redhat-appstudio/infra-deployments

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

66 of your 184 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.02s · analysis 8.12s · 10.9 MB · GitHub API rate-limit (preflight)

https://github.com/redhat-appstudio/infra-deployments · scanned 2026-06-05 13:25 UTC (5 days, 6 hours ago) · 10 languages

236 raw signals (148 security + 88 graph) 10th percentile · Go · small (2-20K LoC) System graph score 77 (lower by 17)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 6 hours ago · v2 · 104 actionable findings from 2 signal sources. 88 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 21 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	40.0	0.15	6.00
`security_score`	31.7	0.25	7.92
`testing_score`	80.0	0.20	16.00
`documentation_score`	76.7	0.15	11.51
`practices_score`	79.0	0.15	11.85
`code_quality`	69.4	0.10	6.94
Overall		1.00	60.2

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 9 High 55 Medium 8 Low 15 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 83 System graph 21 Crowd 0 Layer: Quality 30 Cicd 6 Software 53 Security 11 Api 1 Network 2 Frontend 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade C+ (60/100). Dimensions: security 32, maintainability 40. 148 findings (75 security). 8,976 lines analyzed.

Showing 85 of 104 actionable findings. 192 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED013] Password In Url: https://user:password@host — leaks creds via logs, referrer, error messages.

Review and fix per the pattern semantics. See CWE-200 / A07:2021 for context.

components/konflux-operator/ci/openshift-overlay-e2e/ci-common.sh:119

critical Security checks security secrets conf 0.95 10 occurrences Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Gitleaks detected a committed secret or credential pattern.

6 files, 10 locations

components/pipeline-service/development/main-pipeline-service-configuration.yaml:1119, 1315 (2 hits)

components/pipeline-service/production/base/main-pipeline-service-configuration.yaml:1104, 1294 (2 hits)

components/pipeline-service/production/kflux-fedora-01/deploy.yaml:1540, 1730 (2 hits)

components/pipeline-service/production/kflux-osp-p01/deploy.yaml:1525, 1715 (2 hits)

components/kubearchive/production/kflux-ocp-p01/kubearchive.yaml:983

hack/new-cluster/templates/kubearchive/kubearchive.yaml:973

high Security checks quality Quality conf 1.00 ✓ Repobility Missing import: `platform` used but not imported

The file uses `platform.something(...)` but never imports `platform`. This raises NameError at runtime the first time the line executes.

hack/kueue-vm-quotas/update-kueue-vm-quotas.py:99

critical Security checks security secrets conf 0.95 4 occurrences Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments

Gitleaks detected a committed secret or credential pattern.

3 files, 4 locations

hack/new-cluster/templates/kubearchive/kubearchive.yaml:970, 991 (2 hits)

components/kubearchive/production/kflux-ocp-p01/kubearchive.yaml:980

components/pipeline-service/development/dev-only-pipeline-service-storage-configuration.yaml:136

critical System graph security Secrets conf 1.00 Possible secret in argo-cd-apps/base/member/optional/helm/rekor/rekor.yaml