Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

brightseth/airc

https://github.com/brightseth/airc · scanned 2026-06-17 01:43 UTC (1 month, 1 week ago)

45 raw signals (0 security + 45 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 1 week ago · v2 · last Δ -22.9 (diff) · 45 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
53.8
/100
Security checks
54
0 findings
System graph
54
88.9% cov · 45 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 2 Medium 22 Low 21 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 45 Crowd 0 Layer: Frontend 12 Hardware 2 Security 15 Quality 10 Api 6
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 53.8/100 with 88.9% coverage. It contains 392 nodes across 6 cross-layer flows, written primarily in mixed languages. Engine surfaced 45 findings — concentrated in security (15), frontend (12), quality (10). Risk profile is high: 0 critical, 2 high, 22 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 44 of 45 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph api Wiring conf 1.00 Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateImages?key=${API_KEY} (generate-infographic.js:43)
`generate-infographic.js:43` calls `POST https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateImages?key=${API_KEY}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/generativelanguage.googl…
Dangling fetchFetch
high System graph security auth conf 1.00 FastAPI POST `chat` without auth dependency — tools/ambassador/server.py:97
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
tools/ambassador/server.py:97 securityAuth fastapi unauth mutation
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — airc-channel/server.ts:216
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — conformance/conformance.test.js:23
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — generate-infographic.js:43
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — widget.js:229
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/settings.local.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/settings.local.json VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: airc-channel/.mcp.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
airc-channel/.mcp.json VerificationMcp config
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: openclaw/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
openclaw/SKILL.md VerificationSkill file
medium System graph hardware Security conf 1.00 Dockerfile runs as root: tools/ambassador/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/health.js:14
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/health.js:14 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/lib/utils.js:88
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/lib/utils.js:88 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/register.js:5
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/register.js:5 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in api/well-known-airc.js:13
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
api/well-known-airc.js:13 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in tools/ambassador/server.py:62
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
tools/ambassador/server.py:62 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in conformance.html:192
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
conformance.html:192 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in federation.html:192
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
federation.html:192 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in index.html:1680
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
index.html:1680 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in security.html:192
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
security.html:192 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/server.py:399
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
tools/ambassador/server.py:399 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/widget.html:377
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
tools/ambassador/widget.html:377 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in validate.html:797
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
validate.html:797 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in widget.js:106
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
widget.js:106 Direct innerhtml assignment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 148 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
tools/ambassador/Dockerfile:1 containersPinned dependencies
low System graph quality Tests conf 1.00 Low test-to-source ratio
5 tests / 33 src (ratio 0.15).
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — conformance/conformance.test.js:52
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — conformance/north-star.test.js:78
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — docs/reference/gen-keypair.js:8
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — docs/reference/generate-test-vectors.js:84
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — docs/reference/test-basic.js:11
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — generate-infographic.js:41
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — test/conformance.js:273
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — tools/run-migration.js:39
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — tools/setup-demo-db.js:21
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — twitter-bot/oauth-setup.js:36
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — twitter-bot/post.js:30
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — twitter-bot/thread.js:36
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`tools/ambassador/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/feed
`tools/ambassador/server.py` declares `GET /api/feed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /embed
`tools/ambassador/server.py` declares `GET /embed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /embed.js
`tools/ambassador/server.py` declares `GET /embed.js` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /api/chat
`tools/ambassador/server.py` declares `POST /api/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/e5118899-320e-471e-affc-723d81f6c2aa/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/e5118899-320e-471e-affc-723d81f6c2aa/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.