← Back to scan
File as GitHub Issue repo: inngest/inngest

Push this scan report to inngest/inngest

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED116 [MINED116] Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger: This workfl… .github/workflows/e2e.yml:390
CRIT MINED116 [MINED116] Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger: This workfl… .github/workflows/e2e.yml:361
CRIT MINED116 [MINED116] Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger: This workfl… .github/workflows/e2e.yml:275
CRIT MINED116 [MINED116] Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger: This workfl… .github/workflows/e2e.yml:187
CRIT MINED116 [MINED116] Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger: This workfl… .github/workflows/e2e.yml:93
CRIT MINED116 [MINED116] Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger: This workfl… .github/workflows/go.yaml:86
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… pkg/constraintapi/semaphore_manager.go:84
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… pkg/constraintapi/scavenge.go:282
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… pkg/connect/state/request.go:70
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). pkg/api/apiv1/metadata.go:5
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. pkg/api/v2/endpoints_function.go:98
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. pkg/api/apiv1/metadata.go:136
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. pkg/api/apiv1/apiv1auth/apiv1auth.go:68
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … pkg/connect/grpc/grpc.go:202
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … pkg/api/apiv1/apiv1.go:171
HIGH SEC080 [SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='da… npm/postinstall.ts:183
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… pkg/config/messaging.go:30
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… npm/postinstall.ts:49
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… docs/api-docs/src/routes/$.tsx:57
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… docs/api-docs/scripts/generate-docs.ts:154
HIGH DKR014 Dockerfile copies the entire context without .dockerignore vendor/github.com/pelletier/go-toml/Doc…:3
HIGH DKR014 Dockerfile copies the entire context without .dockerignore Dockerfile:5
HIGH DKR006 Dockerfile pipes a remote script into a shell .devcontainer/Dockerfile:15
HIGH MINED115 [MINED115] Action `peter-evans/repository-dispatch` pinned to mutable ref `@v3`: `uses: p… .github/workflows/dispatch_upstream.yml:13
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v3`: `uses: actions/checkout… .github/workflows/npm_test.yml:32
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/npm_test.yml:29
HIGH MINED115 [MINED115] Action `codecov/codecov-action` pinned to mutable ref `@v5`: `uses: codecov/co… .github/workflows/go.yaml:84
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go… .github/workflows/go.yaml:70
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/go.yaml:65
HIGH MINED115 [MINED115] Action `nicknovitski/nix-develop` pinned to mutable ref `@v1.2.1`: `uses: nick… .github/workflows/go.yaml:47
HIGH MINED115 [MINED115] Action `DeterminateSystems/nix-installer-action` pinned to mutable ref `@main`… .github/workflows/go.yaml:46
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/go.yaml:43
HIGH MINED115 [MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v8`: `uses: gol… .github/workflows/go.yaml:34
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go… .github/workflows/go.yaml:29
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/go.yaml:24
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go… .github/workflows/prerelease.yml:98
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/prerelease.yml:89
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go… .github/workflows/prerelease.yml:29
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/prerelease.yml:23
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/dev_server_ui.yml:22
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4.0.0`: `uses: pnpm/action… .github/workflows/dev_server_ui.yml:19
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/dev_server_ui.yml:18
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/components_test.yml:20
HIGH MINED115 [MINED115] Action `pnpm/action-setup` pinned to mutable ref `@v4`: `uses: pnpm/action-set… .github/workflows/components_test.yml:17
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/components_test.yml:16
HIGH MINED115 [MINED115] Action `github/codeql-action/upload-sarif` pinned to mutable ref `@v3`: `uses:… .github/workflows/security.yaml:28
HIGH MINED115 [MINED115] Action `securego/gosec` pinned to mutable ref `@v2.20.0`: `uses: securego/gose… .github/workflows/security.yaml:22
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/security.yaml:19
HIGH MINED118 [MINED118] Dockerfile FROM `mcr.microsoft.com/vscode/devcontainers/go:0-` not pinned by d… .devcontainer/Dockerfile:5
HIGH MINED118 [MINED118] Dockerfile FROM `alpine:3.21` not pinned by digest: `FROM alpine:3.21` resolve… Dockerfile:10
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/api/apiv1/apiv1.go:171
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/api/apiv1/apiv1.go:170
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/api/apiv1/apiv1.go:169
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/api/apiv1/apiv1.go:168
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/connect/rest/v0/v0.go:95
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/connect/rest/v0/v0.go:94
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/api/api.go:78
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/coreapi/coreapi.go:120
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/coreapi/coreapi.go:119
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… pkg/coreapi/coreapi.go:117
MED CFG006 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build art… —
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … pkg/constraintapi/semaphore_manager.go:84
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … pkg/constraintapi/scavenge.go:282
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … pkg/connect/state/request.go:70
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… pkg/coreapi/coreapi.go:144
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… pkg/api/api.go:109
MED SEC112 [SEC112] Go html/template bypass — text/template used for HTML output, or template.HTML o… cmd/doctor/healthcheck/cmd.go:112
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DKR009 Dockerfile separates apt update from install .devcontainer/Dockerfile:8
MED DKR001 Docker final stage has no non-root USER Dockerfile:11
MED AIC001 Parallel implementation file sits beside a canonical file pkg/connect/gateway_msg_status_update.go:1
MED AIC004 Suspicious implementation file appears unreferenced pkg/connect/gateway_msg_status_update.go:1
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routes/api/search.ts:10
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:145
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:144
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:143
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:142
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:93
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:85
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:83
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:73
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:64
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:56
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:46
MED JRN003 Frontend API reference is not matched by discovered backend routes docs/api-docs/src/routeTree.gen.ts:45
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 23.5% of discovered … —
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/api/apiv1/apiv1.go:170
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/api/apiv1/apiv1.go:169
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/api/apiv1/apiv1.go:168
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/api/apiv1/apiv1.go:167
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/api/apiv1/apiv1.go:165
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/coreapi/coreapi.go:121
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/coreapi/coreapi.go:120
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/coreapi/coreapi.go:119
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/coreapi/coreapi.go:117
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … pkg/authn/authn.go:30
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. cmd/start/start.go:55
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. cmd/doctor/healthcheck/cmd.go:106
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. cmd/devserver/devserver.go:136
LOW AIC003 Duplicated implementation block across source files pkg/coreapi/graph/resolvers/runs_v2.go:149
LOW AIC003 Duplicated implementation block across source files pkg/coreapi/graph/resolvers/runs_v2.go:48
LOW AIC003 Duplicated implementation block across source files pkg/constraintapi/lua.go:55
LOW AIC003 Duplicated implementation block across source files pkg/constraintapi/check.go:31
LOW AIC003 Duplicated implementation block across source files pkg/connect/rest/v0/workergroup.go:14
LOW AIC003 Duplicated implementation block across source files pkg/connect/gateway_msg_ready.go:32
LOW AIC003 Duplicated implementation block across source files cmd/start/start.go:37
LOW AIC003 Duplicated implementation block across source files cmd/start/cmd.go:85
LOW AIC003 Duplicated implementation block across source files cmd/debug/singleton/info.go:15
LOW AIC003 Duplicated implementation block across source files cmd/debug/singleton/delete.go:2
LOW AIC003 Duplicated implementation block across source files cmd/debug/pause/peek.go:17
LOW AIC003 Duplicated implementation block across source files cmd/debug/debounce/run.go:15
LOW AIC003 Duplicated implementation block across source files cmd/debug/debounce/info.go:16
LOW AIC003 Duplicated implementation block across source files cmd/debug/batch/run.go:14
LOW AIC003 Duplicated implementation block across source files cmd/debug/batch/info.go:15
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… pkg/coreapi/graph/resolvers/app_mutatio…:27
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… pkg/config/messaging.go:176
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. docs/api-docs/src/routeTree.gen.ts:23
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. docs/api-docs/src/components/mdx.tsx:105
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … docs/api-docs/scripts/generate-docs.ts:40
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … npm/postinstall.ts:243
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … docs/api-docs/scripts/generate-docs.ts:196
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. pkg/cli/output/text.go:294
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. pkg/api/tel/tel.go:39
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. cmd/main.go:13
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… pkg/config/messaging.go:111
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… cmd/root.go:84
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… cmd/devserver/devserver.go:26
Reset to top 5 128 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `inngest/inngest`

**Score: 79/100 (A-)**  ·  128 findings  ·  scanned 2026-06-05 14:18 UTC  ·  109,689 LOC

| Severity | Count |
|---|---|
| CRITICAL | 6 |
| HIGH | 54 |
| MEDIUM | 37 |
| LOW | 18 |

📊 [Full filterable report](https://repobility.com/scan/dff1705c-35ea-414c-a352-2231a387a0c4/)  ·  ![scorecard](https://repobility.com/scan/dff1705c-35ea-414c-a352-2231a387a0c4/report.png?v=1780669097-s2)

### Top findings

1. **CRITICAL** `MINED116` — Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger
   `.github/workflows/e2e.yml:390` · ✓ Repobility
2. **CRITICAL** `MINED116` — Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger
   `.github/workflows/e2e.yml:361` · ✓ Repobility
3. **CRITICAL** `MINED116` — Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger
   `.github/workflows/e2e.yml:275` · ✓ Repobility
4. **CRITICAL** `MINED116` — Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger
   `.github/workflows/e2e.yml:187` · ✓ Repobility
5. **CRITICAL** `MINED116` — Workflow uses `secrets.CODECOV_TOKEN` on a `pull_request` trigger
   `.github/workflows/e2e.yml:93` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/dff1705c-35ea-414c-a352-2231a387a0c4/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 20 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'inngest/inngest' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
51/134 findings (38%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.