Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Zackriya-Solutions/meetily

https://github.com/Zackriya-Solutions/meetily · scanned 2026-07-23 19:44 UTC (1 month, 2 weeks ago)

218 raw signals (0 security + 218 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v7 · last Δ +0.2 (diff) · 207 actionable findings from 1 signal source. 11 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
56.6
/100
Security checks
57
0 findings
System graph
57
90.0% cov · 207 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 43 Medium 84 Low 70 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 207 Crowd 0 Layer: Software 2 Frontend 59 Security 71 Cicd 3 Quality 11 Dependencies 61
Scan summary Repository scanned at 56.6/100 with 90.0% coverage. It contains 1420 nodes across 19 cross-layer flows, written primarily in mixed languages. Engine surfaced 218 findings — concentrated in security (71), dependencies (61), frontend (59). Risk profile is high: 0 critical, 43 high, 94 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 196 of 207 actionable findings. 218 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.1.0 — frontend/pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-24486: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=…
VulnCve 2026 24486
high System graph security Trivy conf 1.00 CVE-2026-25580: pydantic-ai 0.2.15 — backend/requirements.txt
Pydantic AI: Pydantic AI: Information disclosure via Server-Side Request Forgery (SSRF) through malicious URLs in message history. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) v…
VulnCve 2026 25580
high System graph security Trivy conf 1.00 CVE-2026-42561: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: python-multipart: Denial of Service via excessive multipart part headers Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, Multip…
VulnCve 2026 42561
high System graph security Trivy conf 1.00 CVE-2026-44573: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44578: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-48801: linkify-it 5.0.0 — frontend/pnpm-lock.yaml
linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy lin…
VulnCve 2026 48801
high System graph security Trivy conf 1.00 CVE-2026-53539: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it fir…
VulnCve 2026 53539
high System graph security Trivy conf 1.00 CVE-2026-59887: linkify-it 5.0.0 — frontend/pnpm-lock.yaml
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaini…
VulnCve 2026 59887
high System graph security Trivy conf 1.00 CVE-2026-64641: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Denial of Service in App Router using Server Actions ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exis…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64645: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffi…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64649: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Server-Side Request Forgery in Server Actions on custom servers ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to contro…
VulnCve 2026 64649
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — backend/Dockerfile.app
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: backend/Dockerfile.app
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.app
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.app
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.server-cpu
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y build-essential cmake git wget pkg-config libsdl2-dev && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.ser…
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.server-gpu
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y build-essential cmake git wget pkg-config libsdl2-dev && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.ser…
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.server-macos
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y build-essential cmake git wget pkg-config libsdl2-dev && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.ser…
Misconfig
high System graph security auth conf 0.75 FastAPI POST `delete_meeting` without auth dependency — backend/app/main.py:206
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:206 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `get_api_key` without auth dependency — backend/app/main.py:589
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:589 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `get_transcript_api_key` without auth dependency — backend/app/main.py:596
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:596 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `process_transcript_api` without auth dependency — backend/app/main.py:329
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:329 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_meeting_summary` without auth dependency — backend/app/main.py:607
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:607 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_meeting_title` without auth dependency — backend/app/main.py:196
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:196 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_model_config` without auth dependency — backend/app/main.py:560
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:560 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_transcript_config` without auth dependency — backend/app/main.py:578
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:578 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_transcript` without auth dependency — backend/app/main.py:511
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:511 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `search_transcripts` without auth dependency — backend/app/main.py:623
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:623 securityAuth fastapi unauth mutation
high System graph security Trivy conf 1.00 GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 — Cargo.lock
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING ### Summary `bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public…
VulnGhsa 82j2 j2ch gfr8
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-h25m-26qc-wcjf: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x usin…
VulnGhsa h25m 26qc wcjf
high System graph security Trivy conf 1.00 GHSA-q4gf-8mx6-v5v3: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-238…
VulnGhsa q4gf 8mx6 v5v3
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in frontend/scripts/auto-detect-gpu.js:7
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/auto-detect-gpu.js:7 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in frontend/scripts/tauri-auto.js:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/tauri-auto.js:6 Node child process
high System graph security Secrets conf 0.72 Possible secret in frontend/src-tauri/src/analytics/commands.rs
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
frontend/src-tauri/src/analytics/commands.rs:12 Generic api key
high System graph security Secrets conf 0.72 Possible secret in frontend/src-tauri/src/lib_old_complex.rs
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
frontend/src-tauri/src/lib_old_complex.rs:1818 Generic api key
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr…
frontend/package.json ScaOsvGhsa 36qx fr4f 26g5
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x…
frontend/package.json ScaOsvGhsa 89xv 2m56 2m9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the ad…
frontend/package.json ScaOsvGhsa 8h8q 6873 q5fj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Aliases: CVE-2026-45623 Advisory: https:/…
frontend/package.json ScaOsvGhsa 6g55 p6wh 862q
high System graph dependencies dependencies conf 1.00 Vulnerable dependency pydantic-ai 0.2.15: GHSA-2jrp-274c-jhv3
OSV.dev reports `pydantic-ai` at version `0.2.15` (declared in `backend/requirements.txt`) is affected by GHSA-2jrp-274c-jhv3 (aka CVE-2026-25580). Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling Aliases: CVE-2026-25580, PYSEC-2026-2976, PYSEC-2026-2980 Advisory: https…
backend/requirements.txt ScaOsvGhsa 2jrp 274c jhv3
high System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-5rvq-cxj2-64vf
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-5rvq-cxj2-64vf (aka CVE-2026-53539). python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service Aliases: CVE-2026-53539, PYSEC-2026-…
backend/requirements.txt ScaOsvGhsa 5rvq cxj2 64vf
high System graph dependencies dependencies conf 0.70 Vulnerable dependency tauri 2.6.2: GHSA-7gmj-67g7-phm9
OSV.dev reports `tauri` at version `2.6.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184). Note: `2.6.2` is the declared floor of a range — the installed version may be newer. Tauri has an Origin Confusion Issue that Allows Remote Pages to Inv…
frontend/src-tauri/Cargo.toml ScaOsvGhsa 7gmj 67g7 phm9
high System graph dependencies dependencies conf 0.70 Vulnerable dependency zip 2.2: GHSA-94vh-gphv-8pm8
OSV.dev reports `zip` at version `2.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-94vh-gphv-8pm8 (aka CVE-2025-29787). Note: `2.2` is the declared floor of a range — the installed version may be newer. zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to …
frontend/src-tauri/Cargo.toml ScaOsvGhsa 94vh gphv 8pm8
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/notes/[id]/page.tsx:174
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
frontend/src/app/notes/[id]/page.tsx:174 Fq dangerous html
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-59471: next 14.2.35 — frontend/pnpm-lock.yaml
next: NextJS Denial of Service in Image Optimizer A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcin…
VulnCve 2025 59471
medium System graph security Trivy conf 1.00 CVE-2026-27980: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable…
VulnCve 2026 27980
medium System graph security Trivy conf 1.00 CVE-2026-28684: python-dotenv 1.1.0 — backend/requirements.txt
python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` file…
VulnCve 2026 28684
medium System graph security Trivy conf 1.00 CVE-2026-29057: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: HTTP request smuggling in rewrites Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Tr…
VulnCve 2026 29057
medium System graph security Trivy conf 1.00 CVE-2026-40347: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epi…
VulnCve 2026 40347
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.31 — frontend/pnpm-lock.yaml
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — frontend/pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-44576: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Next.js: Cache poisoning vulnerability in React Server Components Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not corr…
VulnCve 2026 44576
medium System graph security Trivy conf 1.00 CVE-2026-44577: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Next.js: Denial of Service via Image Optimization API Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into mem…
VulnCve 2026 44577
medium System graph security Trivy conf 1.00 CVE-2026-44580: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can b…
VulnCve 2026 44580
medium System graph security Trivy conf 1.00 CVE-2026-44581: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scrip…
VulnCve 2026 44581
medium System graph security Trivy conf 1.00 CVE-2026-45784: openssl 0.10.79 — Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-…
VulnCve 2026 45784
medium System graph security Trivy conf 1.00 CVE-2026-48988: markdown-it 14.1.1 — frontend/pnpm-lock.yaml
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a ... markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from rep…
VulnCve 2026 48988
medium System graph security Trivy conf 1.00 CVE-2026-64643: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Unauthenticated disclosure of internal Server Function endpoints ## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action ID…
VulnCve 2026 64643
medium System graph security Trivy conf 1.00 CVE-2026-64646: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Unbounded Server Action payload in Edge runtime ## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hos…
VulnCve 2026 64646
medium System graph security Trivy conf 1.00 CVE-2026-64647: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **r…
VulnCve 2026 64647
medium System graph security Trivy conf 1.00 CVE-2026-64648: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Cache confusion of response bodies for requests with bodies ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauth…
VulnCve 2026 64648
medium System graph dependencies dependencies conf 0.90 Dependency rubato is two or more major versions behind
`rubato` is pinned at `0.15.0` in `frontend/src-tauri/Cargo.toml` while the latest release on the cargo registry is `4.0.0` — 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `rubato` to `4…
frontend/src-tauri/Cargo.toml FreshnessOutdated
medium System graph security Semgrep conf 0.55 detect child process — frontend/scripts/auto-detect-gpu.js:12
Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-proc…
frontend/scripts/auto-detect-gpu.js:12 SecurityJavascript
medium System graph security Trivy conf 1.00 GHSA-3pv8-6f4r-ffg2: tar 0.4.45 — Cargo.lock
tar has a PAX header desynchronization issue ### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would…
VulnGhsa 3pv8 6f4r ffg2
medium System graph security Trivy conf 1.00 GHSA-7gcf-g7xr-8hxj: serde_with 3.20.0 — Cargo.lock
serde_with: KeyValueMap serialization panics on empty sequence or map entries ### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumptio…
VulnGhsa 7gcf g7xr 8hxj
medium System graph security Trivy conf 1.00 GHSA-wrw7-89jp-8q8g: glib 0.18.5 — Cargo.lock
Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable referenc…
VulnGhsa wrw7 89jp 8q8g
medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
5 files, 5 locations
.github/workflows/build-devtest.yml:55
.github/workflows/build-linux.yml:63
.github/workflows/build-macos.yml:43
.github/workflows/build-windows.yml:48
.github/workflows/build.yml:54
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 7 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
7 files, 7 locations
.github/workflows/build-devtest.yml
.github/workflows/build-linux.yml
.github/workflows/build-macos.yml
.github/workflows/build-test.yml
.github/workflows/build-windows.yml
.github/workflows/build.yml
.github/workflows/release.yml
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in backend/app/main.py:46
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
backend/app/main.py:46 Cors wildcard
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/notes/[id]/page.tsx:174
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
frontend/src/app/notes/[id]/page.tsx:174 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in .github/workflows/build-windows.yml:374
Found a known-risky pattern (weak_hash). Review and replace if possible.
.github/workflows/build-windows.yml:374 Weak hash
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 74 placeholder/mock markers across 34 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Semgrep conf 0.70 react dangerouslysetinnerhtml — frontend/src/app/notes/[id]/page.tsx:174
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
frontend/src/app/notes/[id]/page.tsx:174 SecurityReact
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
5 test file(s) for 330 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190
OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190. Unsoundness in `Error::downcast_mut()` Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190 Fix: upgrade `anyhow` past the affected range per the advisory.
Cargo.toml ScaOsvRustsec 2026 0190
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413
OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413. Note: `atk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0413 Fi…
Cargo.lock ScaOsvRustsec 2024 0413
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416
OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416. Note: `atk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…
Cargo.lock ScaOsvRustsec 2024 0416
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atty 0.2.14: GHSA-g98v-hv3f-hcfr
OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by GHSA-g98v-hv3f-hcfr. Note: `atty` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-g98v-hv3f-h…
Cargo.lock ScaOsvGhsa g98v hv3f hcfr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atty 0.2.14: RUSTSEC-2021-0145
OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by RUSTSEC-2021-0145. Note: `atty` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2021-0145 …
Cargo.lock ScaOsvRustsec 2021 0145
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atty 0.2.14: RUSTSEC-2024-0375
OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0375. Note: `atty` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0375 …
Cargo.lock ScaOsvRustsec 2024 0375
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency bytes 1.9.0: GHSA-434x-w66g-qw3r
OSV.dev reports `bytes` at version `1.9.0` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-434x-w66g-qw3r (aka CVE-2026-25541). Note: `1.9.0` is the declared floor of a range — the installed version may be newer. bytes has integer overflow in BytesMut::reserve Aliases: CVE-2026-…
frontend/src-tauri/Cargo.toml ScaOsvGhsa 434x w66g qw3r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204
OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204. Note: `crossbeam-epoch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
Cargo.lock ScaOsvRustsec 2026 0204
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdk 0.18.2: RUSTSEC-2024-0412
OSV.dev reports `gdk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0412. Note: `gdk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0412 Fi…
Cargo.lock ScaOsvRustsec 2024 0412
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdk-sys 0.18.2: RUSTSEC-2024-0418
OSV.dev reports `gdk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0418. Note: `gdk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…
Cargo.lock ScaOsvRustsec 2024 0418
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdkwayland-sys 0.18.2: RUSTSEC-2024-0411
OSV.dev reports `gdkwayland-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0411. Note: `gdkwayland-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabilit…
Cargo.lock ScaOsvRustsec 2024 0411
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdkx11 0.18.2: RUSTSEC-2024-0417
OSV.dev reports `gdkx11` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0417. Note: `gdkx11` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0…
Cargo.lock ScaOsvRustsec 2024 0417
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdkx11-sys 0.18.2: RUSTSEC-2024-0414
OSV.dev reports `gdkx11-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0414. Note: `gdkx11-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSE…
Cargo.lock ScaOsvRustsec 2024 0414
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency glib 0.18.5: GHSA-wrw7-89jp-8q8g
OSV.dev reports `glib` at version `0.18.5` (resolved in `Cargo.lock`) is affected by GHSA-wrw7-89jp-8q8g. Note: `glib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wrw7-89jp-8…
Cargo.lock ScaOsvGhsa wrw7 89jp 8q8g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency glib 0.18.5: RUSTSEC-2024-0429
OSV.dev reports `glib` at version `0.18.5` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0429. Note: `glib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0429 …
Cargo.lock ScaOsvRustsec 2024 0429
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gtk 0.18.2: RUSTSEC-2024-0415
OSV.dev reports `gtk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0415. Note: `gtk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0415 Fi…
Cargo.lock ScaOsvRustsec 2024 0415
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gtk-sys 0.18.2: RUSTSEC-2024-0420
OSV.dev reports `gtk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0420. Note: `gtk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…
Cargo.lock ScaOsvRustsec 2024 0420
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gtk3-macros 0.18.2: RUSTSEC-2024-0419
OSV.dev reports `gtk3-macros` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0419. Note: `gtk3-macros` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUST…
Cargo.lock ScaOsvRustsec 2024 0419
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-3x4c-7xq6-9pq8
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-3x4c-7xq6-9pq8 (aka CVE-2026-27980). Next.js: Unbounded next/image disk cache growth can exhaust storage Aliases: CVE-2026-27980 Advisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8 Fix:…
frontend/package.json ScaOsvGhsa 3x4c 7xq6 9pq8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-4633-3j49-mh5q
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647). Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Aliases: CVE-2026-64647 Advisory: https://osv.d…
frontend/package.json ScaOsvGhsa 4633 3j49 mh5q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-4c39-4ccg-62r3
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646). Next.js: Unbounded Server Action payload in Edge runtime Aliases: CVE-2026-64646 Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `n…
frontend/package.json ScaOsvGhsa 4c39 4ccg 62r3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-68g3-v927-f742
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648). Next.js: Cache confusion of response bodies for requests with bodies Aliases: CVE-2026-64648 Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix…
frontend/package.json ScaOsvGhsa 68g3 v927 f742
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-955p-x3mx-jcvp
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643). Next.js: Unauthenticated disclosure of internal Server Function endpoints Aliases: CVE-2026-64643 Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcv…
frontend/package.json ScaOsvGhsa 955p x3mx jcvp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-9g9p-9gw9-jx7f
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-9g9p-9gw9-jx7f (aka CVE-2025-59471). Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration Aliases: CVE-2025-59471 Advisory: https://osv.dev/vulner…
frontend/package.json ScaOsvGhsa 9g9p 9gw9 jx7f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-c4j6-fc7j-m34r
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-c4j6-fc7j-m34r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa c4j6 fc7j m34r
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-ffhc-5mcf-pf4q
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-ffhc-5mcf-pf4q. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa ffhc 5mcf pf4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-ggv3-7p47-pfv8
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-ggv3-7p47-pfv8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8 Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa ggv3 7p47 pfv8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-gx5p-jg67-6x7h
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-gx5p-jg67-6x7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa gx5p jg67 6x7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-h25m-26qc-wcjf
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-h25m-26qc-wcjf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa h25m 26qc wcjf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-h64f-5h5j-jqjh
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-h64f-5h5j-jqjh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa h64f 5h5j jqjh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-m99w-x7hq-7vfj
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-m99w-x7hq-7vfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa m99w x7hq 7vfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-p9j2-gv94-2wf4
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-p9j2-gv94-2wf4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4 Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa p9j2 gv94 2wf4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-q4gf-8mx6-v5v3
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-q4gf-8mx6-v5v3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa q4gf 8mx6 v5v3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-vfv6-92ff-j949
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-vfv6-92ff-j949. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa vfv6 92ff j949
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-wfc6-r584-vfw7
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-wfc6-r584-vfw7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: upgrade `next` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa wfc6 r584 vfw7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-qx2v-qp2m-jg93. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: upgrade `postcss` past the affected range per the advisory.
frontend/package.json ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-dotenv 1.1.0: GHSA-mf9w-mj56-hr94
OSV.dev reports `python-dotenv` at version `1.1.0` (declared in `backend/requirements.txt`) is affected by GHSA-mf9w-mj56-hr94. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94 Fix: upgrade `python-dotenv` past the affected range per the advisory.
backend/requirements.txt ScaOsvGhsa mf9w mj56 hr94
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-dotenv 1.1.0: PYSEC-2026-2270
OSV.dev reports `python-dotenv` at version `1.1.0` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-2270. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2270 Fix: upgrade `python-dotenv` past the affected range per the advisory.
backend/requirements.txt ScaOsvPysec 2026 2270
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-6jv3-5f52-599m
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-6jv3-5f52-599m (aka CVE-2026-53538). python-multipart: Semicolon treated as querystring field separator enables parameter smuggling Aliases: CVE-2026-53538, PYSEC-2026-3037 Advisory…
backend/requirements.txt ScaOsvGhsa 6jv3 5f52 599m
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-mj87-hwqh-73pj
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-mj87-hwqh-73pj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mj87-hwqh-73pj Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvGhsa mj87 hwqh 73pj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-pp6c-gr5w-3c5g
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-pp6c-gr5w-3c5g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pp6c-gr5w-3c5g Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvGhsa pp6c gr5w 3c5g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-v9pg-7xvm-68hf
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-v9pg-7xvm-68hf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvGhsa v9pg 7xvm 68hf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-vffw-93wf-4j4q
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-vffw-93wf-4j4q. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvGhsa vffw 93wf 4j4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-wp53-j4wj-2cfg
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-wp53-j4wj-2cfg. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wp53-j4wj-2cfg Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvGhsa wp53 j4wj 2cfg
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-1852
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-1852. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1852 Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvPysec 2026 1852
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3038
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3038. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3038 Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvPysec 2026 3038
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3039
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3039. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3039 Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvPysec 2026 3039
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3040
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3040. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3040 Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvPysec 2026 3040
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3041
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3041. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3041 Fix: upgrade `python-multipart` past the affected range per the advisory.
backend/requirements.txt ScaOsvPysec 2026 3041
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2
OSV.dev reports `tar` at version `0.4.45` (resolved in `Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2. tar has a PAX header desynchronization issue Advisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2 Fix: upgrade `tar` past the affected range per the advisory.
frontend/src-tauri/Cargo.toml ScaOsvGhsa 3pv8 6f4r ffg2
low System graph quality Integrity conf 1.00 9 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `APPDATA`, `BLAS_INCLUDE_DIRS`, `CUDA_PATH`, `DATABASE_PATH`, `NODE_ENV`, `OLLAMA_HOST`, `ROCM_PATH`, `TAURI_GPU_FEATURE` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break.
config drift
low System graph security Trivy conf 1.00 CVE-2026-44572: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path ha…
VulnCve 2026 44572
low System graph security Trivy conf 1.00 CVE-2026-44582: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Next.js: Cache poisoning allows incorrect response delivery Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with…
VulnCve 2026 44582
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.29.0 — frontend/pnpm-lock.yaml
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph security Trivy conf 1.00 CVE-2026-53537: python-multipart 0.0.20 — backend/requirements.txt
multipart: Python-Multipart: Information disclosure via header parsing discrepancy Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 22…
VulnCve 2026 53537
low System graph security Trivy conf 1.00 CVE-2026-53538: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. …
VulnCve 2026 53538
low System graph security Trivy conf 1.00 CVE-2026-53540: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request…
VulnCve 2026 53540
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/app/layout.tsx:87
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/app/layout.tsx:87 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/app/meeting-details/page-content.tsx:50
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/app/meeting-details/page-content.tsx:50 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/app/meeting-details/page.tsx:56
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/app/meeting-details/page.tsx:56 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/app/page.tsx:80
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/app/page.tsx:80 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/app/settings/page.tsx:40
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/app/settings/page.tsx:40 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/AISummary/BlockNoteSummaryView.tsx:45
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/AISummary/BlockNoteSummaryView.tsx:45 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/AISummary/index.tsx:218
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/AISummary/index.tsx:218 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/AnalyticsConsentSwitch.tsx:116
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/AnalyticsConsentSwitch.tsx:116 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/AudioBackendSelector.tsx:69
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/AudioBackendSelector.tsx:69 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/BlockNoteEditor/Editor.tsx:17
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/BlockNoteEditor/Editor.tsx:17 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/ConsoleToggle.tsx:15
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/ConsoleToggle.tsx:15 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/DeviceSelection.tsx:59
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/DeviceSelection.tsx:59 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/LanguageSelection.tsx:145
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/LanguageSelection.tsx:145 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/MeetingDetails/SummaryGeneratorButtonGroup.tsx:71
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/MeetingDetails/SummaryGeneratorButtonGroup.tsx:71 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/MeetingDetails/SummaryPanel.tsx:300
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/MeetingDetails/SummaryPanel.tsx:300 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/ModelSettingsModal.tsx:322
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/ModelSettingsModal.tsx:322 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/onboarding/steps/DownloadProgressStep.tsx:66
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/onboarding/steps/DownloadProgressStep.tsx:66 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/onboarding/steps/PermissionsStep.tsx:16
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/onboarding/steps/PermissionsStep.tsx:16 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/ParakeetModelManager.tsx:81
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/ParakeetModelManager.tsx:81 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/PreferenceSettings.tsx:83
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/PreferenceSettings.tsx:83 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/RecordingControls.tsx:77
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/RecordingControls.tsx:77 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/Sidebar/index.tsx:113
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/Sidebar/index.tsx:113 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/Sidebar/SidebarProvider.tsx:151
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/Sidebar/SidebarProvider.tsx:151 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/SummaryModelSettings.tsx:86
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/SummaryModelSettings.tsx:86 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:85
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:85 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/TranscriptView.tsx:111
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/TranscriptView.tsx:111 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/UpdateDialog.tsx:93
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/UpdateDialog.tsx:93 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/components/WhisperModelManager.tsx:129
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/components/WhisperModelManager.tsx:129 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/contexts/ConfigContext.tsx:200
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/contexts/ConfigContext.tsx:200 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/contexts/OllamaDownloadContext.tsx:45
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/contexts/OllamaDownloadContext.tsx:45 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/contexts/OnboardingContext.tsx:129
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/contexts/OnboardingContext.tsx:129 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/contexts/RecordingPostProcessingProvider.tsx:37
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/contexts/RecordingPostProcessingProvider.tsx:37 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/contexts/RecordingStateContext.tsx:74
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/contexts/RecordingStateContext.tsx:74 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/contexts/TranscriptContext.tsx:103
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/contexts/TranscriptContext.tsx:103 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/meeting-details/useCopyOperations.ts:27
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/meeting-details/useCopyOperations.ts:27 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/meeting-details/useMeetingData.ts:34
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/meeting-details/useMeetingData.ts:34 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/meeting-details/useModelConfiguration.ts:26
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/meeting-details/useModelConfiguration.ts:26 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/meeting-details/useSummaryGeneration.ts:119
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/meeting-details/useSummaryGeneration.ts:119 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/meeting-details/useTemplates.ts:23
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/meeting-details/useTemplates.ts:23 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/useAudioPlayer.ts:19
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/useAudioPlayer.ts:19 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/useModalState.ts:107
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/useModalState.ts:107 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/usePermissionCheck.ts:35
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/usePermissionCheck.ts:35 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/useProcessingProgress.ts:56
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/useProcessingProgress.ts:56 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/useRecordingStart.ts:85
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/useRecordingStart.ts:85 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/useRecordingStateSync.ts:26
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/useRecordingStateSync.ts:26 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/hooks/useRecordingStop.ts:84
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/hooks/useRecordingStop.ts:84 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/lib/analytics.ts:48
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/lib/analytics.ts:48 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/services/indexedDBService.ts:363
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/services/indexedDBService.ts:363 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — frontend/src/services/updateService.ts:51
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
frontend/src/services/updateService.ts:51 Fq console leak
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 485 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency dirs is a major version behind
`dirs` is pinned at `5.0.1` in `frontend/src-tauri/Cargo.toml` while the latest release on the cargo registry is `6.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `dirs` to `6.0.0`.
frontend/src-tauri/Cargo.toml FreshnessOutdated
low System graph security Trivy conf 1.00 GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 — Cargo.lock
webpki: Name constraints for URI names were incorrectly accepted Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected un…
VulnGhsa 965h 392x 2mh5
low System graph security Trivy conf 1.00 GHSA-g98v-hv3f-hcfr: atty 0.2.14 — Cargo.lock
atty potential unaligned read On windows, `atty` dereferences a potentially unaligned pointer. In practice however, the pointer won't be unaligned unless a custom global allocator is used. In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignmen…
VulnGhsa g98v hv3f hcfr
low System graph security Trivy conf 1.00 GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 — Cargo.lock
webpki: Name constraints were accepted for certificates asserting a wildcard name Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly …
VulnGhsa xgp8 3hg3 c2mh
low System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 2 locations
.github/workflows/pr-main-check.yml:19
.github/workflows/release.yml:22
CI/CD securitySupply chainGithub actions
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `daysOld` in frontend/src/services/indexedDBService.ts:326
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `eleven_multilingual_v2` in frontend/src/components/TranscriptSettings.tsx:57
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: delete_api_key
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/app/db.py:863
low System graph software Dead code conf 1.00 Possibly dead Python function: process_transcript_background
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/app/main.py:219
low System graph quality Complexity conf 1.00 Very large file: backend/run-docker.sh (2008 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src-tauri/src/lib_old_complex.rs (2437 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: frontend/src/components/ModelSettingsModal.tsx (1408 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-3g8h-86w9-wvmq
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-3g8h-86w9-wvmq (aka CVE-2026-44572). Next.js's Middleware / Proxy redirects can be cache-poisoned Aliases: CVE-2026-44572 Advisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq Fix: upgrad…
frontend/package.json ScaOsvGhsa 3g8h 86w9 wvmq
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/f5451e83-66f9-442b-a2ca-8313459d230e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/f5451e83-66f9-442b-a2ca-8313459d230e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.