← Back to scan
File as GitHub Issue repo: kalynnka/octomate

Push this scan report to kalynnka/octomate

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Compose service contains a literal secret environment value

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 Missing import: `http` used but not imported octomate/tentacles/channel/slack/ink.py:88
CRIT MINED107 Missing import: `signal` used but not imported octomate/base.py:79
CRIT DKC007 Compose service contains a literal secret environment value docker-compose.yml:111
CRIT DKC007 Compose service contains a literal secret environment value docker-compose.yml:97
CRIT DKC007 Compose service contains a literal secret environment value docker-compose.yml:61
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… octomate/tentacles/channel/slack/ink.py:88
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… octomate/tentacles/channel/napcat/base.…:80
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… octomate/tentacles/channel/lark/base.py:146
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:367
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:185
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:340
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:186
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:158
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:162
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:139
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:141
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/agent/claude/base.py:132
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:294
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:289
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:251
HIGH MINED108 `self.octomate` used but never assigned in __init__ octomate/tentacles/channel/base.py:240
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:242
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:236
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:225
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:217
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:212
HIGH MINED108 `self.id` used but never assigned in __init__ octomate/tentacles/channel/base.py:189
HIGH MINED108 `self.parts` used but never assigned in __init__ octomate/schemas/messages.py:138
HIGH MINED108 `self.parts` used but never assigned in __init__ octomate/schemas/messages.py:112
HIGH MINED108 `self.parts` used but never assigned in __init__ octomate/schemas/messages.py:106
HIGH MINED108 `self.position` used but never assigned in __init__ octomate/schemas/deferred.py:143
HIGH MINED108 `self.position` used but never assigned in __init__ octomate/schemas/deferred.py:140
HIGH MINED108 `self.noticed` used but never assigned in __init__ tests/support/channels.py:296
HIGH COMP001 [COMP001] High cognitive complexity: Function `validate_channel_agent_routes` has cogniti… octomate/config/__init__.py:76
HIGH DKC013 Database service has no persistent data volume docker-compose.yml:97
HIGH MINED118 Dockerfile FROM `ghcr.io/astral-sh/uv:python3.13-bookworm-slim` not pinned by digest Dockerfile:1
HIGH GHSA-5rvq-cxj2-64vf python-multipart: GHSA-5rvq-cxj2-64vf uv.lock
HIGH PYSEC-2026-179 pyjwt: PYSEC-2026-179 uv.lock
HIGH PYSEC-2026-178 pyjwt: PYSEC-2026-178 uv.lock
HIGH PYSEC-2026-177 pyjwt: PYSEC-2026-177 uv.lock
HIGH PYSEC-2026-175 pyjwt: PYSEC-2026-175 uv.lock
HIGH GHSA-f4xh-w4cj-qxq8 langsmith: GHSA-f4xh-w4cj-qxq8 uv.lock
HIGH PYSEC-2026-215 idna: PYSEC-2026-215 uv.lock
HIGH GHSA-537c-gmf6-5ccf cryptography: GHSA-537c-gmf6-5ccf uv.lock
HIGH DKC011 Database service publishes a host port docker-compose.yml:97
HIGH MINED112 FastAPI POST /api/chat has no auth octomate/tentacles/channel/web/vercel/r…:53
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… octomate/tentacles/channel/web/vercel/r…:94
MED MINED111 Bare except continues silently octomate/capabilities/react.py:339
MED COMP001 [COMP001] High cognitive complexity: Function `kick` has cognitive complexity 15 (SonarSo… octomate/base.py:70
MED DKR003 Compose service `pgadmin` image uses the latest tag docker-compose.yml:111
MED DKR003 Compose service `attu` image uses the latest tag docker-compose.yml:85
MED DKR003 Compose service `milvus-rustfs` image uses the latest tag docker-compose.yml:61
MED DKR003 Compose service `napcat` image uses the latest tag docker-compose.yml:28
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED GHSA-jq35-7prp-9v3f pyjwt: GHSA-jq35-7prp-9v3f uv.lock
MED GHSA-993g-76c3-p5m4 pyjwt: GHSA-993g-76c3-p5m4 uv.lock
MED GHSA-4xgf-cpjx-pc3j pydantic-settings: GHSA-4xgf-cpjx-pc3j uv.lock
MED GHSA-xcgm-r5h9-7989 aiohttp: GHSA-xcgm-r5h9-7989 uv.lock
MED GHSA-jg22-mg44-37j8 aiohttp: GHSA-jg22-mg44-37j8 uv.lock
MED GHSA-hpj7-wq8m-9hgp aiohttp: GHSA-hpj7-wq8m-9hgp uv.lock
MED GHSA-hg6j-4rv6-33pg aiohttp: GHSA-hg6j-4rv6-33pg uv.lock
MED GHSA-g3cq-j2xw-wf74 aiohttp: GHSA-g3cq-j2xw-wf74 uv.lock
MED GHSA-63hw-fmq6-xxg2 aiohttp: GHSA-63hw-fmq6-xxg2 uv.lock
MED GHSA-4fvr-rgm6-gqmc aiohttp: GHSA-4fvr-rgm6-gqmc uv.lock
MED DKC015 Database service has no healthcheck docker-compose.yml:97
MED DKR001 Docker final stage has no non-root USER Dockerfile:1
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED AUC012 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /… —
MED AGT012 Agent control bridge may listen on a network interface without visible auth docker-compose.yml:18
MED CORE_NO_CI No CI/CD configuration found —
LOW COMP001 [COMP001] High cognitive complexity: Function `create_app` has cognitive complexity 8 (So… main.py:30
LOW GHSA-vffw-93wf-4j4q python-multipart: GHSA-vffw-93wf-4j4q uv.lock
LOW GHSA-v9pg-7xvm-68hf python-multipart: GHSA-v9pg-7xvm-68hf uv.lock
LOW GHSA-6jv3-5f52-599m python-multipart: GHSA-6jv3-5f52-599m uv.lock
LOW GHSA-m6qw-4cw2-hm4m aiohttp: GHSA-m6qw-4cw2-hm4m uv.lock
LOW GHSA-9x8q-7h8h-wcw9 aiohttp: GHSA-9x8q-7h8h-wcw9 uv.lock
LOW GHSA-4m7w-qmgq-4wj5 aiohttp: GHSA-4m7w-qmgq-4wj5 uv.lock
LOW GHSA-2fqr-mr3j-6wp8 aiohttp: GHSA-2fqr-mr3j-6wp8 uv.lock
LOW AIC003 Duplicated implementation block across source files octomate/tentacles/channel/lark/feelers…:91
LOW AIC003 Duplicated implementation block across source files octomate/tentacles/agent/inkling/base.py:99
LOW AIC003 Duplicated implementation block across source files octomate/models/todos.py:37
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKC016 App service does not wait for database health docker-compose.yml:111
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:111
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:85
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:71
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:28
LOW DKC010 Compose service lacks no-new-privileges hardening docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:111
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:85
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:71
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:28
LOW DKC006 Compose service does not declare a runtime user docker-compose.yml:1
LOW CORE_NO_LICENSE No LICENSE file —
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… octomate/tentacles/channel/web/vercel/b…:59
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… octomate/tentacles/channel/napcat/base.…:81
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… octomate/tentacles/channel/lark/base.py:147
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. octomate/capabilities/history.py:91
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. octomate/capabilities/events.py:46
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. octomate/base.py:34
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… main.py:139
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… docker-compose.yml:56
Reset to top 5 102 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `kalynnka/octomate`

**Score: 52/100 (C-)**  ·  105 findings  ·  scanned 2026-06-25 17:45 UTC  ·  27,509 LOC

| Severity | Count |
|---|---|
| CRITICAL | 5 |
| HIGH | 42 |
| MEDIUM | 23 |
| LOW | 24 |

📊 [Full filterable report](https://repobility.com/scan/dcff4a50-675c-47e5-a49f-0776d8a6d870/)  ·  ![scorecard](https://repobility.com/scan/dcff4a50-675c-47e5-a49f-0776d8a6d870/report.png?v=1782409538-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `http` used but not imported
   `octomate/tentacles/channel/slack/ink.py:88` · ✓ Repobility
2. **CRITICAL** `MINED107` — Missing import: `signal` used but not imported
   `octomate/base.py:79` · ✓ Repobility
3. **CRITICAL** `DKC007` — Compose service contains a literal secret environment value
   `docker-compose.yml:111`
4. **CRITICAL** `DKC007` — Compose service contains a literal secret environment value
   `docker-compose.yml:97`
5. **CRITICAL** `DKC007` — Compose service contains a literal secret environment value
   `docker-compose.yml:61`

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/dcff4a50-675c-47e5-a49f-0776d8a6d870/_
Megaproject â high spam risk
Could not determine 'kalynnka/octomate' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.