sibidharan/zealphp

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

39 of your 111 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 4.66s · analysis 7.28s · 10.5 MB · GitHub API rate-limit (preflight)

https://github.com/sibidharan/zealphp · scanned 2026-06-05 15:05 UTC (5 days, 2 hours ago) · 10 languages

202 raw signals (100 security + 102 graph) 57th percentile · Php · large (100-500K LoC) System graph score 76 (lower by 4)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 2 hours ago · v2 · 93 actionable findings from 2 signal sources. 58 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 46 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	44.3	0.25	11.07
`testing_score`	85.0	0.20	17.00
`documentation_score`	97.8	0.15	14.67
`practices_score`	91.0	0.15	13.65
`code_quality`	56.5	0.10	5.65
Overall		1.00	71.8

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 3 High 22 Medium 15 Low 24 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 47 System graph 46 Crowd 0 Layer: Quality 47 Cicd 9 Security 5 Software 10 Frontend 3 Network 3 Hardware 1 Api 15

Exclude dismissed / FP Exclude test files

All 1378 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`phpstan-stubs.php`	software	healthy	`phpstan-stubs.php`
`PERF.md`	software	healthy	`PERF.md`
`README.md`	software	healthy	`README.md`
`CONTRIBUTING.md`	software	healthy	`CONTRIBUTING.md`
`setup.sh`	software	healthy	`setup.sh`
`Dockerfile`	software	healthy	`Dockerfile`
`composer.json`	software	healthy	`composer.json`
`ROADMAP.md`	software	healthy	`ROADMAP.md`
`bench-install.sh`	software	healthy	`bench-install.sh`
`.env.example`	software	healthy	`.env.example`
`Makefile`	software	healthy	`Makefile`
`FUNDING.md`	software	healthy	`FUNDING.md`
`SUPPORT.md`	software	healthy	`SUPPORT.md`
`CODE_OF_CONDUCT.md`	software	healthy	`CODE_OF_CONDUCT.md`
`CRITIC.md`	software	healthy	`CRITIC.md`
`SECURITY.md`	software	healthy	`SECURITY.md`
`CHANGELOG.md`	software	healthy	`CHANGELOG.md`
`docker-compose.yml`	software	healthy	`docker-compose.yml`
`codecov.yml`	software	healthy	`codecov.yml`
`run_tests.sh`	software	healthy	`run_tests.sh`
`app.php`	software	healthy	`app.php`
`TODO.md`	software	healthy	`TODO.md`
`node_bench.js`	software	healthy	`node_bench.js`
`STANDARDS.md`	software	healthy	`STANDARDS.md`
`patch-opcache.sh`	software	healthy	`docker/patch-opcache.sh`
`bootstrap.php`	software	healthy	`tests/bootstrap.php`
`TestCase.php`	software	healthy	`tests/TestCase.php`
`cgi_isolation_server.php`	software	healthy	`tests/fixtures/cgi_isolation_server.php`
`fallback_include.php`	software	healthy	`tests/fixtures/fallback_include.php`
`mixed_mode_server.php`	software	healthy	`tests/fixtures/mixed_mode_server.php`
`return_string.php`	software	healthy	`tests/fixtures/render/return_string.php`
`return_closure.php`	software	healthy	`tests/fixtures/render/return_closure.php`
`void_return.php`	software	healthy	`tests/fixtures/render/void_return.php`
`echo_only.php`	software	healthy	`tests/fixtures/render/echo_only.php`
`echo_and_return.php`	software	healthy	`tests/fixtures/render/echo_and_return.php`
`return_generator.php`	software	healthy	`tests/fixtures/render/return_generator.php`
`return_int.php`	software	healthy	`tests/fixtures/render/return_int.php`
`uses_args.php`	software	healthy	`tests/fixtures/render/uses_args.php`
`return_array.php`	software	healthy	`tests/fixtures/render/return_array.php`
`frag.php`	software	healthy	`tests/fixtures/render/frag.php`
`halts.php`	software	healthy	`tests/fixtures/render/halts.php`
`HaltExceptionTest.php`	software	healthy	`tests/Unit/HaltExceptionTest.php`
`SessionFileCorruptionTest.php`	software	healthy	`tests/Unit/SessionFileCorruptionTest.php`
`RequestContextOnceTest.php`	software	healthy	`tests/Unit/RequestContextOnceTest.php`
`OverrideBuiltinTest.php`	software	healthy	`tests/Unit/OverrideBuiltinTest.php`
`UriSecurityConformanceTest.php`	software	healthy	`tests/Unit/UriSecurityConformanceTest.php`
`StoreV040ApiTest.php`	software	healthy	`tests/Unit/StoreV040ApiTest.php`
`SessionRegenerateIdHandlerTest.php`	software	healthy	`tests/Unit/SessionRegenerateIdHandlerTest.php`
`AppPubSubAliasesTest.php`	software	healthy	`tests/Unit/AppPubSubAliasesTest.php`
`RoutePatternTest.php`	software	healthy	`tests/Unit/RoutePatternTest.php`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`sleep`	software	healthy	`node_bench.js:sleep`
`respond`	software	healthy	`node_bench.js:respond`
`main`	software	healthy	`scripts/fuzz/send_raw.py:45`
`percentile`	software	healthy	`bench/tail/tail_bench.py:67`
`run_rate`	software	healthy	`bench/tail/tail_bench.py:75`
`one_request`	software	healthy	`bench/tail/tail_bench.py:94`
`fmt_ms`	software	healthy	`bench/tail/tail_bench.py:150`
`print_table`	software	healthy	`bench/tail/tail_bench.py:158`
`main`	software	healthy	`bench/tail/tail_bench.py:187`
`respond`	software	healthy	`bench/compare-3way/node_raw.js:respond`
`$`	software	healthy	`examples/tic-tac-toe/public/game.js:$`
`setStatus`	software	healthy	`examples/tic-tac-toe/public/game.js:setStatus`
`showStage`	software	healthy	`examples/tic-tac-toe/public/game.js:showStage`
`setBoard`	software	healthy	`examples/tic-tac-toe/public/game.js:setBoard`
`updateScoreCell`	software	healthy	`examples/tic-tac-toe/public/game.js:updateScoreCell`
`applyState`	software	healthy	`examples/tic-tac-toe/public/game.js:applyState`
`hasScore`	software	healthy	`examples/tic-tac-toe/public/game.js:hasScore`
`setYou`	software	healthy	`examples/tic-tac-toe/public/game.js:setYou`
`connect`	software	healthy	`examples/tic-tac-toe/public/game.js:connect`
`send`	software	healthy	`examples/tic-tac-toe/public/game.js:send`
`name`	software	healthy	`examples/tic-tac-toe/public/game.js:name`
`room`	software	healthy	`examples/tic-tac-toe/public/game.js:room`
`get_zealphp_reference`	software	healthy	`examples/agents/config_converter.py:2435`
`get_conversion_examples`	software	healthy	`examples/agents/config_converter.py:2441`
`validate_conversion`	software	healthy	`examples/agents/config_converter.py:2447`
`main`	software	healthy	`examples/agents/config_converter.py:2930`
`get_reference`	software	healthy	`examples/agents/convert_sse.py:364`
`get_rewrite_skill`	software	healthy	`examples/agents/convert_sse.py:370`
`main`	software	healthy	`examples/agents/convert_sse.py:518`
`get_zealphp_reference`	software	healthy	`examples/agents/chat_agent.py:36`
`main`	software	healthy	`examples/agents/chat_agent.py:122`
`_api`	software	healthy	`examples/agents/notes_agent.py:40`
`list_notes`	software	healthy	`examples/agents/notes_agent.py:62`
`read_note`	software	healthy	`examples/agents/notes_agent.py:73`
`search_notes`	software	healthy	`examples/agents/notes_agent.py:82`
`create_note`	software	healthy	`examples/agents/notes_agent.py:94`
`update_note`	software	healthy	`examples/agents/notes_agent.py:107`
`delete_note`	software	healthy	`examples/agents/notes_agent.py:126`
`build_agent`	software	healthy	`examples/agents/notes_agent.py:134`
`emit`	software	healthy	`examples/agents/notes_agent.py:163`
`main`	software	healthy	`examples/agents/notes_agent.py:169`
`get_zealphp_info`	software	healthy	`examples/agents/streaming_agent.py:22`
`generate_zealphp_route`	software	healthy	`examples/agents/streaming_agent.py:41`
`main`	software	healthy	`examples/agents/streaming_agent.py:76`
`initLearn`	software	healthy	`public/js/learn.js:initLearn`
`htmlFragment`	software	healthy	`public/js/learn.js:htmlFragment`
`makeEl`	software	healthy	`public/js/learn.js:makeEl`
`initChat`	software	healthy	`public/js/learn.js:initChat`
`loadHistory`	software	healthy	`public/js/learn.js:loadHistory`
`appendUser`	software	healthy	`public/js/learn.js:appendUser`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`docker`	software	healthy	`docker`
`tests`	software	healthy	`tests`
`fixtures`	software	healthy	`tests/fixtures`
`render`	software	healthy	`tests/fixtures/render`
`Unit`	software	healthy	`tests/Unit`
`Session`	software	healthy	`tests/Unit/Session`
`Middleware`	software	healthy	`tests/Unit/Middleware`
`Pipeline`	software	healthy	`tests/Unit/Middleware/Pipeline`
`WS`	software	healthy	`tests/Unit/WS`
`Db`	software	healthy	`tests/Unit/Db`
`CGI`	software	healthy	`tests/Unit/CGI`
`Store`	software	healthy	`tests/Unit/Store`
`Support`	software	healthy	`tests/Unit/Store/Support`
`Learn`	software	healthy	`tests/Unit/Learn`
`Docs`	software	healthy	`tests/Unit/Docs`
`HTTP`	software	healthy	`tests/Unit/HTTP`
`Counter`	software	healthy	`tests/Unit/Counter`
`gabbi`	software	healthy	`tests/gabbi`
`Helpers`	software	healthy	`tests/Helpers`
`Integration`	software	healthy	`tests/Integration`
`fixtures`	software	healthy	`tests/Integration/fixtures`
`compat`	software	healthy	`compat`
`api`	software	healthy	`api`
`php`	software	healthy	`api/php`
`session`	software	healthy	`api/php/session`
`cookie`	software	healthy	`api/php/cookie`
`open`	software	healthy	`api/open`
`response`	software	healthy	`api/response`
`blocked`	software	healthy	`api/blocked`
`learn`	software	healthy	`api/learn`
`zeal`	software	healthy	`api/zeal`
`docs`	software	healthy	`api/docs`
`swoole`	software	healthy	`api/swoole`
`secured`	software	healthy	`api/secured`
`stream`	software	healthy	`api/stream`
`device`	software	healthy	`api/device`
`new`	software	healthy	`api/device/new`
`bug`	software	healthy	`api/bug`
`domain`	software	healthy	`api/domain`
`docs`	software	healthy	`docs`
`superpowers`	software	healthy	`docs/superpowers`
`plans`	software	healthy	`docs/superpowers/plans`
`specs`	software	healthy	`docs/superpowers/specs`
`architecture`	software	healthy	`docs/architecture`
`scripts`	software	healthy	`scripts`
`fuzz`	software	healthy	`scripts/fuzz`
`isolation`	software	healthy	`scripts/isolation`
`app-lab`	software	healthy	`scripts/app-lab`
`task`	software	healthy	`task`
`route`	software	healthy	`route`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`port:8080`	network	healthy	`Dockerfile`
`port:9501`	network	healthy	`Makefile`
`port:8181`	network	healthy	`run_tests.sh`
`port:9820`	network	healthy	`scripts/isolation/run-matrix.sh`
`port:3307`	network	healthy	`scripts/app-lab/setup.sh`
`port:8094`	network	healthy	`scripts/app-lab/setup.sh`
`port:3306`	network	healthy	`scripts/app-lab/setup.sh`
`port:80`	network	healthy	`scripts/app-lab/setup.sh`
`port:8085`	network	healthy	`scripts/app-lab/perf-vm-zealphp.sh`
`port:50`	network	healthy	`scripts/app-lab/perf-vm-zealphp.sh`
`port:2074`	network	healthy	`scripts/app-lab/perf-vm-zealphp.sh`
`port:18080`	network	healthy	`bench/compare-3way/run-full.sh`
`port:09`	network	healthy	`.github/dependabot.yml`
`port:03`	network	healthy	`.github/workflows/codeql.yml`
`port:30`	network	healthy	`.github/workflows/codeql.yml`
`port:04`	network	healthy	`.github/workflows/scorecard.yml`
`port:37`	network	healthy	`.github/workflows/scorecard.yml`
`port:16379`	network	healthy	`.github/workflows/tests.yml`
`port:6379`	network	healthy	`.github/workflows/tests.yml`
`port:11211`	network	healthy	`.github/workflows/tests.yml`

Label	Layer	Status	Path
`analyze`	cicd	healthy	`.github/workflows/codeql.yml`
`analysis`	cicd	healthy	`.github/workflows/scorecard.yml`
`validate`	cicd	healthy	`.github/workflows/tests.yml`
`static-analysis`	cicd	healthy	`.github/workflows/tests.yml`
`phpunit`	cicd	healthy	`.github/workflows/tests.yml`
`infection`	cicd	healthy	`.github/workflows/mutation.yml`
`scan`	cicd	healthy	`.github/workflows/gitleaks.yml`
`perf-smoke`	cicd	healthy	`.github/workflows/perf.yml`
`sbom`	cicd	healthy	`.github/workflows/sbom.yml`
`fuzz`	cicd	healthy	`.github/workflows/fuzz.yml`

Label	Layer	Status	Path
`gha::codeql`	cicd	healthy	`.github/workflows/codeql.yml`
`gha::scorecard`	cicd	healthy	`.github/workflows/scorecard.yml`
`gha::tests`	cicd	healthy	`.github/workflows/tests.yml`
`gha::mutation`	cicd	healthy	`.github/workflows/mutation.yml`
`gha::gitleaks`	cicd	healthy	`.github/workflows/gitleaks.yml`
`gha::perf`	cicd	healthy	`.github/workflows/perf.yml`
`gha::sbom`	cicd	healthy	`.github/workflows/sbom.yml`
`gha::fuzz`	cicd	healthy	`.github/workflows/fuzz.yml`

Label	Layer	Status	Path
`/middleware`	frontend	healthy	`public/js/pages/middleware.js`
`/home`	frontend	healthy	`public/js/pages/home.js`
`/websocket`	frontend	healthy	`public/js/pages/websocket.js`
`/legacy-apps`	frontend	healthy	`public/js/pages/legacy-apps.js`
`/store`	frontend	healthy	`public/js/pages/store.js`
`/migration`	frontend	healthy	`public/js/pages/migration.js`
`/pubsub`	frontend	healthy	`public/js/pages/pubsub.js`

Label	Layer	Status	Path
`127.0.0.1`	network	healthy	`tests/gabbi/conformance.yaml`
`10.0.0.0`	network	healthy	`examples/agents/config_converter.py`
`172.16.0.0`	network	healthy	`examples/agents/config_converter.py`
`203.0.113.42`	network	healthy	`examples/agents/config_converter.py`
`1.2.3.4`	network	healthy	`examples/agents/config_converter.py`
`203.0.113.0`	network	healthy	`examples/agents/config_converter.py`

Label	Layer	Status	Path
`sqlite`	data	healthy	`.env.example`
`redis`	data	healthy	`Makefile`
`mysql`	data	healthy	`docs/architecture/2026-06-03-scalability-audit.json`
`postgres`	data	healthy	`docs/architecture/2026-06-03-scalability-audit.json`
`mariadb`	data	healthy	`.github/workflows/tests.yml`

Label	Layer	Status	Path
`envoy`	network	healthy	`docs/architecture/2026-06-03-scalability-audit.json`
`traefik`	network	healthy	`scripts/fuzz/slowhttptest.sh`
`nginx`	network	healthy	`scripts/fuzz/slowhttptest.sh`
`caddy`	network	healthy	`examples/agents/config_converter.py`
`haproxy`	network	healthy	`examples/agents/config_converter.py`

Label	Layer	Status	Path
`RateResult`	software	healthy	`bench/tail/tail_bench.py:55`
`AgentContext`	software	healthy	`examples/agents/notes_agent.py:34`
`is`	software	healthy	`public/js/site-nav.js:is`
`RateResult`	software	healthy	`labs-bench/tail_bench.py:55`

Label	Layer	Status	Path
`image::Dockerfile`	hardware	healthy	`Dockerfile`
`app`	hardware	healthy	`docker-compose.yml`
`bench`	hardware	healthy	`docker-compose.yml`
`compare`	hardware	healthy	`docker-compose.yml`

Label	Layer	Status	Path
`CODECOV_TOKEN`	cicd	healthy	`—`
`GITHUB_TOKEN`	cicd	healthy	`—`
`SCORECARD_TOKEN`	cicd	healthy	`—`

Label	Layer	Status	Path
`GET /raw/:rest`	api	healthy	`bench/compare-3way/node_express.js`
`GET /json`	api	healthy	`bench/compare-3way/node_express.js`

Label	Layer	Status	Path
`pubsub`	data	healthy	`docs/architecture/2026-06-03-critical-infra-edge-audit.json`
`kafka`	data	healthy	`docs/architecture/2026-06-03-scalability-audit.json`

Label	Layer	Status	Path
`repobility-clone-b5wz0qqh`	software	healthy	`/tmp/repobility-clone-b5wz0qqh`

Label	Layer	Status	Path
`migration.js`	data	healthy	`public/js/pages/migration.js`

Label	Layer	Status	Path
`password_literal::scripts/app-lab/setup.sh`	security	healthy	`scripts/app-lab/setup.sh`

Label	Layer	Status	Path
`auth::docs/architecture/2026-06-03-critical-infra-edge-audi…`	security	healthy	`docs/architecture/2026-06-03-critical-infra-edge-audit.json`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/e4dc0a0f-1ff8-4e8d-be22-c8d2e5e3c6a1/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/e4dc0a0f-1ff8-4e8d-be22-c8d2e5e3c6a1/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

sibidharan/zealphp

Complete repo analysis

file 50+

function 50+

directory 50+

port 20

job 10

pipeline 8

route 7

service 6

database 5

load_balancer 5

class 4

container 4

env_var 3

endpoint 2

queue 2

repo 1

migration 1

secret 1

auth 1