gramps-project/gramps-web

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

18 of your 158 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.89s · analysis 50.98s · 5.6 MB · GitHub preflight 414ms

https://github.com/gramps-project/gramps-web · scanned 2026-06-05 13:15 UTC (5 days, 7 hours ago) · 10 languages

259 raw signals (153 security + 106 graph) 26th percentile · Javascript · medium (20-100K LoC) System graph score 67 (lower by 15)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 7 hours ago · v2 · 129 actionable findings from 2 signal sources. 77 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 41 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	9.0	0.25	2.25
`testing_score`	25.0	0.20	5.00
`documentation_score`	73.7	0.15	11.05
`practices_score`	85.0	0.15	12.75
`code_quality`	58.3	0.10	5.83
Overall		1.00	51.9

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 4 High 22 Medium 40 Low 42 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 88 System graph 41 Crowd 0 Layer: Quality 24 Security 10 Software 76 Cicd 6 Api 1 Frontend 7 Hardware 5

Exclude dismissed / FP Exclude test files

Scan summary Quality grade C- (52/100). Dimensions: security 9, maintainability 100. 153 findings (81 security). 57,728 lines analyzed.

Showing 108 of 129 actionable findings. 206 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks software dependencies conf 0.88 koa: GHSA-593f-38f6-jp5m

Inefficient Regular Expression Complexity in koa

package-lock.json

critical Security checks software dependencies conf 0.88 vitest: GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

package-lock.json

critical System graph security Secrets conf 1.00 Possible secret in src/components/GrampsjsFormUser.js

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/components/GrampsjsFormUser.js:84

critical System graph security Secrets conf 1.00 Possible secret in src/components/GrampsjsRelogin.js

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/components/GrampsjsRelogin.js:77

high Security checks software dependencies conf 0.88 @babel/plugin-transform-modules-systemjs: GHSA-fv7c-fp4j-7gwp

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

package-lock.json

high Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

src/components/GrampsjsFormSelectObject.js:106

high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences Dockerfile FROM `mcr.microsoft.com/devcontainers/javascript-node:22` not pinned by digest

`FROM mcr.microsoft.com/devcontainers/javascript-node:22` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

3 files, 3 locations

.devcontainer/Dockerfile:1

Dockerfile:1

Dockerfile.devel:1

high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6

fast-uri vulnerable to path traversal via percent-encoded dot segments

package-lock.json

high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

package-lock.json

high Security checks software dependencies conf 0.88 flatted: GHSA-25h7-pfq9-p65f

flatted vulnerable to unbounded recursion DoS in parse() revive phase

package-lock.json

high Security checks software dependencies conf 0.88 flatted: GHSA-rf6f-7fwh-wjgh

Prototype Pollution via parse() in NodeJS flatted

package-lock.json

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 10 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 10 locations

.github/workflows/image-devel.yml:14, 15 (3 hits)

.github/workflows/image-release.yml:14, 15 (3 hits)

.github/workflows/release.yml:12, 13 (2 hits)

.github/workflows/test.yml:14, 15 (2 hits)

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 happy-dom: GHSA-6q6h-j7hj-3r64

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

package-lock.json

high Security checks software dependencies conf 0.88 happy-dom: GHSA-w4gp-fjgq-3q4g

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

package-lock.json

high Security checks software dependencies conf 0.88 koa: GHSA-7gcc-r8m5-44qm

Koa has Host Header Injection via ctx.hostname

package-lock.json

high Security checks software dependencies conf 0.88 lodash: GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

package-lock.json

high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

package-lock.json

high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/components/GrampsjsPasswordManagerPolyfill.js:63

high Security checks software dependencies conf 0.88 serialize-javascript: GHSA-5c6j-r48x-rmvq

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

package-lock.json

medium Security checks software dependencies conf 0.88 @babel/helpers: GHSA-968p-4wvh-cqc8

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

package-lock.json

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

medium Security checks software Open redirect conf 1.00 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.

Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …

src/oidc.js:52

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2

brace-expansion: Large numeric range defeats documented `max` DoS protection

package-lock.json

high Security checks security auth conf 0.82 12 occurrences Browser storage is used for session token material

localStorage and sessionStorage are readable by injected JavaScript. For sensitive sessions, this turns XSS into account compromise.

lines 22, 23, 27, 31, 47, 602, 608, 613, +4 more

src/api.js:22, 23, 27, 31, 47, 602, 608, 613, +4 more (12 hits)

high Security checks cicd CI/CD security conf 0.82 4 occurrences Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

4 files, 4 locations

.devcontainer/Dockerfile:1

Dockerfile:1

Dockerfile.devel:1

Dockerfile.nginx:1

CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.94 Dockerfile base image uses the latest tag

The latest tag is mutable and can change without a code review, producing different images from the same source.

Dockerfile:1 CI/CD securitycontainers

high Security checks software dependencies conf 0.90 4 occurrences GitHub Action `actions/checkout@v4` is 2 major version(s) behind (latest v6.0.3)

`uses: actions/checkout@v4` is 2 major version(s) behind the latest published release v6.0.3. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.

4 files, 4 locations

.github/workflows/image-devel.yml:14

.github/workflows/image-release.yml:14

.github/workflows/release.yml:12

.github/workflows/test.yml:14

high Security checks software dependencies conf 0.90 4 occurrences GitHub Action `actions/setup-node@v4` is 2 major version(s) behind (latest v6.4.0)

`uses: actions/setup-node@v4` is 2 major version(s) behind the latest published release v6.4.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.

4 files, 4 locations

.github/workflows/image-devel.yml:15

.github/workflows/image-release.yml:15

.github/workflows/release.yml:13

.github/workflows/test.yml:15

high Security checks software dependencies conf 0.90 GitHub Action `softprops/action-gh-release@v1` is 2 major version(s) behind (latest v3.0.0)

`uses: softprops/action-gh-release@v1` is 2 major version(s) behind the latest published release v3.0.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no covera…

.github/workflows/release.yml:28

medium Security checks software dependencies conf 0.88 jsondiffpatch: GHSA-33vc-wfww-vjfv

jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

package-lock.json

medium Security checks software dependencies conf 0.88 koa: GHSA-x2rg-q646-7m2v

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

package-lock.json

high Security checks quality Quality conf 0.80 localStorage write failures are swallowed silently

localStorage quotas are small and writes can fail. Catching storage errors without a user-visible warning causes silent data loss when notes, images, or snapshots exceed quota.

src/api.js:22

medium Security checks software dependencies conf 0.88 lodash: GHSA-f23m-r3pf-42rh

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

package-lock.json

medium Security checks software dependencies conf 0.88 lodash: GHSA-xxjr-mmjv-4gpg

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

package-lock.json

medium Security checks software dependencies conf 0.90 npm package `@rollup/plugin-replace` is 1 major version(s) behind (5.0.7 -> 6.0.3)

`@rollup/plugin-replace` is pinned/resolved at 5.0.7 but the latest stable release on the npm registry is 6.0.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs ra…

package.json

medium Security checks software dependencies conf 0.90 npm package `d3-selection` is 1 major version(s) behind (2.0.0 -> 3.0.0)

`d3-selection` is pinned/resolved at 2.0.0 but the latest stable release on the npm registry is 3.0.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `eslint-config-prettier` is 3 major version(s) behind (7.2.0 -> 10.1.8)

`eslint-config-prettier` is pinned/resolved at 7.2.0 but the latest stable release on the npm registry is 10.1.8 (3 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs r…

package.json

medium Security checks software dependencies conf 0.90 npm package `eslint-plugin-lit-a11y` is 1 major version(s) behind (4.1.4 -> 5.1.1)

`eslint-plugin-lit-a11y` is pinned/resolved at 4.1.4 but the latest stable release on the npm registry is 5.1.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs ra…

package.json

medium Security checks software dependencies conf 0.90 npm package `eslint-plugin-n` is 2 major version(s) behind (16.6.2 -> 18.0.1)

`eslint-plugin-n` is pinned/resolved at 16.6.2 but the latest stable release on the npm registry is 18.0.1 (2 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `eslint-plugin-promise` is 1 major version(s) behind (6.6.0 -> 7.3.0)

`eslint-plugin-promise` is pinned/resolved at 6.6.0 but the latest stable release on the npm registry is 7.3.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rai…

package.json

medium Security checks software dependencies conf 0.90 npm package `husky` is 5 major version(s) behind (4.3.8 -> 9.1.7)

`husky` is pinned/resolved at 4.3.8 but the latest stable release on the npm registry is 9.1.7 (5 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `jwt-decode` is 1 major version(s) behind (3.1.2 -> 4.0.0)

`jwt-decode` is pinned/resolved at 3.1.2 but the latest stable release on the npm registry is 4.0.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `lint-staged` is 7 major version(s) behind (10.5.4 -> 17.0.7)

`lint-staged` is pinned/resolved at 10.5.4 but the latest stable release on the npm registry is 17.0.7 (7 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `lit` is 1 major version(s) behind (2.8.0 -> 3.3.3)

`lit` is pinned/resolved at 2.8.0 but the latest stable release on the npm registry is 3.3.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `prettier` is 1 major version(s) behind (2.8.8 -> 3.8.3)

`prettier` is pinned/resolved at 2.8.8 but the latest stable release on the npm registry is 3.8.3 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.90 npm package `rimraf` is 3 major version(s) behind (3.0.2 -> 6.1.3)

`rimraf` is pinned/resolved at 3.0.2 but the latest stable release on the npm registry is 6.1.3 (3 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

package-lock.json

medium Security checks software dependencies conf 0.88 postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

package-lock.json

medium Security checks software dependencies conf 0.88 protocol-buffers-schema: GHSA-j452-xhg8-qg39

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

package-lock.json

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 serialize-javascript: GHSA-qj8w-gfj5-8c6v

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

package-lock.json

medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

package-lock.json

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

package-lock.json

medium Security checks software dependencies conf 0.88 yaml: GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

package-lock.json

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/api.js:851

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/components/GrampsjsImg.js:161

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/oidc.js:28

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/sw.js:42

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: dmstraub/gramps-webapi:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:1 containersPinned dependencies

medium System graph hardware Security conf 1.00 Dockerfile runs as root: .devcontainer/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph cicd CI/CD security conf 1.00 12 occurrences GitHub Action is tag-pinned rather than SHA-pinned

docker/setup-qemu-action@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

3 files, 12 locations

.github/workflows/image-devel.yml:23, 26, 34, 40, 50 (5 hits)

.github/workflows/image-release.yml:23, 26, 34, 47, 58 (5 hits)

.github/workflows/release.yml:28 (2 hits)

CI/CD securitySupply chainGitHub Actions

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

12 test file(s) for 301 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

low Security checks software dependencies conf 0.88 brace-expansion: GHSA-v6h2-p8h4-qcjw

brace-expansion Regular Expression Denial of Service vulnerability

package-lock.json

low Security checks quality Quality conf 0.60 30 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 17 locations

src/components/GrampsjsBlogPreview.js:8, 9 (2 hits)

src/components/GrampsjsFilterProperties.js:7, 9 (2 hits)

src/components/GrampsjsFilterYears.js:9, 11 (2 hits)

src/components/GrampsjsFormSpouseRef.js:5, 8 (2 hits)

src/components/GrampsjsFormUser.js:20, 26 (2 hits)

src/charts/TreeChart.js:188

src/charts/YtreeLineageChart.js:3

src/components/GrampsjsBlogPostPreview.js:48

duplicationquality

low Security checks software dependencies conf 0.88 koa: GHSA-jgmv-j7ww-jx2x

Koa Open Redirect via Referrer Header (User-Controlled)

package-lock.json

low Security checks software dependencies conf 0.90 npm package `@awesome.me/webawesome` is minor version(s) behind (3.4.0 -> 3.7.0)

`@awesome.me/webawesome` is pinned/resolved at 3.4.0 but the latest stable release on the npm registry is 3.7.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rais…

package.json

low Security checks software dependencies conf 0.90 npm package `@hpcc-js/wasm` is minor version(s) behind (2.22.4 -> 2.34.0)

`@hpcc-js/wasm` is pinned/resolved at 2.22.4 but the latest stable release on the npm registry is 2.34.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `@material/web` is minor version(s) behind (2.2.0 -> 2.4.1)

`@material/web` is pinned/resolved at 2.2.0 but the latest stable release on the npm registry is 2.4.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `@vitest/coverage-v8` is minor version(s) behind (4.0.18 -> 4.1.8)

`@vitest/coverage-v8` is pinned/resolved at 4.0.18 but the latest stable release on the npm registry is 4.1.8 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `eslint-plugin-import` is minor version(s) behind (2.31.0 -> 2.32.0)

`eslint-plugin-import` is pinned/resolved at 2.31.0 but the latest stable release on the npm registry is 2.32.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs rais…

package.json

low Security checks software dependencies conf 0.90 npm package `eslint-plugin-lit` is minor version(s) behind (2.2.1 -> 2.3.1)

`eslint-plugin-lit` is pinned/resolved at 2.2.1 but the latest stable release on the npm registry is 2.3.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `eslint-plugin-no-only-tests` is minor version(s) behind (3.3.0 -> 3.4.0)

`eslint-plugin-no-only-tests` is pinned/resolved at 3.3.0 but the latest stable release on the npm registry is 3.4.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs…

package.json

low Security checks software dependencies conf 0.90 npm package `jsondiffpatch` is minor version(s) behind (0.6.0 -> 0.7.6)

`jsondiffpatch` is pinned/resolved at 0.6.0 but the latest stable release on the npm registry is 0.7.6 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks software dependencies conf 0.90 npm package `maplibre-gl` is minor version(s) behind (5.6.0 -> 5.24.0)

`maplibre-gl` is pinned/resolved at 5.6.0 but the latest stable release on the npm registry is 5.24.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt

low Security checks quality Quality conf 0.74 Public web app has no robots.txt

Public websites should publish a robots.txt file so crawlers and AI agents can discover crawl rules and sitemap locations without guessing.

robots.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/devcontainers/javascript-node:22

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

.devcontainer/Dockerfile:1 containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: rollup.config.js