grafana/grafana

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	100.0	0.25	25.00
`testing_score`	90.0	0.20	18.00
`documentation_score`	90.0	0.15	13.50
`practices_score`	100.0	0.15	15.00
`code_quality`	80.0	0.10	8.00
Overall		1.00	92.2

low Security checks quality Quality conf 1.00 ✓ Repobility [MINED013] Password In Url: https://user:password@host — leaks creds via logs, referrer, error messages.

Review and fix per the pattern semantics. See CWE-200 / A07:2021 for context.

devenv/frontend-service/docker-compose.yaml:38

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED035] Js New Function: new Function(...) compiles strings to functions.

Review and fix per the pattern semantics. See CWE-95 / for context.

packages/grafana-ui/src/components/Table/TableNG/Filter/FilterList.tsx:70

low Security checks security secrets conf 0.90 [SEC003] Hardcoded Secret: Hardcoded secret key found in source code.

Never commit secrets. Use .env files with .gitignore.

apps/advisor/pkg/app/checks/configchecks/security_config_step.go:16

critical Security checks cicd CI/CD security conf 0.96 5 occurrences Compose service contains a literal secret environment value

Rotate the value if real. Move it to Docker Compose secrets, a platform secret manager, or an uncommitted environment file.

4 files, 5 locations

devenv/docker/ha_test/docker-compose.yaml:17, 55 (2 hits)

devenv/docker/blocks/auth/freeipa/docker-compose.yaml:6

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:3

devenv/frontend-service/docker-compose.yaml:87

CI/CD securitycontainers

critical Security checks cicd CI/CD security conf 0.98 3 occurrences Compose service mounts the Docker socket

Avoid mounting docker.sock. Use a narrow proxy, rootless build service, or provider-native deployment credentials.

3 files, 3 locations

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:35

devenv/docker/ha_test/docker-compose.yaml:3

devenv/frontend-service/docker-compose.yaml:98

CI/CD securitycontainers

critical Security checks cicd CI/CD security conf 0.96 Docker image bakes a secret-like ENV value

Remove the secret from the Dockerfile, rotate the value if real, and inject runtime secrets through your platform secret manager.

devenv/docker/blocks/mysql_opendata/Dockerfile:5 CI/CD securitycontainers

critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in public/app/plugins/datasource/azuremonitor/components/ConfigEditor/AppRegistrationCredentials.tsx:334

Found a known-risky pattern (private_key_in_repo). Review and replace if possible.

public/app/plugins/datasource/azuremonitor/components/ConfigEditor/AppRegistrationCredentials.tsx:334 Private key in repo

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in conf/ldap.toml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 32, 34

conf/ldap.toml:32, 34 (2 hits)

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in conf/ldap_multiple.toml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 10, 36

conf/ldap_multiple.toml:10, 36 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in devenv/docker/blocks/auth/authentik/ldap_authentik.toml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

devenv/docker/blocks/auth/authentik/ldap_authentik.toml:9

critical System graph security Secrets conf 1.00 Possible secret in devenv/docker/blocks/auth/freeipa/ldap_freeipa.toml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

devenv/docker/blocks/auth/freeipa/ldap_freeipa.toml:23

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in devenv/docker/blocks/auth/openldap-multiple/ldap_dev.toml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 19, 57

devenv/docker/blocks/auth/openldap-multiple/ldap_dev.toml:19, 57 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in devenv/docker/blocks/influxdb/docker-compose.yaml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

devenv/docker/blocks/influxdb/docker-compose.yaml:11

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in devenv/docker/blocks/mysql_opendata/Dockerfile

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 6, 8

devenv/docker/blocks/mysql_opendata/Dockerfile:6, 8 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in pkg/cmd/grafana-cli/commands/reset_password_command.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

pkg/cmd/grafana-cli/commands/reset_password_command.go:30

critical System graph security Secrets conf 1.00 Possible secret in pkg/services/ldap/api/support_bundle.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

pkg/services/ldap/api/support_bundle.go:43

critical System graph security Secrets conf 1.00 Possible secret in pkg/services/notifications/notifications.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

pkg/services/notifications/notifications.go:48

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in pkg/services/sqlstore/sqlutil/sqlutil.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 143, 165

pkg/services/sqlstore/sqlutil/sqlutil.go:143, 165 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in pkg/setting/setting.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

pkg/setting/setting.go:55

critical System graph security Secrets conf 1.00 Possible secret in playwright.config.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

playwright.config.ts:79

critical System graph security Secrets conf 1.00 Possible secret in public/app/plugins/datasource/influxdb/components/editor/config-v2/InfluxInfluxQLDBConnection.tsx

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

public/app/plugins/datasource/influxdb/components/editor/config-v2/InfluxInfluxQLDBConnection.tsx:47

high Security checks software dependencies conf 0.90 ✓ Repobility 25 occurrences [MINED118] Dockerfile FROM `golang:latest` not pinned by digest: `FROM golang:latest` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Replace with: `FROM golang:latest@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).

12 files, 15 locations

Dockerfile:16, 17, 18, 20 (4 hits)

devenv/docker/blocks/alert_webhook_listener/Dockerfile:1

devenv/docker/blocks/auth/apache_proxy_mac/Dockerfile:1

devenv/docker/blocks/auth/nginx_proxy_mac/Dockerfile:1

devenv/docker/blocks/collectd/Dockerfile:1

devenv/docker/blocks/elastic/data/Dockerfile:1

devenv/docker/blocks/mysql_opendata/Dockerfile:2

devenv/docker/blocks/prometheus/Dockerfile:1

high Security checks software dependencies conf 0.90 ✓ Repobility [MINED122] package.json dep `@grafana/eslint-plugin` pulled from URL/Git: `devDependencies.@grafana/eslint-plugin` = `link:./packages/grafana-eslint-rules` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or git host is compromised, every `npm install` pulls the new payload.

Publish the dependency to npm (or your private registry) and reference it by `^x.y.z`. If that's not possible, lock by commit SHA: `git+https://...#<full-sha>` AND verify the SHA in CI.

package.json:1

high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences [MINED126] Workflow container/services image `docker.io/tonistiigi/binfmt:qemu-v10.2.1-65` unpinned: `container/services image: docker.io/tonistiigi/binfmt:qemu-v10.2.1-65` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.

Replace with `docker.io/tonistiigi/binfmt:qemu-v10.2.1-65@sha256:<digest>`. Re-pin via Dependabot Docker scope.

2 files, 3 locations

.github/workflows/pr-test-integration.yml:110, 256 (2 hits)

.github/workflows/build-docker-variants.yml:114

high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences [MINED128] go.mod replaces `github.com/prometheus/alertmanager` — redirects to fork `github.com/grafana/prometheus-alertmanager`: `replace github.com/prometheus/alertmanager => github.com/grafana/prometheus-alertmanager` overrides the canonical dependency with a different source (redirects to fork `github.com/grafana/prometheus-alertmanager`). Local-path replaces are fine for monorepos but in published modules they can hide malicious forks from anyone who only audits the require lines.

If the replace is intentional (e.g. waiting on an upstream fix), vendor the dependency into the repo and add a comment explaining the reason. Remove the replace once upstream merges.

3 files, 3 locations

apps/alerting/historian/go.mod:169

apps/plugins/go.mod:292

pkg/codegen/go.mod:64

high Security checks cicd CI/CD security conf 0.90 Compose service bind-mounts a sensitive host path

Mount only the exact file or directory required, prefer read-only mode, and avoid host system paths.

devenv/docker/blocks/auth/freeipa/docker-compose.yaml:6 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.92 Compose service explicitly runs as root

Run as a numeric non-root UID, or if root is needed for startup, drop privileges before starting the app process.

devenv/frontend-service/docker-compose.yaml:135 CI/CD securitycontainers

high Security checks security auth conf 0.78 Consent is collected in UI without visible backend audit persistence

Persist consent as a backend record with subject, actor, purpose, scope, legal text version, timestamp, IP address, user agent, and revocation state.

packages/grafana-api-clients/src/clients/rtkq/iam/v0alpha1/endpoints.gen.ts:1781

high Security checks cicd CI/CD security conf 0.90 4 occurrences Database service has no persistent data volume

Mount the database data directory to a named Docker volume or managed persistent disk, and document backup and restore testing.

2 files, 4 locations

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:3, 18 (2 hits)

devenv/docker/ha_test/docker-compose.yaml:17, 32 (2 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.84 4 occurrences Database service publishes a host port

Use `expose` for service-to-service access, bind to 127.0.0.1 for local-only access, or protect the port with firewall rules.

2 files, 4 locations

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:3, 18 (2 hits)

devenv/docker/ha_test/docker-compose.yaml:17, 32 (2 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.90 ✓ Repobility 12 occurrences GitHub Action is tag-pinned rather than SHA-pinned

[MINED115] Action `grafana/shared-workflows/actions/login-to-gar` pinned to mutable ref `@main`: `uses: grafana/shared-workflows/actions/login-to-gar@main` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025)…

3 files, 12 locations

.github/workflows/release-comms.yml:69, 79, 88, 98, 110, 122, 142 (7 hits)

.github/workflows/pr-build-grafana.yml:180, 224, 236 (3 hits)

.github/workflows/publish-artifact.yml:55, 80 (2 hits)

CI/CD securitySupply chainGitHub Actions

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/elastic/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/elasticstack/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/grafana/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/mysql/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/mysql_exporter/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/mysql_tests/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/pgvector/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/postgres/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/postgres_tests/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph security Secrets conf 1.00 .env file present in repo: devenv/docker/blocks/slow_proxy/.env

A raw .env file is in the working tree. Verify it isn't committed and that secrets are in a vault.

Config

high System graph api Wiring conf 1.00 Dangling fetch: DELETE /api/storage/delete/upload/${file.file.name} (public/app/features/dimensions/editors/FileUploader.tsx:48)

`public/app/features/dimensions/editors/FileUploader.tsx:48` calls `DELETE /api/storage/delete/upload/${file.file.name}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/storage/delete/upload/<p>` If this points at an…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET /-/fe-boot-error?ts=${Date.now()}${Math.random()} (public/boot/index.ts:19)

`public/boot/index.ts:19` calls `GET /-/fe-boot-error?ts=${Date.now()}${Math.random()}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/-/fe-boot-error` If this points at an external API, prefix it with `https://` so…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET /health (e2e-playwright/test-plugins/grafana-test-datasource/datasource.ts:66)

`e2e-playwright/test-plugins/grafana-test-datasource/datasource.ts:66` calls `GET /health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/health` If this points at an external API, prefix it with `https://`…

Dangling fetchHelper:request

high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/${path} (.github/actions/changelog/index.js:63)

`.github/actions/changelog/index.js:63` calls `GET https://api.github.com/${path}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/<p>` If this points at an external API, prefix it with `https:/…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/storage/upload (public/app/features/dimensions/editors/ResourcePickerPopover.tsx:124)

`public/app/features/dimensions/editors/ResourcePickerPopover.tsx:124` calls `POST /api/storage/upload` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/storage/upload` If this points at an external API, prefix it wit…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/user/auth-tokens/rotate (public/boot/index.ts:73)

`public/boot/index.ts:73` calls `POST /api/user/auth-tokens/rotate` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/user/auth-tokens/rotate` If this points at an external API, prefix it with `https://` so the matcher…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.github.com/graphql (.github/actions/changelog/index.js:39)

`.github/actions/changelog/index.js:39` calls `POST https://api.github.com/graphql` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/graphql` If this points at an external API, prefix it with `ht…

Dangling fetchFetch

high System graph cicd CI/CD security conf 1.00 47 occurrences GitHub Action tracks a moving branch

grafana/grafana-github-actions/commands@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

12 files, 35 locations

.github/workflows/release-build.yml:609, 637, 661, 688, 715, 742, 769, 796, +2 more (10 hits)

.github/workflows/release-comms.yml:69, 79, 88, 98, 110, 122, 142 (7 hits)

.github/workflows/community-release.yml:37, 44 (2 hits)

.github/workflows/deploy-storybook.yml:91, 103 (2 hits)

.github/workflows/github-release.yml:45, 57 (2 hits)

.github/workflows/i18n-crowdin-create-tasks.yml:18, 25 (2 hits)

.github/workflows/i18n-crowdin-download.yml:32, 39 (2 hits)

.github/workflows/i18n-crowdin-upload.yml:28, 35 (2 hits)

CI/CD securitySupply chainGithub actions

high System graph security security conf 1.00 Insecure pattern 'eval_used' in pkg/api/admin.go:82

Found a known-risky pattern (eval_used). Review and replace if possible.

pkg/api/admin.go:82 Eval used

high System graph security security conf 1.00 Insecure pattern 'eval_used' in pkg/expr/threshold.go:198

Found a known-risky pattern (eval_used). Review and replace if possible.

pkg/expr/threshold.go:198 Eval used

high System graph security security conf 1.00 Insecure pattern 'eval_used' in public/app/features/dashboard/dashgrid/DashboardLibrary/utils/communityDashboardHelpers.ts:181

Found a known-risky pattern (eval_used). Review and replace if possible.

public/app/features/dashboard/dashgrid/DashboardLibrary/utils/communityDashboardHelpers.ts:181 Eval used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in .github/actions/changelog/index.js:20

Found a known-risky pattern (exec_used). Review and replace if possible.

.github/actions/changelog/index.js:20 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in pkg/util/xorm/session_raw.go:148

Found a known-risky pattern (exec_used). Review and replace if possible.

pkg/util/xorm/session_raw.go:148 Exec used

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

packages/grafana-ui/src/components/Table/TableNG/Filter/FilterList.tsx:73

medium Security checks quality Quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

packages/grafana-ui/src/components/Table/Table.story.tsx:119

medium Security checks quality Quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

devenv/docker/blocks/loki/data/data.js:203

medium Security checks quality Quality conf 1.00 3 occurrences [SEC089] Go: bind to all interfaces (0.0.0.0): Server binds to all network interfaces — exposes service beyond intended scope. Ported from gosec G102 (Apache-2.0).

Bind to `127.0.0.1:PORT` and front with a reverse proxy.

3 files, 3 locations

devenv/docker/blocks/alert_webhook_listener/main.go:27

devenv/docker/blocks/prometheus_high_card/main.go:122

devenv/docker/blocks/prometheus_utf8/main.go:126

medium Security checks cicd CI/CD security conf 0.94 Compose service `goff` image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

devenv/frontend-service/docker-compose.yaml:77 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.94 Compose service `grafana-subpath` image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

devenv/docker/blocks/traefik/docker-compose.yml:14 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.88 3 occurrences Database service has no healthcheck

Add a database-native healthcheck such as pg_isready, mysqladmin ping, redis-cli ping, or the vendor's readiness command.

3 files, 3 locations

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:18

devenv/docker/ha_test/docker-compose.yaml:32

devenv/frontend-service/docker-compose.yaml:87

CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.80 Docker Compose file could not be parsed

Validate the Compose file with `docker compose config` and fix YAML syntax errors.

devenv/docker/blocks/webdav/docker-compose.yaml CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.80 Docker Compose file could not be parsed

Validate the Compose file with `docker compose config` and fix YAML syntax errors.

devenv/docker/blocks/sensugo/docker-compose.yaml CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 22 occurrences Docker final stage has no non-root USER

Add a non-root USER in the final runtime stage after files and permissions are prepared.

12 files, 12 locations

Dockerfile:394

devenv/docker/blocks/alert_webhook_listener/Dockerfile:2

devenv/docker/blocks/auth/apache_proxy/Dockerfile:1

devenv/docker/blocks/auth/apache_proxy_mac/Dockerfile:1

devenv/docker/blocks/auth/nginx_proxy_mac/Dockerfile:1

devenv/docker/blocks/auth/prometheus_basic_auth_proxy/Dockerfile:1

devenv/docker/blocks/caddy_tls/build/Dockerfile:1

devenv/docker/blocks/collectd/Dockerfile:1

CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.94 7 occurrences Dockerfile base image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

7 files, 7 locations

devenv/docker/blocks/alert_webhook_listener/Dockerfile:2

devenv/docker/blocks/auth/apache_proxy/Dockerfile:1

devenv/docker/blocks/auth/apache_proxy_mac/Dockerfile:1

devenv/docker/blocks/mysql_opendata/Dockerfile:3

devenv/docker/blocks/prometheus_high_card/Dockerfile:1

devenv/docker/blocks/prometheus_utf8/Dockerfile:1

devenv/docker/blocks/slow_proxy/Dockerfile:1

CI/CD securitycontainers

medium Security checks quality Quality conf 0.82 Parallel implementation file sits beside a canonical file

Merge the intended change into the canonical file, update tests/imports, and delete the parallel implementation if it is not the active entry point.

pkg/util/xorm/session_update.go:1

medium Security checks quality Quality conf 0.82 Parallel implementation file sits beside a canonical file

Merge the intended change into the canonical file, update tests/imports, and delete the parallel implementation if it is not the active entry point.

pkg/registry/apis/collections/stars_update.go:1

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

Add a Content-Security-Policy header through the web framework or hosting config. For static apps, add a CSP meta tag that restricts default-src, script-src, connect-src, img-src, and frame-ancestors.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.

.well-known/security.txt

medium Security checks quality Quality conf 0.86 robots.txt blocks the full public site

Replace full-site blocking with specific private path disallows, or add explicit Allow rules for public docs and landing pages.

public/robots.txt

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/grafana-ui/src/components/PanelChrome/PanelDescription.tsx:26

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/grafana-ui/src/components/RenderUserContentAsHTML/RenderUserContentAsHTML.tsx:7

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/grafana-ui/src/components/Table/TableNG/Cells/MarkdownCell.tsx:22

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/grafana-ui/src/components/Typeahead/TypeaheadInfo.tsx:46

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/core/components/EmptyListCTA/EmptyListCTA.tsx:64

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/core/components/help/HelpModal.tsx:252

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/core/components/PluginHelp/PluginHelp.tsx:39

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/core/components/QueryOperationRow/OperationRowHelp.tsx:31

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/dashboard-scene/panel-edit/PanelEditNext/QueryEditor/TransformationHelpDisplay.tsx:51

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/dashboard/components/PanelEditor/PanelHeaderCorner.tsx:57

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/datasources/components/DataSourceFailureBadge.tsx:22

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/explore/TraceView/components/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx:140

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/plugins/admin/components/Changelog.tsx:15

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/plugins/admin/components/PluginDetailsBody.tsx:57

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/plugins/admin/components/PluginDetailsDeprecatedWarning.tsx:42

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/provisioning/components/Folders/FolderReadmePanel.tsx:192

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/features/users/UsersListPage.tsx:114

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/plugins/datasource/azuremonitor/components/LogsQueryEditor/RawQuery.tsx:26

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/plugins/datasource/tempo/_importedDependencies/datasources/prometheus/RawQuery.tsx:24

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/plugins/panel/news/component/News.tsx:48

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/plugins/panel/timeseries/plugins/annotations2-cluster/AnnotationTooltipBody.tsx:20

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — public/app/plugins/panel/timeseries/plugins/annotations2/AnnotationTooltip2.tsx:140

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — .github/actions/changelog/index.js:39

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — e2e-playwright/dashboard-cujs/utils.ts:88

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/grafana-api-clients/src/clients/rtkq/createBaseQuery.ts:39

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/grafana-api-clients/src/utils/backendSrv.mock.ts:8

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/grafana-runtime/src/services/backendSrv.ts:168

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/grafana-runtime/src/services/pluginMeta/plugins.ts:21

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/grafana-runtime/src/utils/getCachedPromise.ts:130

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/core/services/backend_srv.ts:617

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/core/services/ResponseQueue.ts:32

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/core/specs/backend_srv.test.ts:452

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/features/alerting/unified/api/alertingApi.ts:75

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/features/alerting/unified/api/alertmanager.ts:47

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/features/alerting/unified/insights/grafana/MostFiringLabels.tsx:25

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/features/dimensions/editors/ResourcePickerPopover.tsx:124

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/features/plugins/sandbox/codeLoader.ts:22

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/datasource/grafana-testdata-datasource/runStreams.ts:329

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/datasource/influxdb/datasource.ts:578

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/datasource/opentsdb/datasource.ts:309

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/datasource/tempo/datasource.test.ts:1301

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/panel/canvas/editor/element/utils.ts:22

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/panel/geomap/style/markers.ts:256

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/app/plugins/panel/news/feed.ts:5

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/boot/index.ts:73

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/swagger/K8sNameLookup.tsx:37

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — public/swagger/SwaggerPage.tsx:22

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph frontend Frontend quality conf 1.00 Custom React Flow node registered without explicit width/height — public/app/features/variables/query/operators.test.ts:48

When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: …, height: …` to the node object. …

Fq rfnode no dims

medium System graph frontend Frontend quality conf 1.00 Custom React Flow node registered without explicit width/height — public/app/features/variables/query/VariableQueryRunner.test.ts:135

When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: …, height: …` to the node object. …

Fq rfnode no dims

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: gcr.io/distroless/static-debian13

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:20 containersPinned dependencies

medium System graph hardware Supply chain conf 1.00 4 occurrences Docker base image uses a mutable or implicit tag: golang:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

4 files, 4 locations

devenv/docker/blocks/alert_webhook_listener/Dockerfile:1

devenv/docker/blocks/prometheus_high_card/Dockerfile:1

devenv/docker/blocks/prometheus_utf8/Dockerfile:1

devenv/docker/blocks/slow_proxy/Dockerfile:1

containersPinned dependencies

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: jmferrer/apache2-reverse-proxy:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/auth/apache_proxy/Dockerfile:1 containersPinned dependencies

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: jmferrer/apache2-reverse-proxy:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/auth/apache_proxy_mac/Dockerfile:1 containersPinned dependencies

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: mysql:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/mysql_opendata/Dockerfile:2 containersPinned dependencies

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/alert_webhook_listener/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/auth/apache_proxy/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/auth/apache_proxy_mac/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/auth/nginx_proxy_mac/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/auth/prometheus_basic_auth_proxy/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/collectd/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/mysql_tests/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/postgres_tests/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/prometheus/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/prometheus_high_card/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/prometheus_random_data/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/prometheus_utf8/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/slow_proxy/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/smtp/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/blocks/stateful_webhook/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/buildcontainer/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/debtest/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: devenv/docker/ha-test-unified-alerting/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: packaging/docker/custom/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph quality Integrity conf 1.00 Frontend route `/alerting/notifications/new` has no Link/navigate to it — public/app/features/alerting/unified/components/receivers/NewReceiverView.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/org/teams/:uid/:page` has no Link/navigate to it — public/app/features/teams/TeamPages.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 2 occurrences Frontend route `/org/teams/create` has no Link/navigate to it — public/app/features/teams/create-team/CreateTeam.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

2 occurrences

repo-level (2 hits)

Orphan pageWiring

medium System graph quality Integrity conf 1.00 Frontend route `/plugins/:pluginId` has no Link/navigate to it — public/app/features/plugins/admin/pages/PluginDetails.test.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph quality Integrity conf 1.00 3 occurrences Frontend route `new` has no Link/navigate to it — public/app/features/alerting/unified/Templates.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

3 occurrences

repo-level (3 hits)

Orphan pageWiring

medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Action is tag-pinned rather than SHA-pinned

grafana/shared-workflows/actions/send-slack-message@send-slack-message/v2.0.4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

4 files, 5 locations

.github/workflows/issue-opened.yml:63, 131 (2 hits)

.github/workflows/alerting-update-module.yml:148

.github/workflows/pr-dependabot-update-go-workspace.yml:27

.github/workflows/pr-test-docker.yml:56

CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 54 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

12 files, 12 locations

.github/workflows/alerting-update-module.yml

.github/workflows/backend-code-checks.yml

.github/workflows/backend-unit-tests.yml

.github/workflows/backport-workflow.yml

.github/workflows/build-docker-variants.yml

.github/workflows/build-go-matrix.yml

.github/workflows/bump-version.yml

.github/workflows/changelog.yml

CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in packages/grafana-ui/src/components/PanelChrome/PanelDescription.tsx:26

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

packages/grafana-ui/src/components/PanelChrome/PanelDescription.tsx:26 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in packages/grafana-ui/src/components/RenderUserContentAsHTML/RenderUserContentAsHTML.tsx:7

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

packages/grafana-ui/src/components/RenderUserContentAsHTML/RenderUserContentAsHTML.tsx:7 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in packages/grafana-ui/src/components/Table/TableNG/Cells/MarkdownCell.tsx:22

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

packages/grafana-ui/src/components/Table/TableNG/Cells/MarkdownCell.tsx:22 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in packages/grafana-ui/src/components/Typeahead/TypeaheadInfo.tsx:46

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

packages/grafana-ui/src/components/Typeahead/TypeaheadInfo.tsx:46 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/core/components/EmptyListCTA/EmptyListCTA.tsx:64

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/core/components/EmptyListCTA/EmptyListCTA.tsx:64 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/core/components/help/HelpModal.tsx:252

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/core/components/help/HelpModal.tsx:252 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/core/components/PluginHelp/PluginHelp.tsx:39

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/core/components/PluginHelp/PluginHelp.tsx:39 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/core/components/QueryOperationRow/OperationRowHelp.tsx:31

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/core/components/QueryOperationRow/OperationRowHelp.tsx:31 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/dashboard-scene/panel-edit/PanelEditNext/QueryEditor/TransformationHelpDisplay.tsx:51

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/dashboard-scene/panel-edit/PanelEditNext/QueryEditor/TransformationHelpDisplay.tsx:51 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/dashboard/components/PanelEditor/PanelHeaderCorner.tsx:57

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/dashboard/components/PanelEditor/PanelHeaderCorner.tsx:57 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/datasources/components/DataSourceFailureBadge.tsx:22

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/datasources/components/DataSourceFailureBadge.tsx:22 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/explore/TraceView/components/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx:140

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/explore/TraceView/components/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx:140 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/plugins/admin/components/Changelog.tsx:15

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/plugins/admin/components/Changelog.tsx:15 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/plugins/admin/components/PluginDetailsBody.tsx:57

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/plugins/admin/components/PluginDetailsBody.tsx:57 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/plugins/admin/components/PluginDetailsDeprecatedWarning.tsx:42

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/plugins/admin/components/PluginDetailsDeprecatedWarning.tsx:42 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/provisioning/components/Folders/FolderReadmePanel.tsx:192

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/provisioning/components/Folders/FolderReadmePanel.tsx:192 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/features/users/UsersListPage.tsx:114

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/features/users/UsersListPage.tsx:114 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/plugins/datasource/azuremonitor/components/LogsQueryEditor/RawQuery.tsx:26

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/plugins/datasource/azuremonitor/components/LogsQueryEditor/RawQuery.tsx:26 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/plugins/datasource/tempo/_importedDependencies/datasources/prometheus/RawQuery.tsx:24

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/plugins/datasource/tempo/_importedDependencies/datasources/prometheus/RawQuery.tsx:24 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/plugins/panel/news/component/News.tsx:48

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/plugins/panel/news/component/News.tsx:48 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/plugins/panel/timeseries/plugins/annotations2-cluster/AnnotationTooltipBody.tsx:20

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/plugins/panel/timeseries/plugins/annotations2-cluster/AnnotationTooltipBody.tsx:20 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in public/app/plugins/panel/timeseries/plugins/annotations2/AnnotationTooltip2.tsx:140

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

public/app/plugins/panel/timeseries/plugins/annotations2/AnnotationTooltip2.tsx:140 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in pkg/plugins/repo/models.go:31

Found a known-risky pattern (weak_hash). Review and replace if possible.

pkg/plugins/repo/models.go:31 Weak hash

medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in public/app/features/alerting/unified/utils/cloud-alertmanager-notifier-types.ts:630

Found a known-risky pattern (weak_hash). Review and replace if possible.

public/app/features/alerting/unified/utils/cloud-alertmanager-notifier-types.ts:630 Weak hash

medium System graph network Security conf 1.00 Privileged port 10 in use

Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

.github/license_finder.yaml Ports

medium System graph network Security conf 1.00 Privileged port 11 in use

Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/datasources_docker.yaml Ports

medium System graph network Security conf 1.00 Privileged port 12 in use

Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

.github/license_finder.yaml Ports

medium System graph network Security conf 1.00 Privileged port 13 in use

Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

.github/license_finder.yaml Ports

medium System graph network Security conf 1.00 Privileged port 161 in use

Port 161 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/docker/blocks/smtp/Dockerfile Ports

medium System graph network Security conf 1.00 Privileged port 17 in use

Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/frontend-service/docker-compose.yaml Ports

medium System graph network Security conf 1.00 Privileged port 180 in use

Port 180 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/frontend-service/docker-compose.yaml Ports

medium System graph network Security conf 1.00 Privileged port 256 in use

Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/frontend-service/docker-compose.yaml Ports

medium System graph network Security conf 1.00 Privileged port 636 in use

Port 636 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/docker/blocks/auth/openldap/docker-compose.yaml Ports

medium System graph network Security conf 1.00 Privileged port 65 in use

Port 65 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

devenv/frontend-service/docker-compose.yaml Ports

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases.

.dockerignore CI/CD securitycontainers

low Security checks quality Error handling conf 1.00 3 occurrences [ERR003] Ignored Error (Go): Ignoring error return values.

Handle the error or use errcheck linter.

3 files, 3 locations

apps/advisor/pkg/apis/advisor/v0alpha1/createregister_response_object_types_gen.go:22

apps/advisor/pkg/apis/advisor_manifest.go:25

apps/advisor/pkg/app/app.go:167

high Security checks cicd CI/CD security conf 0.56 16 occurrences Compose service does not declare a runtime user

Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.

5 files, 16 locations

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:27, 44, 53, 64, 75, 86 (6 hits)

devenv/docker/ha_test/docker-compose.yaml:55, 85, 94, 102 (4 hits)

devenv/frontend-service/docker-compose.yaml:3, 19, 49, 158 (4 hits)

devenv/docker/blocks/auth/freeipa/docker-compose.yaml:6

devenv/local-npm/docker-compose.yaml:12

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 16 occurrences Compose service lacks no-new-privileges hardening

Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.

5 files, 16 locations

devenv/docker/ha-test-unified-alerting/docker-compose.yaml:27, 44, 53, 64, 75, 86 (6 hits)

devenv/docker/ha_test/docker-compose.yaml:55, 85, 94, 102 (4 hits)

devenv/frontend-service/docker-compose.yaml:3, 19, 49, 158 (4 hits)

devenv/docker/blocks/auth/freeipa/docker-compose.yaml:6

devenv/local-npm/docker-compose.yaml:12

CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.72 6 occurrences Dockerfile installs recommended OS packages

Add `--no-install-recommends` and explicitly list only packages the image needs.

5 files, 6 locations

scripts/verify-repo-update/Dockerfile.deb:6, 13 (2 hits)

Dockerfile:301

devenv/docker/blocks/mqtt/build/Dockerfile:3

devenv/docker/blocks/mysql_opendata/Dockerfile:11

devenv/docker/debtest/Dockerfile:3

CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.74 4 occurrences Dockerfile leaves apt package indexes in the image layer

End the apt install layer with `rm -rf /var/lib/apt/lists/*`.

3 files, 4 locations

scripts/verify-repo-update/Dockerfile.deb:6, 13 (2 hits)

devenv/docker/blocks/mysql_opendata/Dockerfile:11

devenv/docker/debtest/Dockerfile:3

CI/CD securitycontainers

low Security checks quality Quality conf 0.60 30 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 16 locations

apps/alerting/notifications/pkg/apis/alertingnotifications/v1beta1/client_gen.go:2, 7 (2 hits)

apps/alerting/notifications/pkg/apis/alertingnotifications/v1beta1/inhibitionrule_client_gen.go:2, 28 (2 hits)

apps/alerting/notifications/pkg/apis/alertingnotifications/v1beta1/inhibitionrule_object_gen.go:2, 67 (2 hits)

apps/alerting/notifications/pkg/apis/alertingnotifications/v1beta1/receiver_client_gen.go:2, 33 (2 hits)

apps/advisor/pkg/apis/advisor/v0alpha1/checktype_client_gen.go:29

apps/advisor/pkg/apis/advisor/v0alpha1/checktype_object_gen.go:80

apps/alerting/historian/pkg/apis/alertinghistorian/v0alpha1/client_gen.go:8

apps/alerting/historian/pkg/apis/alertinghistorian/v0alpha1/dummy_client_gen.go:29

duplicationquality

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

Add llms.txt with the product summary, canonical docs, API endpoints, security guidance, and preferred CLI workflow for AI agents.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

Add humans.txt with team ownership, contact URL, key documentation links, and the last-updated date.

humans.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

Add sitemap.xml, a sitemap index, or a framework-native sitemap route and reference it from robots.txt.

sitemap.xml

low Security checks quality Quality conf 0.74 robots.txt does not advertise a sitemap

Add `Sitemap: https://your-domain.example/sitemap.xml` to robots.txt.

public/robots.txt

low System graph quality Maintenance conf 1.00 1577 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: alpine:3.23.4

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:16 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: centos:6.6

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/buildcontainer/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: centos:centos7

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/smtp/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: golang:1.17

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/prometheus_random_data/Dockerfile:4 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: golang:1.26.4

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/stateful_webhook/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: golang:1.26.4-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:18 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: grafana/grafana:${GRAFANA_VERSION}

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

packaging/docker/custom/Dockerfile:2 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: nginx:1.19.3-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/auth/prometheus_basic_auth_proxy/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: nginx:1.19.3-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/auth/nginx_proxy_mac/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:24-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:19 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: prom/prometheus:v3.2.1

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/prometheus/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:17 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: ubuntu:jammy

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

devenv/docker/blocks/collectd/Dockerfile:1 containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: .levignore.js