Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

cocoindex-io/cocoindex

https://github.com/cocoindex-io/cocoindex · scanned 2026-05-15 03:47 UTC (4 weeks, 1 day ago) · 10 languages

204 raw signals (93 security + 111 graph) 82nd percentile · Python · medium (20-100K LoC) System graph score 87 (lower by 6)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 weeks, 1 day ago · v1 · 27 actionable findings from 1 signal source. 61 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
81.5
/100
Security checks
76
27 findings
System graph
87
100.0% cov · 0 findings
Critical
2
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5 calibration-aware
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 86.1 0.25 21.52
testing_score 95.0 0.20 19.00
documentation_score 86.6 0.15 12.99
practices_score 80.0 0.15 12.00
code_quality 63.8 0.10 6.38
Overall 1.00 80.9
Calibrated penalty buckets (security_score): agent: 1.1 · authz: 2.1 · threat: 10.8
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 14 Medium 2 Low 5 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 27 System graph 0 Crowd 0 Layer: Quality 11 Software 5 Security 11
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Ranks in the 4th percentile among small-sized repos. Strongest dependencies (90), structure (72); weakest security (15), practices (42). 130 findings (4 critical, 78 high). Most common pattern: ts-non-null-assertion.

Showing 23 of 27 actionable findings. 88 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks security Deserialization conf 0.85 Insecure deserialization — pickle/yaml/marshal
pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data — RCE.
python/cocoindex/subprocess_exec.py:203 unsafe-deserialization-pickle · CWE-502 · A08:2021
critical Security checks security secrets conf 0.85 Password embedded in URL
https://user:password@host — leaks creds via logs, referrer, error messages.
examples/postgres_source/prepare_source_data.sql:2 password-in-url · CWE-200 · A07:2021
high Security checks security Injection conf 0.50 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.
Use parameterized queries: cursor.execute('SELECT * FROM t WHERE id = %s', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.
python/cocoindex/connectors/doris/_target.py:696
high Security checks security Injection conf 0.85 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.
Use parameterized queries: cursor.execute('SELECT * FROM t WHERE id = %s', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.
python/cocoindex/connectors/postgres/_source.py:132
high Security checks quality Error handling conf 0.85 Bare except: pass — silent failure
except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.
python/cocoindex/subprocess_exec.py:145 bare-except-pass · CWE-755
high Security checks quality Error handling conf 0.85 except BaseException — catches SystemExit/KeyboardInterrupt
except BaseException: ... — prevents Ctrl+C and SystemExit from working.
python/cocoindex/runtime.py:65 overcatch-baseexception · CWE-705
high Security checks quality Error handling conf 0.85 except BaseException — catches SystemExit/KeyboardInterrupt
except BaseException: ... — prevents Ctrl+C and SystemExit from working.
examples/live_updates/main.py:48 overcatch-baseexception · CWE-705
high Security checks quality Quality conf 0.85 3 occurrences Floats used for monetary values
Variable named price/amount/cost typed as float instead of Decimal.
2 files, 3 locations
examples/product_recommendation/main.py:47, 86 (2 hits)
examples/postgres_source/main.py:16
floats-for-money · CWE-682
high Security checks quality Quality conf 0.85 Imported but never used
AST detector: dead-imports
/tank0/claude-archive/opus47/cocoindex-io__cocoindex/python/cocoindex/flow.py:5 dead-imports
high Security checks software Supply chain conf 0.85 Supply chain — curl | bash anti-pattern
curl ... | sh / bash — runs unverified network code.
examples/sec_edgar_analytics/docker-compose.yml:6 curl-pipe-bash · CWE-494 · A08:2021
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
low Security checks quality Error handling conf 1.00 3 occurrences [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
3 files, 3 locations
python/cocoindex/_internal/environment.py:533
python/cocoindex/_internal/runner.py:138
python/cocoindex/connectors/qdrant/_target.py:339
low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.
Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.
python/cocoindex/_internal/function.py:1069
low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.
Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.
python/cocoindex/_internal/runner.py:173
medium Security checks security auth conf 0.85 19 occurrences CORS misconfiguration — wildcard Access-Control-Allow-Origin
Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints.
3 files, 19 locations
python/cocoindex/cli.py:560, 652, 668, 729, 769, 770, 771, 773, +2 more (10 hits)
python/cocoindex/setting.py:156, 165, 167, 173, 177, 180 (6 hits)
rust/cocoindex/src/server.rs:16, 25, 27 (3 hits)
cors-wildcard · CWE-942 · A05:2021
high Security checks security Crypto conf 0.45 3 occurrences Crypto — plaintext HTTP for sensitive endpoint
Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
2 files, 3 locations
examples/image_search/frontend/src/App.jsx:3, 45 (2 hits)
rust/cocoindex/src/server.rs:91
http-not-https · CWE-319 · A02:2021
low Security checks quality Quality conf 0.60 3 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
3 files, 3 locations
python/cocoindex/connectors/neo4j/_cypher.py:90
python/cocoindex/connectors/turbopuffer/_target.py:340
python/cocoindex/setting.py:7
duplicationquality
high Security checks software Test quality conf 0.85 10 occurrences Function is stub-only (pass/raise NotImplementedError)
Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.
5 files, 10 locations
python/cocoindex/engine_object.py:99, 101 (2 hits)
python/cocoindex/engine_type.py:424, 428 (2 hits)
python/cocoindex/lib.py:30, 32 (2 hits)
python/cocoindex/setting.py:173, 177 (2 hits)
python/cocoindex/typing.py:52, 53 (2 hits)
stub-only-function · CWE-1188
high Security checks quality Quality conf 0.85 Magic number used as default arg
Using hardcoded default values for complex configuration objects makes the code brittle and difficult to manage. Consider using a dedicated factory or builder pattern. Auto-promoted from proposal 444 on 2026-05-12. Synth confidence: 0.85. FP estimate: 0.00.
python/cocoindex/validation.py:32 magic-number-default
high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell
Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.
docs/src/content/docs/contributing/setup_dev_environment.mdx:17
high Security checks software Supply chain conf 0.85 Supply chain — npm install without lockfile
Production image runs npm install (resolves new versions on every build) instead of npm ci.
examples/fastapi_server_docker/dockerfile:13 npm-install-no-lockfile · CWE-1357 · A06:2021
low Security checks quality Quality conf 0.74 robots.txt does not advertise a sitemap
Sitemap directives in robots.txt help crawlers and AI agents find the canonical public URL inventory quickly.
docs/public/robots.txt
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/ecebda09-0cac-4f20-b198-ea898eaf9be2/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/ecebda09-0cac-4f20-b198-ea898eaf9be2/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.