← Back to scan
File as GitHub Issue repo: HKUDS/DeepTutor

Push this scan report to HKUDS/DeepTutor

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

`self.get_default` used but never assigned in __init__

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … deeptutor/core/agentic/client.py:272
HIGH MINED106 [MINED106] Phantom test coverage: test_search_connection: Test function `test_search_conn… deeptutor/api/routers/system.py:274
HIGH MINED106 [MINED106] Phantom test coverage: test_embeddings_connection: Test function `test_embeddi… deeptutor/api/routers/system.py:217
HIGH MINED106 [MINED106] Phantom test coverage: test_llm_connection: Test function `test_llm_connection… deeptutor/api/routers/system.py:149
HIGH MINED108 [MINED108] `self.get_default` used but never assigned in __init__: Method `get_info` of c… deeptutor/knowledge/manager.py:837
HIGH MINED108 [MINED108] `self._embedding_fields` used but never assigned in __init__: Method `get_info… deeptutor/knowledge/manager.py:829
HIGH MINED108 [MINED108] `self.get_default` used but never assigned in __init__: Method `get_info` of c… deeptutor/knowledge/manager.py:748
HIGH MINED108 [MINED108] `self._load_config` used but never assigned in __init__: Method `get_info` of … deeptutor/knowledge/manager.py:746
HIGH MINED108 [MINED108] `self._embedding_fields` used but never assigned in __init__: Method `get_meta… deeptutor/knowledge/manager.py:729
HIGH MINED108 [MINED108] `self.get_default` used but never assigned in __init__: Method `get_metadata` … deeptutor/knowledge/manager.py:708
HIGH MINED108 [MINED108] `self._load_config` used but never assigned in __init__: Method `get_metadata`… deeptutor/knowledge/manager.py:713
HIGH MINED108 [MINED108] `self.list_knowledge_bases` used but never assigned in __init__: Method `get_d… deeptutor/knowledge/manager.py:676
HIGH MINED108 [MINED108] `self.list_knowledge_bases` used but never assigned in __init__: Method `get_d… deeptutor/knowledge/manager.py:682
HIGH MINED108 [MINED108] `self.list_knowledge_bases` used but never assigned in __init__: Method `set_d… deeptutor/knowledge/manager.py:650
HIGH MINED108 [MINED108] `self.get_knowledge_base_path` used but never assigned in __init__: Method `ge… deeptutor/knowledge/manager.py:645
HIGH MINED108 [MINED108] `self.get_knowledge_base_path` used but never assigned in __init__: Method `ge… deeptutor/knowledge/manager.py:640
HIGH MINED108 [MINED108] `self.get_knowledge_base_path` used but never assigned in __init__: Method `ge… deeptutor/knowledge/manager.py:635
HIGH MINED108 [MINED108] `self.get_knowledge_base_path` used but never assigned in __init__: Method `ge… deeptutor/knowledge/manager.py:619
HIGH MINED108 [MINED108] `self.set_default` used but never assigned in __init__: Method `register_knowl… deeptutor/knowledge/manager.py:600
HIGH MINED108 [MINED108] `self._save_config` used but never assigned in __init__: Method `register_know… deeptutor/knowledge/manager.py:602
HIGH MINED108 [MINED108] `self._auto_register_kb` used but never assigned in __init__: Method `list_kno… deeptutor/knowledge/manager.py:516
HIGH MINED108 [MINED108] `self._save_config` used but never assigned in __init__: Method `list_knowledg… deeptutor/knowledge/manager.py:521
HIGH MINED108 [MINED108] `self._load_config` used but never assigned in __init__: Method `list_knowledg… deeptutor/knowledge/manager.py:458
HIGH MINED108 [MINED108] `self._load_config` used but never assigned in __init__: Method `get_kb_status… deeptutor/knowledge/manager.py:437
HIGH MINED108 [MINED108] `self._sync_kb_to_pb` used but never assigned in __init__: Method `update_kb_s… deeptutor/knowledge/manager.py:433
HIGH MINED108 [MINED108] `self._save_config` used but never assigned in __init__: Method `update_kb_sta… deeptutor/knowledge/manager.py:432
HIGH MINED108 [MINED108] `self._load_config` used but never assigned in __init__: Method `update_kb_sta… deeptutor/knowledge/manager.py:355
HIGH MINED108 [MINED108] `self._notify` used but never assigned in __init__: Method `update` of class `… deeptutor/knowledge/progress_tracker.py:214
HIGH MINED108 [MINED108] `self._save_progress` used but never assigned in __init__: Method `update` of … deeptutor/knowledge/progress_tracker.py:204
HIGH MINED020 [MINED020] Logging Credential Via Fstring: logger.error(f"failed for {api_key}") — secret… deeptutor/logging/stats/llm_stats.py:173
HIGH MINED009 [MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of D… deeptutor/logging/stats/llm_stats.py:64
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… deeptutor/services/llm/provider_core/op…:86
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… deeptutor/services/embedding/adapters/o…:30
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… deeptutor/services/config/embedding_end…:60
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… deeptutor/book/blocks/animation.py:5
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … deeptutor/core/trace.py:79
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … deeptutor/api/routers/skills.py:192
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… deeptutor/api/routers/notebook.py:170
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… deeptutor/api/routers/chat.py:47
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… deeptutor/api/routers/capabilities_sett…:34
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… deeptutor/api/routers/unified_ws.py:68
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… deeptutor/api/routers/chat.py:242
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… deeptutor/agents/research/utils/json_ut…:30
HIGH DKR006 Dockerfile pipes a remote script into a shell Dockerfile:77
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` r… .github/workflows/tests.yml:102
HIGH MINED115 [MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setu… .github/workflows/tests.yml:97
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:94
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` r… .github/workflows/tests.yml:53
HIGH MINED115 [MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setu… .github/workflows/tests.yml:48
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/tests.yml:45
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/docker-release.yml:28
HIGH MINED115 [MINED115] Action `pypa/gh-action-pypi-publish` pinned to mutable ref `@release/v1`: `use… .github/workflows/pypi-release.yml:151
HIGH MINED115 [MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-… .github/workflows/pypi-release.yml:61
HIGH MINED115 [MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setu… .github/workflows/pypi-release.yml:56
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout… .github/workflows/pypi-release.yml:38
HIGH MINED118 [MINED118] Dockerfile FROM `deeptutor.services.config (no tag)` not pinned by digest: `FR… Dockerfile:338
HIGH MINED118 [MINED118] Dockerfile FROM `deeptutor.services.setup (no tag)` not pinned by digest: `FRO… Dockerfile:331
HIGH MINED118 [MINED118] Dockerfile FROM `python:3.11-slim` not pinned by digest: `FROM python:3.11-sli… Dockerfile:103
HIGH MINED118 [MINED118] Dockerfile FROM `python:3.11-slim` not pinned by digest: `FROM python:3.11-sli… Dockerfile:63
HIGH MINED118 [MINED118] Dockerfile FROM `node:22-slim` not pinned by digest: `FROM node:22-slim` resol… Dockerfile:58
HIGH SEC016 [SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolat… deeptutor/services/llm/provider_core/az…:105
HIGH SEC016 [SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolat… deeptutor/book/agents/ideation_agent.py:51
HIGH SEC016 [SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolat… deeptutor/co_writer/edit_agent.py:183
HIGH MINED112 [MINED112] FastAPI POST /edit_react/stream has no auth: Handler `edit_text_react_stream` … deeptutor/api/routers/co_writer.py:392
HIGH MINED112 [MINED112] FastAPI POST /edit_react has no auth: Handler `edit_text_react` is registered … deeptutor/api/routers/co_writer.py:381
HIGH MINED112 [MINED112] FastAPI POST /edit has no auth: Handler `edit_text` is registered with router/… deeptutor/api/routers/co_writer.py:357
HIGH MINED112 [MINED112] FastAPI DELETE /{name} has no auth: Handler `delete_skill` is registered with … deeptutor/api/routers/skills.py:189
HIGH MINED112 [MINED112] FastAPI PUT /{name} has no auth: Handler `update_skill` is registered with rou… deeptutor/api/routers/skills.py:167
HIGH MINED112 [MINED112] FastAPI POST /create has no auth: Handler `create_skill` is registered with ro… deeptutor/api/routers/skills.py:148
HIGH MINED112 [MINED112] FastAPI DELETE /tags/{tag} has no auth: Handler `delete_tag` is registered wit… deeptutor/api/routers/skills.py:93
HIGH MINED112 [MINED112] FastAPI PUT /tags/{tag} has no auth: Handler `rename_tag` is registered with r… deeptutor/api/routers/skills.py:79
HIGH MINED112 [MINED112] FastAPI POST /tags/create has no auth: Handler `create_tag` is registered with… deeptutor/api/routers/skills.py:67
HIGH MINED112 [MINED112] FastAPI POST /books/rebuild has no auth: Handler `rebuild_book` is registered … deeptutor/api/routers/book.py:463
HIGH MINED112 [MINED112] FastAPI POST /books/page-chat-session has no auth: Handler `set_page_chat_sess… deeptutor/api/routers/book.py:450
HIGH MINED112 [MINED112] FastAPI POST /books/supplement has no auth: Handler `supplement` is registered… deeptutor/api/routers/book.py:433
HIGH MINED112 [MINED112] FastAPI POST /books/{book_id}/refresh-fingerprints has no auth: Handler `refre… deeptutor/api/routers/book.py:424
HIGH MINED112 [MINED112] FastAPI POST /books/quiz-attempt has no auth: Handler `quiz_attempt` is regist… deeptutor/api/routers/book.py:402
HIGH MINED112 [MINED112] FastAPI POST /books/deep-dive has no auth: Handler `deep_dive` is registered w… deeptutor/api/routers/book.py:382
HIGH MINED112 [MINED112] FastAPI POST /books/change-block-type has no auth: Handler `change_block_type`… deeptutor/api/routers/book.py:362
HIGH MINED112 [MINED112] FastAPI POST /books/move-block has no auth: Handler `move_block` is registered… deeptutor/api/routers/book.py:348
HIGH MINED112 [MINED112] FastAPI POST /books/delete-block has no auth: Handler `delete_block` is regist… deeptutor/api/routers/book.py:339
HIGH MINED112 [MINED112] FastAPI POST /books/insert-block has no auth: Handler `insert_block` is regist… deeptutor/api/routers/book.py:318
HIGH MINED112 [MINED112] FastAPI POST /books/regenerate-block has no auth: Handler `regenerate_block` i… deeptutor/api/routers/book.py:286
HIGH MINED112 [MINED112] FastAPI POST /books/compile-page has no auth: Handler `compile_page` is regist… deeptutor/api/routers/book.py:272
HIGH MINED112 [MINED112] FastAPI POST /books/confirm-spine has no auth: Handler `confirm_spine` is regi… deeptutor/api/routers/book.py:248
HIGH MINED112 [MINED112] FastAPI POST /books/confirm-proposal has no auth: Handler `confirm_proposal` i… deeptutor/api/routers/book.py:225
HIGH MINED112 [MINED112] FastAPI POST /books has no auth: Handler `create_book` is registered with rout… deeptutor/api/routers/book.py:199
HIGH MINED112 [MINED112] FastAPI DELETE /books/{book_id} has no auth: Handler `delete_book` is register… deeptutor/api/routers/book.py:190
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… deeptutor/api/routers/co_writer.py:447
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… deeptutor/api/routers/co_writer.py:432
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… deeptutor/multi_user/router.py:174
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… deeptutor/multi_user/router.py:144
HIGH AUC003 [AUC003] Object-level route lacks visible authorization: A route with an object id-like p… deeptutor/multi_user/router.py:138
MED SEC014 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma… deeptutor/core/agentic/client.py:64
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/runtime/launcher.py:396
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/runtime/launcher.py:459
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/runtime/launcher.py:429
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/multi_user/audit.py:24
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/multi_user/grants.py:56
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/multi_user/skill_access.py:57
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/services/auth.py:95
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/logging/process_stream.py:83
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/logging/loguru_bridge.py:13
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/add_documents.py:181
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/add_documents.py:167
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/add_documents.py:87
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/add_documents.py:304
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/initializer.py:85
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/initializer.py:305
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1420
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1414
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1406
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1249
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1399
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1081
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1287
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1160
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:1134
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… deeptutor/knowledge/manager.py:104
MED CFG006 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build art… —
MED SEC014 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma… deeptutor/services/llm/openai_http_clie…:42
MED SEC034 [SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logge… deeptutor/services/search/__init__.py:138
MED SEC139 [SEC139] AI-generated migration/route without companion test file: Route or migration tou… deeptutor/multi_user/router.py:144
MED SEC014 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma… deeptutor/services/llm/provider_core/op…:86
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… deeptutor/multi_user/skill_access.py:55
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… deeptutor/co_writer/edit_agent.py:44
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… deeptutor/api/utils/task_id_manager.py:93
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… deeptutor/api/routers/vision_solver.py:260
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… deeptutor/api/routers/chat.py:242
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … deeptutor/services/llm/providers/routin…:38
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … deeptutor/services/auth.py:196
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … deeptutor/agents/chat/session_manager.py:94
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DKR002 Dockerfile base image has no explicit tag Dockerfile:368
MED DKR002 Dockerfile base image has no explicit tag Dockerfile:338
MED DKR002 Dockerfile base image has no explicit tag Dockerfile:331
MED DKR002 Dockerfile base image has no explicit tag Dockerfile:330
MED DKR001 Docker final stage has no non-root USER Dockerfile:397
MED SEC017 [SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external … deeptutor/services/llm/provider_core/az…:105
MED SEC017 [SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external … deeptutor/book/agents/ideation_agent.py:51
MED SEC017 [SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external … deeptutor/co_writer/edit_agent.py:183
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 19.6% of discovered … —
MED AUC012 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /… —
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/question_notebook…:269
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/knowledge.py:1675
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/co_writer.py:585
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/co_writer.py:462
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/skills.py:188
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/skills.py:92
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/book.py:347
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/book.py:338
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/book.py:198
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … deeptutor/api/routers/book.py:189
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/api/routers/knowledge.py:811
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/api/routers/knowledge.py:702
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/api/routers/skills.py:123
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/api/routers/skills.py:107
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/multi_user/router.py:174
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/multi_user/router.py:169
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/multi_user/router.py:144
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/multi_user/router.py:138
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/multi_user/router.py:129
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… deeptutor/multi_user/router.py:117
LOW COMP001 [COMP001] High cognitive complexity: Function `parse_target_duration_seconds` has cogniti… deeptutor/agents/math_animator/duration…:17
LOW COMP001 [COMP001] High cognitive complexity: Function `build_capability_tool_schemas` has cogniti… deeptutor/agents/auto/schemas.py:69
LOW COMP001 [COMP001] High cognitive complexity: Function `build_atomic_tool_schemas` has cognitive c… deeptutor/agents/auto/schemas.py:99
LOW AIC003 Duplicated implementation block across source files deeptutor/capabilities/visualize.py:581
LOW AIC003 Duplicated implementation block across source files deeptutor/capabilities/visualize.py:290
LOW AIC003 Duplicated implementation block across source files deeptutor/services/llm/provider_core/op…:621
LOW AIC003 Duplicated implementation block across source files deeptutor/services/llm/provider_core/ba…:189
LOW AIC003 Duplicated implementation block across source files deeptutor/services/memory/consolidator/…:314
LOW AIC003 Duplicated implementation block across source files deeptutor/services/model_selection/runt…:10
LOW AIC003 Duplicated implementation block across source files deeptutor/services/memory/consolidator/…:30
LOW AIC003 Duplicated implementation block across source files deeptutor/services/memory/consolidator/…:155
LOW AIC003 Duplicated implementation block across source files deeptutor/services/llm/provider_core/op…:96
LOW AIC003 Duplicated implementation block across source files deeptutor/services/llm/provider_core/gi…:172
LOW AIC003 Duplicated implementation block across source files deeptutor/services/llm/provider_core/az…:115
LOW AIC003 Duplicated implementation block across source files deeptutor/services/embedding/adapters/o…:24
LOW AIC003 Duplicated implementation block across source files deeptutor/knowledge/initializer.py:251
LOW AIC003 Duplicated implementation block across source files deeptutor/co_writer/storage.py:38
LOW AIC003 Duplicated implementation block across source files deeptutor/capabilities/math_animator.py:428
LOW AIC003 Duplicated implementation block across source files deeptutor/book/blocks/interactive.py:37
LOW AIC003 Duplicated implementation block across source files deeptutor/book/agents/spine_synthesizer…:229
LOW AIC003 Duplicated implementation block across source files deeptutor/agents/visualize/utils.py:2
LOW AIC003 Duplicated implementation block across source files deeptutor/agents/math_animator/agents/v…:59
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
LOW DKR012 Dockerfile keeps pip download cache Dockerfile:97
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… deeptutor/services/config/origins.py:36
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. deeptutor/agents/_shared/tool_compositi…:65
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. deeptutor/services/llm/exceptions.py:139
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… deeptutor/services/llm/utils.py:121
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… deeptutor/services/config/embedding_end…:61
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. deeptutor/services/auth.py:11
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. deeptutor/app/facade.py:15
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. deeptutor/agents/vision_solver/models.py:255
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… deeptutor/api/routers/chat.py:243
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… deeptutor/agents/research/utils/json_ut…:31
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… deeptutor/agents/__init__.py:20
Reset to top 5 200 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `HKUDS/DeepTutor`

**Score: 68/100 (B-)**  ·  220 findings  ·  scanned 2026-05-29 03:41 UTC  ·  75,505 LOC

| Severity | Count |
|---|---|
| CRITICAL | 15 |
| HIGH | 98 |
| MEDIUM | 72 |
| LOW | 24 |

📊 [Full filterable report](https://repobility.com/scan/e6787ecc-a4cd-42f5-bd0d-ed4c112ba8ec/)  ·  ![scorecard](https://repobility.com/scan/e6787ecc-a4cd-42f5-bd0d-ed4c112ba8ec/report.png?v=1780026063-s2)

### Top findings

1. **HIGH** `SEC128` — Async function without await — fire-and-forget Promise (AI mistake)
   `deeptutor/core/agentic/client.py:272`
2. **HIGH** `MINED106` — Phantom test coverage: test_search_connection
   `deeptutor/api/routers/system.py:274` · ✓ Repobility
3. **HIGH** `MINED106` — Phantom test coverage: test_embeddings_connection
   `deeptutor/api/routers/system.py:217` · ✓ Repobility
4. **HIGH** `MINED106` — Phantom test coverage: test_llm_connection
   `deeptutor/api/routers/system.py:149` · ✓ Repobility
5. **HIGH** `MINED108` — `self.get_default` used but never assigned in __init__
   `deeptutor/knowledge/manager.py:837` · ✓ Repobility

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/e6787ecc-a4cd-42f5-bd0d-ed4c112ba8ec/_
Premium account
This scan was submitted by a Enterprise-tier account. Premium accounts have full outreach control â Repobility doesn't pre-fill the 'file as GitHub issue' button for paid users. You can still file the issue manually using the markdown body above (Copy markdown), or contact us if you'd like batch-filing enabled for your account.
Megaproject â high spam risk
Could not determine 'HKUDS/DeepTutor' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.