Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

likec4/likec4

https://github.com/likec4/likec4 · scanned 2026-07-23 19:40 UTC (4 days, 20 hours ago)

228 raw signals (0 security + 228 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 20 hours ago · v7 · last Δ +10.1 (diff) · 211 actionable findings from 1 signal source. 17 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
64.2
/100
Security checks
64
0 findings
System graph
64
100.0% cov · 211 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 31 Medium 70 Low 71 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 211 Crowd 0 Layer: Frontend 38 Security 71 Quality 45 Hardware 3 Cicd 5 Dependencies 48 Api 1
Scan summary Repository scanned at 64.2/100 with 100.0% coverage. It contains 33896 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 228 findings — concentrated in security (71), dependencies (48), quality (45). Risk profile is high: 0 critical, 31 high, 87 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 169 of 211 actionable findings. 228 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.18.2 — pnpm-lock.yaml
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.24.8 — pnpm-lock.yaml
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.0.3 — pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 4.0.1 — pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 5.0.5 — pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.1.0 — pnpm-lock.yaml
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …
VulnCve 2026 13676
high System graph security Trivy conf 1.00 CVE-2026-1526: undici 7.18.2 — pnpm-lock.yaml
undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia…
VulnCve 2026 1526
high System graph security Trivy conf 1.00 CVE-2026-1528: undici 7.18.2 — pnpm-lock.yaml
undici: undici: Denial of Service via crafted WebSocket frame with large length ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that te…
VulnCve 2026 1528
high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.1.0 — pnpm-lock.yaml
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ... Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL pa…
VulnCve 2026 16221
high System graph security Trivy conf 1.00 CVE-2026-2229: undici 7.18.2 — pnpm-lock.yaml
undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket clie…
VulnCve 2026 2229
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash-es 4.17.21 — pnpm-lock.yaml
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 7.5.6 — pnpm-lock.yaml
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…
VulnCve 2026 48712
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.0 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.20.1 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — pnpm-lock.yaml
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — pnpm-lock.yaml
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Trivy conf 1.00 CVE-2026-6734: undici 7.24.8 — pnpm-lock.yaml
undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requ…
VulnCve 2026 6734
high System graph security Trivy conf 1.00 CVE-2026-9697: undici 7.24.8 — pnpm-lock.yaml
undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default tr…
VulnCve 2026 9697
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — pnpm-lock.yaml
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/generators/src/likec4/operators/expressions.ts:160
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/generators/src/likec4/operators/expressions.ts:160 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/generators/src/likec4/operators/views.ts:77
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/generators/src/likec4/operators/views.ts:77 Exec used
high System graph security security conf 1.00 Insecure pattern 'new_function_used' in packages/icons/scripts/prerender-svg.mjs:45
Found a known-risky pattern (new_function_used). Review and replace if possible.
packages/icons/scripts/prerender-svg.mjs:45 New function used
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in packages/diagram/vite.config.ts:3
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/diagram/vite.config.ts:3 Node child process
high System graph cicd CI/CD security conf 1.00 pull_request_target workflow appears to check out untrusted PR code
pull_request_target runs with base-repo privileges. Checking out PR head code in that context can expose repository tokens or secrets to attacker-controlled code.
.github/workflows/prepare-release.yaml CI/CD securitySupply chainGithub actions
high System graph dependencies dependencies conf 1.00 Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj
OSV.dev reports `sharp` at version `0.34.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f88m-g3jw-g9cj. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 Advisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj Fix: upgrade `sharp…
pnpm-lock.yaml ScaOsvGhsa f88m g3jw g9cj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.18.0: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.18.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-48779 Advisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p Fix: upgrade `ws` past…
pnpm-lock.yaml ScaOsvGhsa 96hv 2xvq fx4p
high System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.20.1: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.20.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-48779 Advisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p Fix: upgrade `ws` past…
pnpm-lock.yaml ScaOsvGhsa 96hv 2xvq fx4p
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/diagram/src/base-primitives/Markdown.tsx:57
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/diagram/src/base-primitives/Markdown.tsx:57 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/diagram/src/context/IconRenderer.tsx:194
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/diagram/src/context/IconRenderer.tsx:194 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/diagram/src/context/TagStylesContext.tsx:77
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/diagram/src/context/TagStylesContext.tsx:77 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/diagram/src/LikeC4Styles.tsx:107
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/diagram/src/LikeC4Styles.tsx:107 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/diagram/src/shadowroot/ShadowRoot.tsx:173
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/diagram/src/shadowroot/ShadowRoot.tsx:173 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/likec4-spa/src/pages/ViewAsD2.tsx:71
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/likec4-spa/src/pages/ViewAsD2.tsx:71 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/likec4-spa/src/pages/ViewAsDot.tsx:31
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/likec4-spa/src/pages/ViewAsDot.tsx:31 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/likec4-spa/src/pages/ViewAsMmd.tsx:56
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/likec4-spa/src/pages/ViewAsMmd.tsx:56 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — packages/likec4-spa/src/pages/ViewAsPuml.tsx:69
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
packages/likec4-spa/src/pages/ViewAsPuml.tsx:69 Fq dangerous html
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/agents/release.agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/agents/release.agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/settings.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/settings.json VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
AGENTS.md VerificationAgents md
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/likec4-dsl/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/likec4-dsl/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash-es 4.17.21 — pnpm-lock.yaml
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2026-1525: undici 7.18.2 — pnpm-lock.yaml
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests w…
VulnCve 2026 1525
medium System graph security Trivy conf 1.00 CVE-2026-1527: undici 7.18.2 — pnpm-lock.yaml
undici: Undici: HTTP header injection and request smuggling vulnerability ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request premature…
VulnCve 2026 1527
medium System graph security Trivy conf 1.00 CVE-2026-2581: undici 7.18.2 — pnpm-lock.yaml
undici: Undici: Denial of Service due to uncontrolled resource consumption This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated reque…
VulnCve 2026 2581
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash-es 4.17.21 — pnpm-lock.yaml
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 4.0.1 — pnpm-lock.yaml
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42338: ip-address 10.1.0 — pnpm-lock.yaml
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embeddi…
VulnCve 2026 42338
medium System graph security Trivy conf 1.00 CVE-2026-45149: brace-expansion 5.0.5 — pnpm-lock.yaml
brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expa…
VulnCve 2026 45149
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.0 — pnpm-lock.yaml
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45740: protobufjs 7.5.6 — pnpm-lock.yaml
protobufjs: protobufjs: Denial of Service via crafted JSON descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.add…
VulnCve 2026 45740
medium System graph security Trivy conf 1.00 CVE-2026-54269: protobufjs 7.5.6 — pnpm-lock.yaml
protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protob…
VulnCve 2026 54269
medium System graph security Trivy conf 1.00 CVE-2026-59877: protobufjs 7.5.6 — pnpm-lock.yaml
protobufjs: protobufjs: Denial of Service via crafted .proto schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a…
VulnCve 2026 59877
medium System graph security Trivy conf 1.00 CVE-2026-9678: undici 7.18.2 — pnpm-lock.yaml
undici: Undici: Information disclosure due to improper cache-control header parsing Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" author…
VulnCve 2026 9678
medium System graph security Trivy conf 1.00 CVE-2026-9678: undici 7.24.8 — pnpm-lock.yaml
undici: Undici: Information disclosure due to improper cache-control header parsing Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" author…
VulnCve 2026 9678
medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 7.18.2 — pnpm-lock.yaml
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…
VulnCve 2026 9679
medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 7.24.8 — pnpm-lock.yaml
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…
VulnCve 2026 9679
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-editor-api is two or more major versions behind
`@codingame/monaco-vscode-editor-api` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guid…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-editor-service-override is two or more major versions behind
`@codingame/monaco-vscode-editor-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / m…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-files-service-override is two or more major versions behind
`@codingame/monaco-vscode-files-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / mi…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-keybindings-service-override is two or more major versions behind
`@codingame/monaco-vscode-keybindings-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelo…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-lifecycle-service-override is two or more major versions behind
`@codingame/monaco-vscode-lifecycle-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog …
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-textmate-service-override is two or more major versions behind
`@codingame/monaco-vscode-textmate-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog /…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-theme-defaults-default-extension is two or more major versions behind
`@codingame/monaco-vscode-theme-defaults-default-extension` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream chan…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-theme-service-override is two or more major versions behind
`@codingame/monaco-vscode-theme-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / mi…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @codingame/monaco-vscode-views-service-override is two or more major versions behind
`@codingame/monaco-vscode-views-service-override` is pinned at `16.1.1` in `apps/playground/package.json` while the latest release on the npm registry is `36.0.0` — 20 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / mi…
apps/playground/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency @types/node is two or more major versions behind
`@types/node` is pinned at `22.19.17` in `e2e/package.json` while the latest release on the npm registry is `26.1.1` — 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@types/node` to `26.…
e2e/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency typescript is two or more major versions behind
`typescript` is pinned at `5.9.3` in `e2e/package.json` while the latest release on the npm registry is `7.0.2` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `typescript` to `7.0.2`.
e2e/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency which is two or more major versions behind
`which` is pinned at `5.0.0` in `packages/language-server/package.json` while the latest release on the npm registry is `7.0.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `which` to…
packages/language-server/package.json FreshnessOutdated
medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — Dockerfile
'RUN cd ...' to change directory RUN should not be used to change directory: 'apt-get update && apt-get install -y --no-install-recommends ca-certificates build-essential jq libexpat1-dev libgd-dev zlib1g-dev curl cmake pk…
Misconfig
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — apps/docs/src/lib/githubdata.ts:187
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
apps/docs/src/lib/githubdata.ts:187 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — apps/playground/worker/index.ts:77
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
apps/playground/worker/index.ts:77 runtime safetyRobustnessUnhandled promise
medium System graph security Trivy conf 1.00 GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 — pnpm-lock.yaml
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44). ### Summary On Wind…
VulnGhsa frvp 7c67 39w9
medium System graph cicd CI/CD security conf 1.00 12 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
12 files, 12 locations
.github/workflows/checks.yaml:67
.github/workflows/cleanup-cache.yml:18
.github/workflows/codeql.yml:49
.github/workflows/docker.yaml:51
.github/workflows/docs.yaml:67
.github/workflows/e2e-update-screenshots.yaml:83
.github/workflows/issue-comment.yaml:35
.github/workflows/main.yml:73
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 7 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
7 files, 7 locations
.github/workflows/docker.yaml
.github/workflows/e2e-update-screenshots.yaml
.github/workflows/issue-comment.yaml
.github/workflows/main.yml
.github/workflows/prepare-release.yaml
.github/workflows/release.yaml
.github/workflows/test-export-action.yml
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/mcp/src/server/StreamableLikeC4MCPServer.ts:25
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
packages/mcp/src/server/StreamableLikeC4MCPServer.ts:25 Cors wildcard
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/diagram/src/base-primitives/Markdown.tsx:9
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/diagram/src/base-primitives/Markdown.tsx:9 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/diagram/src/context/IconRenderer.tsx:194
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/diagram/src/context/IconRenderer.tsx:194 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/diagram/src/context/TagStylesContext.tsx:77
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/diagram/src/context/TagStylesContext.tsx:77 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/diagram/src/LikeC4Styles.tsx:107
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/diagram/src/LikeC4Styles.tsx:107 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/diagram/src/shadowroot/ShadowRoot.tsx:173
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/diagram/src/shadowroot/ShadowRoot.tsx:173 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/likec4-spa/src/pages/ViewAsD2.tsx:71
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/likec4-spa/src/pages/ViewAsD2.tsx:71 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/likec4-spa/src/pages/ViewAsDot.tsx:31
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/likec4-spa/src/pages/ViewAsDot.tsx:31 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/likec4-spa/src/pages/ViewAsMmd.tsx:56
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/likec4-spa/src/pages/ViewAsMmd.tsx:56 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in packages/likec4-spa/src/pages/ViewAsPuml.tsx:69
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/likec4-spa/src/pages/ViewAsPuml.tsx:69 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in apps/playground/src/components/appshell/UserButton.tsx:47
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
apps/playground/src/components/appshell/UserButton.tsx:47 Local storage auth token
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 28 placeholder/mock markers across 15 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Semgrep conf 0.70 react dangerouslysetinnerhtml — packages/diagram/src/base-primitives/Markdown.tsx:57
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
packages/diagram/src/base-primitives/Markdown.tsx:57 SecurityReact
medium System graph security Semgrep conf 0.70 react dangerouslysetinnerhtml — packages/diagram/src/context/TagStylesContext.tsx:77
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
packages/diagram/src/context/TagStylesContext.tsx:77 SecurityReact
medium System graph security Semgrep conf 0.70 react dangerouslysetinnerhtml — packages/diagram/src/LikeC4Styles.tsx:107
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
packages/diagram/src/LikeC4Styles.tsx:107 SecurityReact
medium System graph security Semgrep conf 0.70 react dangerouslysetinnerhtml — packages/diagram/src/shadowroot/ShadowRoot.tsx:173
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
packages/diagram/src/shadowroot/ShadowRoot.tsx:173 SecurityReact
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
162 test file(s) for 6492 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9
OSV.dev reports `@hono/node-server` at version `1.19.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-frvp-7c67-39w9. Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) Advisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9 Fix: upgrade …
pnpm-lock.yaml ScaOsvGhsa frvp 7c67 39w9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.18.0: GHSA-58qx-3vcg-4xpx
OSV.dev reports `ws` at version `8.18.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-58qx-3vcg-4xpx (aka CVE-2026-45736). ws: Uninitialized memory disclosure Aliases: CVE-2026-45736 Advisory: https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx Fix: upgrade `ws` past the affected range per th…
pnpm-lock.yaml ScaOsvGhsa 58qx 3vcg 4xpx
low System graph api Wiring conf 1.00 2 backend endpoints not called by scanned frontend
No scanned frontend call matched these backend routes. Sample: ALL /mcp, USE /__likec4_ai. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes.
Unused endpoint
low System graph quality Maintenance conf 1.00 32 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph security Trivy conf 1.00 CVE-2025-14505: elliptic 6.6.1 — pnpm-lock.yaml
elliptic: Key handling flaws in Elliptic The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, whi…
VulnCve 2025 14505
low System graph security Trivy conf 1.00 CVE-2026-11525: undici 7.18.2 — pnpm-lock.yaml
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC…
VulnCve 2026 11525
low System graph security Trivy conf 1.00 CVE-2026-11525: undici 7.24.8 — pnpm-lock.yaml
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC…
VulnCve 2026 11525
low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 2.2.2 — pnpm-lock.yaml
body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…
VulnCve 2026 12590
low System graph security Trivy conf 1.00 CVE-2026-24001: diff 7.0.0 — pnpm-lock.yaml
jsdiff: denial of service vulnerability in parsePatch and applyPatch jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause…
VulnCve 2026 24001
low System graph security Trivy conf 1.00 CVE-2026-6733: undici 7.18.2 — pnpm-lock.yaml
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response…
VulnCve 2026 6733
low System graph security Trivy conf 1.00 CVE-2026-6733: undici 7.24.8 — pnpm-lock.yaml
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response…
VulnCve 2026 6733
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — apps/playground/src/monaco/MonacoEditor.tsx:46
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
apps/playground/src/monaco/MonacoEditor.tsx:46 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — apps/playground/src/routes/share.$shareId/view/route.tsx:29
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
apps/playground/src/routes/share.$shareId/view/route.tsx:29 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — apps/playground/src/state/context.tsx:21
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
apps/playground/src/state/context.tsx:21 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — apps/playground/worker/api.share.ts:47
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
apps/playground/worker/api.share.ts:47 Fq console leak
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 118 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency @typefox/monaco-editor-react is a major version behind
`@typefox/monaco-editor-react` is pinned at `6.7.0` in `apps/playground/package.json` while the latest release on the npm registry is `7.7.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgr…
apps/playground/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency monaco-languageclient is a major version behind
`monaco-languageclient` is pinned at `9.6.0` in `apps/playground/package.json` while the latest release on the npm registry is `10.7.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `m…
apps/playground/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency std-env is a major version behind
`std-env` is pinned at `3.9.0` in `e2e/package.json` while the latest release on the npm registry is `4.2.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `std-env` to `4.2.0`.
e2e/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency yargs is a major version behind
`yargs` is pinned at `17.7.2` in `packages/likec4/package.json` while the latest release on the npm registry is `18.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `yargs` to `18.0.…
packages/likec4/package.json FreshnessOutdated
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22.22.3-bookworm
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:2 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22.22.3-bookworm-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:37 containersPinned dependencies
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile
Misconfig
low System graph security Trivy conf 1.00 GHSA-g7r4-m6w7-qqqr: esbuild 0.27.3 — pnpm-lock.yaml
esbuild allows arbitrary file read when running the development server on Windows ### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instea…
VulnGhsa g7r4 m6w7 qqqr
low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/vscode.yaml:47 CI/CD securitySupply chainGithub actions
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/docs/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
apps/docs/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/playground/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
apps/playground/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: devops/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
devops/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: e2e/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
e2e/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/config/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/config/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/core/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/core/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/create-likec4/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/create-likec4/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/create-likec4/template/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/create-likec4/template/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/diagram/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/diagram/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/generators/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/generators/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/icons/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/icons/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/language-server/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/language-server/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/language-services/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/language-services/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/layouts/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/layouts/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/leanix-bridge/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/leanix-bridge/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/likec4-spa/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/likec4-spa/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/likec4/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/likec4/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/log/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/log/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/lsp/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/lsp/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/mcp/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/mcp/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/react/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/react/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/vite-plugin/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/vite-plugin/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/vscode-preview/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/vscode-preview/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/vscode/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/vscode/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: styled-system/preset/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
styled-system/preset/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: styled-system/styles/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
styled-system/styles/package.json LockfileReproducibilityGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `cloud_legacy` in e2e/src/likec4-model.test-d.ts:72
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `cloud_legacy` in e2e/src/likec4-views.test-d.ts:79
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `ContainerServicesDeprecated` in packages/icons/azure/index.ts:182
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `EslintOld` in packages/icons/tech/index.ts:583
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `mute_old` in packages/core/src/compute-view/element-view/__test__/fixture.ts:355
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `SvgContainerServicesDeprecated` in packages/icons/azure/container-services-deprecated.tsx:4
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `SvgEslintOld` in packages/icons/tech/eslint-old.tsx:4
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
package.json CI/CD securitySupply chainNpm
low System graph frontend Frontend quality conf 0.85 React Flow <Controls> without dark theming — packages/diagram/src/likec4diagram/DiagramXYFlow.tsx:313
`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper. Why: P1 in CHECKLIST.md — vendor defaults bleed light through. Rule id: fq.controls.no-bg
packages/diagram/src/likec4diagram/DiagramXYFlow.tsx:313 Fq controls no bg
low System graph frontend Frontend quality conf 0.85 React Flow edge with `label=` but no project-wide edge-label CSS override — packages/core/src/compute-view/utils/view-hash.ts:39
React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet. Why: P-H in CHECKLIST.md — vendor edge labels bleed whit…
packages/core/src/compute-view/utils/view-hash.ts:39 Fq edge label no bg
low System graph quality Complexity conf 1.00 Very large file: packages/generators/src/drawio/generate-drawio.ts (1431 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/generators/src/drawio/parse-drawio.ts (1996 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/icons/bootstrap/index.ts (2051 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/icons/tech/index.ts (2000 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/icons/tech/linux.tsx (3092 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/icons/tech/memgraph.tsx (2313 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/icons/tech/sugarss.tsx (834 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/icons/tech/tastejs.tsx (1631 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/language-server/src/formatting/LikeC4Formatter.spec.ts (2128 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: packages/language-server/src/workspace/ProjectsManager.spec.ts (1346 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 1.00 Vulnerable dependency esbuild 0.27.3: GHSA-g7r4-m6w7-qqqr
OSV.dev reports `esbuild` at version `0.27.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-g7r4-m6w7-qqqr. esbuild allows arbitrary file read when running the development server on Windows Advisory: https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr Fix: upgrade `esbuild` past the affected r…
pnpm-lock.yaml ScaOsvGhsa g7r4 m6w7 qqqr
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/f231e8af-e109-4b5e-ae83-0e556bc3197f/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/f231e8af-e109-4b5e-ae83-0e556bc3197f/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.