mateiszakwork-cloud/hiro

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	62.2	0.25	15.55
`testing_score`	30.0	0.20	6.00
`documentation_score`	38.7	0.15	5.81
`practices_score`	44.0	0.15	6.60
`code_quality`	77.4	0.10	7.74
Overall		1.00	56.7

critical Legacy security security .env file committed to repository

Remove .env from version control: git rm --cached .env. Add '.env' to .gitignore. Rotate all exposed credentials.

.env securitylegacy

critical Legacy security credential_exposure conf 1.00 [SEC009] .env File Committed: .env file with secrets committed to repository.

Add .env to .gitignore. Rotate all exposed credentials.

.env credential_exposurelegacy

critical 9-layer security secrets conf 1.00 Possible secret in src/pages/Login.tsx

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/pages/Login.tsx:52 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/pages/Register.tsx

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/pages/Register.tsx:55 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/pages/Register.tsx

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/pages/Register.tsx:56 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/pages/Register.tsx

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/pages/Register.tsx:57 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/pages/Register.tsx

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/pages/Register.tsx:58 secrets

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

supabase/functions/draft-tracker-message/index.ts:88 xsslegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

supabase/functions/calculate-match-score/index.ts:85 xsslegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

src/components/ui/chart.tsx:72 xsslegacy

high Legacy security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/pages/Register.tsx:169 authlegacy

high Legacy security auth conf 0.83 Secret-like setting is echoed into a password input value

Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.

src/pages/Login.tsx:163 authlegacy

high 9-layer security secrets conf 1.00 .env file present in repo: .env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

secretsconfig

medium Legacy security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

authlegacy

medium Legacy quality quality conf 1.00 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets to swap them. In production, these break demo flows, send mail to a real example.com host (it's owned by IANA), and leak that the codebase had an AI scaffolding pass.

Move dummy values to fixtures / seed files. In application code, require these to come from config or fail closed. Add a CI grep that rejects 'lorem ipsum' and 'example.com' outside test files.

src/pages/Register.tsx:151 qualitylegacy

medium Legacy quality quality conf 0.70 Public web app has no Content Security Policy

A Content Security Policy reduces the blast radius of injected scripts if the app is ever served through preview, static hosting, or a web container outside its normal sandbox.

index.html qualitylegacy

medium Legacy quality quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt qualitylegacy

medium 9-layer frontend frontend-quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — src/components/ui/chart.tsx:70

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

frontend-qualityfq.dangerous-html

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/calculate-match-score/index.ts:122

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/draft-outreach-messages/index.ts:53

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/draft-tracker-message/index.ts:168

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/generate-interview-prep/index.ts:116

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/parse-cv/index.ts:146

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/search-linkedin-contacts/index.ts:239

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/tailor-cv/index.ts:135

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/test-linkedin-connection/index.ts:58

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Frontend route `/auth/callback` has no Link/navigate to it — src/App.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

integrityorphan-pagewiring

medium 9-layer quality integrity conf 1.00 Frontend route `/jobs/:jobId` has no Link/navigate to it — src/App.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

integrityorphan-pagewiring

medium 9-layer security owasp conf 1.00 Insecure pattern 'dangerous_innerhtml' in src/components/ui/chart.tsx:70

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/components/ui/chart.tsx:70 owaspdangerous_innerhtml

medium 9-layer security coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

coverageauth

medium 9-layer cicd coverage conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

coverage

medium 9-layer data coverage conf 1.00 ORM models found but no DB engine detected

The repo defines tables/models but no DB connection string was found. Likely lives in env vars or a config file the scanner didn't read.

coverage

medium 9-layer quality tests conf 1.00 Very low test-to-source ratio

4 test file(s) for 103 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths.

testscoverage

low Legacy security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

authlegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

supabase/functions/parse-job/index.ts:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/pages/Welcome.tsx:58 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/pages/Register.tsx:1 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/lib/generateCvDocx.ts:7 qualitylegacy

low Legacy quality documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

documentationlegacy

low Legacy quality quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt qualitylegacy

low Legacy quality quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt qualitylegacy

low Legacy quality quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml qualitylegacy

low Legacy quality quality conf 0.74 robots.txt does not advertise a sitemap

Sitemap directives in robots.txt help crawlers and AI agents find the canonical public URL inventory quickly.

public/robots.txt qualitylegacy

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: eslint.config.js