charmbracelet/crush

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

23 of your 83 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 1.48s · analysis 7.1s · 7.8 MB · GitHub API rate-limit (preflight)

https://github.com/charmbracelet/crush · scanned 2026-06-05 22:09 UTC (4 days, 8 hours ago) · 10 languages

102 raw signals (74 security + 28 graph) 55th percentile · Go · large (100-500K LoC) System graph score 89 (lower by 12)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 8 hours ago · v2 · 37 actionable findings from 2 signal sources. 50 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 11 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	76.4	0.25	19.10
`testing_score`	80.0	0.20	16.00
`documentation_score`	63.6	0.15	9.54
`practices_score`	93.0	0.15	13.95
`code_quality`	52.6	0.10	5.26
Overall		1.00	76.6

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 1 High 7 Medium 2 Low 9 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 26 System graph 11 Crowd 0 Layer: Quality 18 Software 10 Security 3 Cicd 4 Api 1 Frontend 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B+ (77/100). Dimensions: security 76, maintainability 85. 74 findings (11 security). 109,814 lines analyzed.

Showing 18 of 37 actionable findings. 87 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks security secrets conf 0.95 Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Gitleaks detected a committed secret or credential pattern.

internal/event/event.go:18

high Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `charmbracelet/meta/.github/workflows/lint-sync.yml` pinned to mutable ref `@main` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 4 locations

.github/workflows/lint-sync.yml:14

.github/workflows/lint.yml:9

.github/workflows/nightly.yml:29

.github/workflows/release.yml:16

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 golang.org/x/image: GO-2026-4961

Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/image: GO-2026-4962

Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/image: GO-2026-5031

Panic when reading out of bound palette index in golang.org/x/image/bmp

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/image: GO-2026-5032

Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff

go.mod

high System graph cicd CI/CD security conf 1.00 4 occurrences GitHub Action tracks a moving branch

charmbracelet/meta/.github/workflows/lint-sync.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

4 files, 4 locations

.github/workflows/lint-sync.yml:14

.github/workflows/lint.yml:9

.github/workflows/nightly.yml:29

.github/workflows/release.yml:16

CI/CD securitySupply chainGithub actions

high System graph security security conf 1.00 Insecure pattern 'exec_used' in internal/db/db.go:331

Found a known-risky pattern (exec_used). Review and replace if possible.

internal/db/db.go:331 Exec used

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/cla.yml CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/lint-sync.yml CI/CD securitySupply chainGithub actions

low Security checks quality Error handling conf 1.00 3 occurrences [ERR003] Ignored Error (Go): Ignoring error return values.

Handle the error or use errcheck linter.

3 files, 3 locations

internal/agent/tools/diagnostics.go:60

internal/agent/tools/web_fetch.go:62

internal/cmd/login.go:55

low Security checks quality Quality conf 0.60 27 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 16 locations

internal/workspace/client_workspace.go:294, 460, 736 (3 hits)

internal/proto/message.go:61, 380 (2 hits)

internal/proto/proto.go:124, 162 (2 hits)

internal/agent/tools/fetch.go:88

internal/agent/tools/multiedit.go:1

internal/agent/tools/write.go:1

internal/cmd/logout.go:30

internal/cmd/run.go:152

duplicationquality

low Security checks software dependencies conf 0.88 github.com/disintegration/imaging: GHSA-q7pp-wcgr-pffx

Crash when processing crafted TIFF files

go.mod

low System graph quality Maintenance conf 1.00 56 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph quality Complexity conf 1.00 Very large file: internal/agent/agent.go (2121 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph quality Complexity conf 1.00 Very large file: internal/config/load_test.go (2076 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph quality Complexity conf 1.00 Very large file: internal/swagger/docs.go (3717 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph quality Complexity conf 1.00 Very large file: internal/ui/model/ui.go (3975 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/f1ea3e2b-21a1-42fd-a8fc-2b9cc16cee43/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/f1ea3e2b-21a1-42fd-a8fc-2b9cc16cee43/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.