mateiszakwork-cloud/hiro

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

Scan timing: clone 1.49s · analysis 1.92s · 1.5 MB · GitHub API rate-limit (preflight)

https://github.com/mateiszakwork-cloud/hiro.git · scanned 2026-05-25 15:37 UTC (1 week, 3 days ago) · 10 languages

193 findings (39 legacy + 154 scanner) 22nd percentile · Typescript · small (2-20K LoC) Scanner says 77 (lower by 20)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 week, 3 days ago · v2 · 116 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	62.2	0.25	15.55
`testing_score`	30.0	0.20	6.00
`documentation_score`	38.7	0.15	5.81
`practices_score`	44.0	0.15	6.60
`code_quality`	77.4	0.10	7.74
Overall		1.00	56.7

Severity distribution — click a segment to filter

Active filters: source: legacy × excluding tests × Reset all

Severity: Critical 7 High 7 Medium 20 Low 63 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 39 9-layer 77 Crowd 0 Layer: Quality 45 Security 14 Software 47 Api 1 Frontend 7 Data 1 Cicd 1

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 77.2/100 with 88.9% coverage. It contains 618 nodes across 23 cross-layer flows, written primarily in mixed languages. Engine surfaced 77 findings — concentrated in software (44), quality (15), security (8). Risk profile is high: 5 critical, 1 high, 16 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 24 of 116 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Legacy security security .env file committed to repository

Remove .env from version control: git rm --cached .env. Add '.env' to .gitignore. Rotate all exposed credentials.

.env securitylegacy

critical Legacy security credential_exposure conf 1.00 [SEC009] .env File Committed: .env file with secrets committed to repository.

Add .env to .gitignore. Rotate all exposed credentials.

.env credential_exposurelegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

supabase/functions/draft-tracker-message/index.ts:88 xsslegacy

supabase/functions/calculate-match-score/index.ts:85 xsslegacy

src/components/ui/chart.tsx:72 xsslegacy

high Legacy security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/pages/Register.tsx:169 authlegacy

high Legacy security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/pages/Login.tsx:163 authlegacy

medium Legacy security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

authlegacy

medium Legacy quality quality conf 1.00 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets to swap them. In production, these break demo flows, send mail to a real example.com host (it's owned by IANA), and leak that the codebase had an AI scaffolding pass.

Move dummy values to fixtures / seed files. In application code, require these to come from config or fail closed. Add a CI grep that rejects 'lorem ipsum' and 'example.com' outside test files.

src/pages/Register.tsx:151 qualitylegacy

medium Legacy quality quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html qualitylegacy

medium Legacy quality quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt qualitylegacy

low Legacy security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

authlegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

supabase/functions/parse-job/index.ts:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/pages/Welcome.tsx:58 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/pages/Register.tsx:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/lib/generateCvDocx.ts:7 qualitylegacy

low Legacy quality documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

documentationlegacy

low Legacy quality quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt qualitylegacy

low Legacy quality quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt qualitylegacy

low Legacy quality quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml qualitylegacy

low Legacy quality quality conf 0.74 robots.txt does not advertise a sitemap

Sitemap directives in robots.txt help crawlers and AI agents find the canonical public URL inventory quickly.

public/robots.txt qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.

Review and fix per the pattern semantics. See CWE-476 / for context.

supabase/functions/parse-cv/index.ts:67 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.

Review and fix per the pattern semantics. See CWE-476 / for context.

supabase/functions/draft-tracker-message/index.ts:117 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.

Review and fix per the pattern semantics. See CWE-79 / A03:2021 for context.

src/components/ui/chart.tsx:70 qualitylegacy

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/ecbe478e-97ee-4d3d-90ff-98c1aca2692b/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/ecbe478e-97ee-4d3d-90ff-98c1aca2692b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.