Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
1 of your 27 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 1.24s · analysis 7.78s · 0.6 MB · GitHub API rate-limit (preflight)

neurons-me/all.this

https://github.com/neurons-me/all.this · scanned 2026-06-05 17:10 UTC (4 days, 22 hours ago) · 10 languages

75 raw signals (27 security + 48 graph) 8th percentile · Typescript · small (2-20K LoC) System graph score 97 (lower by 50)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 22 hours ago · v2 · 51 actionable findings from 2 signal sources. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
82.5
/100
Security checks
68
27 findings
System graph
97
77.8% cov · 24 findings
Critical
1
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 100.0 0.15 15.00
security_score 55.0 0.25 13.75
testing_score 0.0 0.20 0.00
documentation_score 40.0 0.15 6.00
practices_score 42.0 0.15 6.30
code_quality 67.6 0.10 6.76
Overall 1.00 47.8
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 1 High 11 Medium 12 Low 22 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 27 System graph 24 Crowd 0 Layer: Software 37 Quality 9 Api 1 Frontend 2 Security 1 Cicd 1
Scan summary Quality grade D+ (48/100). Dimensions: security 55, maintainability 100. 27 findings (19 security). 4,009 lines analyzed.

Showing 46 of 51 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks software dependencies conf 0.88 @vitest/browser: GHSA-2h32-95rg-cppp
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 axios: GHSA-35jp-ww65-95wh
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 axios: GHSA-777c-7fjr-54vf
Allocation of Resources Without Limits or Throttling in Axios
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 axios: GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 axios: GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 axios: GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 axios: GHSA-pjwm-pj3p-43mv
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to path traversal via percent-encoded dot segments
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 js-cookie: GHSA-qjx8-664m-686j
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
pnpm-lock.yaml
high Security checks software dependencies conf 0.88 systeminformation: GHSA-hvx9-hwr7-wjj9
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 axios: GHSA-898c-q2cr-xwhg
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2
brace-expansion: Large numeric range defeats documented `max` DoS protection
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 esbuild: GHSA-67mh-4wv8-2f99
esbuild enables any website to send any requests to the development server and read the response
pnpm-lock.yaml
high Security checks quality Quality conf 0.80 localStorage write failures are swallowed silently
localStorage quotas are small and writes can fail. Catching storage errors without a user-visible warning causes silent data loss when notes, images, or snapshots exceed quota.
src/npm/src/boot/browser-global.js:114
medium Security checks software dependencies conf 0.88 qs: GHSA-q8mj-m7cp-5q26
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 react-router: GHSA-2j2x-hqr9-3h42
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 turbo: GHSA-hcf7-66rw-9f5r
Trubo: Login callback CSRF/session fixation
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
pnpm-lock.yaml
medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
pnpm-lock.yaml
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/npm/src/boot/browser-global.js:546
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.
auth
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
0 test file(s) for 20 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.
Coverage
low Security checks software dependencies conf 0.88 axios: GHSA-654m-c8p4-x5fp
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
pnpm-lock.yaml
low Security checks quality Documentation No LICENSE file
Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).
low Security checks software dependencies conf 0.88 pm2: GHSA-x5gf-qvw8-r2rm
pm2 Regular Expression Denial of Service vulnerability
pnpm-lock.yaml
low Security checks software dependencies conf 0.88 turbo: GHSA-3qcw-2rhx-2726
Turbo: Unexpected local code execution during Yarn Berry detection
pnpm-lock.yaml
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/cleaker.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-atoms.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-components.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-compounds.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-devtools.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-legacy.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-molecules.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-react.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui-runtime.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/gui.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/me.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/monad.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/npm/src/netget.ts
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph software Dead code candidate conf 1.00 File has no detected symbols: src/pip/setup.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
low System graph frontend Frontend quality conf 1.00 Icon-only button without accessible name — src/npm/src/boot/browser-entry.ts:1266
A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label
Fq button no label
low System graph software Dead code conf 1.00 Possibly dead Python function: greet
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
src/pip/all.this/__init__.py:1
low System graph quality Complexity conf 1.00 Very large file: src/npm/src/boot/browser-entry.ts (2098 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: src/npm/src/boot/browser-global.js (1828 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/f43550d6-be9b-4cca-930d-1e237a032f03/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/f43550d6-be9b-4cca-930d-1e237a032f03/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.