAttempt software healthy workers/api/src/index.ts:logAuthAttempt
scheduled software healthy workers/api/src/index.ts:scheduled
consumeJti software healthy workers/api/src/auth/jwt.test.ts:consumeJti
buildInitData software healthy workers/api/src/auth/telegram.test.ts:buildInitData
nowSec software healthy workers/api/src/auth/telegram.test.ts:nowSec
isMerchantClaims software healthy workers/api/src/auth/jwt.ts:isMerchantClaims
mintJwt software healthy workers/api/src/auth/jwt.ts:mintJwt
verifyJwt software healthy workers/api/src/auth/jwt.ts:verifyJwt
verifyWithSecret software healthy workers/api/src/auth/jwt.ts:verifyWithSecret
isBotKind software healthy workers/api/src/auth/telegram.ts:isBotKind
verifyInitData software healthy workers/api/src/auth/telegram.ts:verifyInitData
hmacSha256Bytes software healthy workers/api/src/auth/telegram.ts:hmacSha256Bytes
bytesToHex software healthy workers/api/src/auth/telegram.ts:bytesToHex
constantTimeEqual software healthy workers/api/src/auth/telegram.ts:constantTimeEqual
routePathToRegex software healthy workers/api/src/middleware/auth.ts:routePathToRegex
isPublicRoute software healthy workers/api/src/middleware/auth.ts:isPublicRoute
reads software healthy workers/api/src/middleware/cors.ts:reads
__resetBreachStateForTesting software healthy workers/api/src/middleware/rateLimit.ts:__resetBreachStateF…
fireAndForget software healthy workers/api/src/middleware/rateLimit.ts:fireAndForget
recordBreach software healthy workers/api/src/middleware/rateLimit.ts:recordBreach
isPostgresError software healthy workers/api/src/middleware/consumeJti.ts:isPostgresError
pgError software healthy workers/api/src/middleware/consumeJti.test.ts:pgError
buildApp software healthy workers/api/src/middleware/consumeJti.test.ts:buildApp
buildApp software healthy workers/api/src/middleware/cors.test.ts:buildApp

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
0036_consumed_jti.sql data healthy db/migrations/0036_consumed_jti.sql
0064_relax_refunded_consistency.sql data healthy db/migrations/0064_relax_refunded_consistency.sql
0026_orders_minimum_amount_triggers.sql data healthy db/migrations/0026_orders_minimum_amount_triggers.sql
0019_rls_probe_expectations.sql data healthy db/migrations/0019_rls_probe_expectations.sql
0043_confirm_delete_account.sql data healthy db/migrations/0043_confirm_delete_account.sql
0024_rls_configuration_tables.sql data healthy db/migrations/0024_rls_configuration_tables.sql
0053_compute_escrow_ledger_totals.sql data healthy db/migrations/0053_compute_escrow_ledger_totals.sql
0029_grant_registry_allow_rows.sql data healthy db/migrations/0029_grant_registry_allow_rows.sql
0033_rpcs_order_lifecycle_happy_path.sql data healthy db/migrations/0033_rpcs_order_lifecycle_happy_path.sql
0052_pms_unmatched_quarantine_rpc.sql data healthy db/migrations/0052_pms_unmatched_quarantine_rpc.sql
0003_merchants_table.sql data healthy db/migrations/0003_merchants_table.sql
0030_orders_state_machine_f1023_reconciliation.sql data healthy db/migrations/0030_orders_state_machine_f1023_reconciliatio…
0013_sweep_cycles.sql data healthy db/migrations/0013_sweep_cycles.sql
0047_auth_attempt_audit_logging.sql data healthy db/migrations/0047_auth_attempt_audit_logging.sql
0059_settlement_db_layer.sql data healthy db/migrations/0059_settlement_db_layer.sql
0001_extensions_and_types.sql data healthy db/migrations/0001_extensions_and_types.sql
0055_bms_intake_rpcs.sql data healthy db/migrations/0055_bms_intake_rpcs.sql
0037_resolve_principal.sql data healthy db/migrations/0037_resolve_principal.sql
0038_public_storefront_view.sql data healthy db/migrations/0038_public_storefront_view.sql
0022_rls_governance_forensics_tables.sql data healthy db/migrations/0022_rls_governance_forensics_tables.sql
0045_dro324_redeem_lockout.sql data healthy db/migrations/0045_dro324_redeem_lockout.sql
0034_rpcs_order_lifecycle_cancellations.sql data healthy db/migrations/0034_rpcs_order_lifecycle_cancellations.sql
0054_bms_notification_drain_rpcs.sql data healthy db/migrations/0054_bms_notification_drain_rpcs.sql
0016_unmatched_payments.sql data healthy db/migrations/0016_unmatched_payments.sql
0009_cleanup_failed_constraint.sql data healthy db/migrations/0009_cleanup_failed_constraint.sql
0005_drop_merchant_cashout_override.sql data healthy db/migrations/0005_drop_merchant_cashout_override.sql
0012_payout_requests.sql data healthy db/migrations/0012_payout_requests.sql
0031_search_path_pin_and_pii_invariants.sql data healthy db/migrations/0031_search_path_pin_and_pii_invariants.sql
0008_products_table.sql data healthy db/migrations/0008_products_table.sql
0025_orders_state_machine_trigger.sql data healthy db/migrations/0025_orders_state_machine_trigger.sql
0018_support_tickets.sql data healthy db/migrations/0018_support_tickets.sql
0040_sensitive_action_confirm_rpcs.sql data healthy db/migrations/0040_sensitive_action_confirm_rpcs.sql
0015_sensitive_access_log.sql data healthy db/migrations/0015_sensitive_access_log.sql
0027_revoke_registry_deny_grants.sql data healthy db/migrations/0027_revoke_registry_deny_grants.sql
0023_rls_operational_tenant_policies.sql data healthy db/migrations/0023_rls_operational_tenant_policies.sql
0006_verification_codes.sql data healthy db/migrations/0006_verification_codes.sql
0063_bms_open_support_ticket_party_check.sql data healthy db/migrations/0063_bms_open_support_ticket_party_check.sql
0011_merchant_balances.sql data healthy db/migrations/0011_merchant_balances.sql
0061_disable_dormant_tokens.sql data healthy db/migrations/0061_disable_dormant_tokens.sql
0046_rate_limit_breach_audit_overlay.sql data healthy db/migrations/0046_rate_limit_breach_audit_overlay.sql
0007_currency_and_rates.sql data healthy db/migrations/0007_currency_and_rates.sql
0049_registry_dual_mode_resolve_principal.sql data healthy db/migrations/0049_registry_dual_mode_resolve_principal.sql
0044_rpcs_support_and_notifications.sql data healthy db/migrations/0044_rpcs_support_and_notifications.sql
0032_definer_function_columns_on_rls_probe_expectations.sql data healthy db/migrations/0032_definer_function_columns_on_rls_probe_ex…
0058_recon_hardening.sql data healthy db/migrations/0058_recon_hardening.sql
0051_seed_pms_token_config.sql data healthy db/migrations/0051_seed_pms_token_config.sql
0041_manual_withdrawal_payout_rpcs.sql data healthy db/migrations/0041_manual_withdrawal_payout_rpcs.sql
0065_payment_token_active_guard.sql data healthy db/migrations/0065_payment_token_active_guard.sql
0062_fee_sweep_money_move.sql data healthy db/migrations/0062_fee_sweep_money_move.sql
0014_fee_pool.sql data healthy db/migrations/0014_fee_pool.sql

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
apps software healthy apps
tma software healthy apps/tma
src software healthy apps/tma/src
lib software healthy apps/tma/src/lib
docs software healthy docs
architecture software healthy docs/architecture
audits software healthy docs/audits
scripts software healthy scripts
e2e software healthy scripts/e2e
workers software healthy workers
api software healthy workers/api
src software healthy workers/api/src
auth software healthy workers/api/src/auth
middleware software healthy workers/api/src/middleware
routes software healthy workers/api/src/routes
db software healthy workers/api/src/db
pms software healthy workers/pms
src software healthy workers/pms/src
verifiers software healthy workers/pms/src/verifiers
lib software healthy workers/pms/src/lib
db software healthy workers/pms/src/db
bms software healthy workers/bms
src software healthy workers/bms/src
notify software healthy workers/bms/src/notify
middleware software healthy workers/bms/src/middleware
telegram software healthy workers/bms/src/telegram
db software healthy workers/bms/src/db
sweep software healthy workers/bms/src/sweep
handlers software healthy workers/bms/src/handlers
payout software healthy workers/payout
src software healthy workers/payout/src
lib software healthy workers/payout/src/lib
db software healthy db
fixtures software healthy db/fixtures
synthetic software healthy db/fixtures/synthetic
probes software healthy db/probes
tools software healthy db/probes/tools
ci software healthy db/probes/ci
migrations software healthy db/migrations
.github software healthy .github
workflows software healthy .github/workflows

LabelLayerStatusPath
auth::workers/api/src/middleware/rateLimit.test.ts security healthy workers/api/src/middleware/rateLimit.test.ts
auth::workers/api/src/auth/jwt.ts security healthy workers/api/src/auth/jwt.ts
auth::workers/api/src/db/client.test.ts security healthy workers/api/src/db/client.test.ts
auth::scripts/e2e/e2e-rpc.mjs security healthy scripts/e2e/e2e-rpc.mjs
auth::workers/api/src/middleware/consumeJti.ts security healthy workers/api/src/middleware/consumeJti.ts
auth::CLAUDE.md security healthy CLAUDE.md
auth::workers/api/src/middleware/cors.test.ts security healthy workers/api/src/middleware/cors.test.ts
auth::workers/api/src/middleware/auth.test.ts security healthy workers/api/src/middleware/auth.test.ts
auth::workers/api/src/middleware/rateLimit.ts security healthy workers/api/src/middleware/rateLimit.ts
auth::workers/api/src/middleware/cors.ts security healthy workers/api/src/middleware/cors.ts
auth::workers/api/src/scheduled.test.ts security healthy workers/api/src/scheduled.test.ts
auth::workers/api/src/routes/me.test.ts security healthy workers/api/src/routes/me.test.ts
auth::workers/api/src/middleware/auth.ts security healthy workers/api/src/middleware/auth.ts
auth::workers/api/src/routes/rpc.test.ts security healthy workers/api/src/routes/rpc.test.ts
auth::workers/bms/src/db/client.ts security healthy workers/bms/src/db/client.ts
auth::workers/api/src/middleware/consumeJti.test.ts security healthy workers/api/src/middleware/consumeJti.test.ts
auth::workers/api/src/routes/rpc-allowlist.ts security healthy workers/api/src/routes/rpc-allowlist.ts
auth::README.md security healthy README.md
auth::workers/api/wrangler.toml security healthy workers/api/wrangler.toml
auth::workers/api/src/auth/telegram.ts security healthy workers/api/src/auth/telegram.ts
auth::workers/api/src/routes/stall.ts security healthy workers/api/src/routes/stall.ts
auth::workers/api/src/index.ts security healthy workers/api/src/index.ts
auth::workers/api/src/auth/jwt.test.ts security healthy workers/api/src/auth/jwt.test.ts
auth::workers/api/src/db/client.ts security healthy workers/api/src/db/client.ts
auth::workers/api/src/routes/rpc.ts security healthy workers/api/src/routes/rpc.ts
auth::workers/api/src/routes/stall.test.ts security healthy workers/api/src/routes/stall.test.ts
auth::workers/api/src/index.test.ts security healthy workers/api/src/index.test.ts
auth::workers/api/src/routes/me.ts security healthy workers/api/src/routes/me.ts
auth::db/migrations/README.md security healthy db/migrations/README.md

LabelLayerStatusPath
consumed_jti data healthy db/migrations/0036_consumed_jti.sql
rls_probe_expectations data healthy db/migrations/0019_rls_probe_expectations.sql
merchants data healthy db/migrations/0003_merchants_table.sql
sweep_cycles data healthy db/migrations/0013_sweep_cycles.sql
sweep_cycle_tokens data healthy db/migrations/0013_sweep_cycles.sql
escrow_send_lock data healthy db/migrations/0059_settlement_db_layer.sql
merchant_warnings data healthy db/migrations/0059_settlement_db_layer.sql
refunds data healthy db/migrations/0059_settlement_db_layer.sql
unmatched_payments data healthy db/migrations/0016_unmatched_payments.sql
payout_requests data healthy db/migrations/0012_payout_requests.sql
products data healthy db/migrations/0008_products_table.sql
support_tickets data healthy db/migrations/0018_support_tickets.sql
support_ticket_messages data healthy db/migrations/0018_support_tickets.sql
sensitive_access_log data healthy db/migrations/0015_sensitive_access_log.sql
verification_codes data healthy db/migrations/0006_verification_codes.sql
merchant_balances data healthy db/migrations/0011_merchant_balances.sql
exchange_rates data healthy db/migrations/0007_currency_and_rates.sql
block data healthy db/migrations/0032_definer_function_columns_on_rls_probe_ex…
fee_pool data healthy db/migrations/0014_fee_pool.sql
notification_queue data healthy db/migrations/0017_notification_queue.sql
standalone data healthy db/migrations/0042_deleted_merchants.sql
deleted_merchants data healthy db/migrations/0042_deleted_merchants.sql
platform_config data healthy db/migrations/0004_platform_config.sql
platform_currency_config data healthy db/migrations/0004_platform_config.sql
orders data healthy db/migrations/0010_orders_and_order_items.sql
order_items data healthy db/migrations/0010_orders_and_order_items.sql
sweep_transactions data healthy db/migrations/0050_sweep_transactions.sql

LabelLayerStatusPath
JwtVerifyError software healthy workers/api/src/auth/jwt.ts:JwtVerifyError
InitDataVerifyError software healthy workers/api/src/auth/telegram.ts:InitDataVerifyError
TonCenterClient software healthy workers/pms/src/verifiers/toncenter.ts:TonCenterClient
TonCenterBalanceReader software healthy workers/pms/src/verifiers/balance.ts:TonCenterBalanceReader
TonApiBalanceReader software healthy workers/pms/src/verifiers/balance.ts:TonApiBalanceReader
TonApiClient software healthy workers/pms/src/verifiers/tonapi.ts:TonApiClient
PmsDb software healthy workers/pms/src/db/client.ts:PmsDb
NotOrderPartyError software healthy workers/bms/src/db/partyCheck.ts:NotOrderPartyError
TonCenterBalanceReader software healthy workers/payout/src/lib/balance.ts:TonCenterBalanceReader
TonApiBalanceReader software healthy workers/payout/src/lib/balance.ts:TonApiBalanceReader

LabelLayerStatusPath
GET /health api healthy workers/api/src/index.ts
POST /auth/telegram api healthy workers/api/src/index.ts
POST /rpc/:function_name api healthy workers/api/src/index.ts
GET /me api healthy workers/api/src/index.ts
GET /stall/:store_code api healthy workers/api/src/index.ts
POST /rpc/:fn api healthy workers/api/src/middleware/auth.ts
POST /webhook/:bot api healthy workers/bms/src/index.ts
GET /internal/health api healthy workers/payout/src/index.ts
POST /internal/payout/execute api healthy workers/payout/src/index.ts
POST /internal/refund/execute api healthy workers/payout/src/index.ts

LabelLayerStatusPath
203.0.113.42 network healthy workers/api/src/middleware/rateLimit.test.ts
203.0.113.1 network healthy workers/api/src/middleware/rateLimit.test.ts
203.0.113.2 network healthy workers/api/src/middleware/rateLimit.test.ts
1.2.3.4 network healthy workers/api/src/middleware/rateLimit.test.ts
203.0.113.9 network healthy workers/api/src/middleware/rateLimit.test.ts

LabelLayerStatusPath
postgres data healthy README.md
postgresql data healthy workers/pms/src/db/client.test.ts

LabelLayerStatusPath
NEON_STAGING_PROBE_URL cicd healthy —
NEON_PROD_PROBE_URL cicd healthy —

LabelLayerStatusPath
repobility-clone-x3hopjwz software healthy /tmp/repobility-clone-x3hopjwz

LabelLayerStatusPath
gha::db-probes cicd healthy .github/workflows/db-probes.yml

LabelLayerStatusPath
probes cicd healthy .github/workflows/db-probes.yml
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/d8b9484b-5722-4b33-bb0b-fbada3f9f189/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/d8b9484b-5722-4b33-bb0b-fbada3f9f189/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.