Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Zackriya-Solutions/meetily

https://github.com/Zackriya-Solutions/meetily · scanned 2026-07-23 19:44 UTC (3 months ago)

218 raw signals (0 security + 218 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v7 · last Δ +0.2 (diff) · 207 actionable findings from 1 signal source. 11 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
56.6
/100
Security checks
57
0 findings
System graph
57
90.0% cov · 207 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: high × excluding tests × Reset all
Severity: Critical 0 High 43 Medium 84 Low 70 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 207 Crowd 0 Layer: Software 2 Frontend 59 Security 71 Cicd 3 Quality 11 Dependencies 61
Scan summary Repository scanned at 56.6/100 with 90.0% coverage. It contains 1420 nodes across 19 cross-layer flows, written primarily in mixed languages. Engine surfaced 218 findings — concentrated in security (71), dependencies (61), frontend (59). Risk profile is high: 0 critical, 43 high, 94 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 43 of 207 actionable findings. 218 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.1.0 — frontend/pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-24486: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=…
VulnCve 2026 24486
high System graph security Trivy conf 1.00 CVE-2026-25580: pydantic-ai 0.2.15 — backend/requirements.txt
Pydantic AI: Pydantic AI: Information disclosure via Server-Side Request Forgery (SSRF) through malicious URLs in message history. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) v…
VulnCve 2026 25580
high System graph security Trivy conf 1.00 CVE-2026-42561: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: python-multipart: Denial of Service via excessive multipart part headers Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, Multip…
VulnCve 2026 42561
high System graph security Trivy conf 1.00 CVE-2026-44573: next 14.2.35 — frontend/pnpm-lock.yaml
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44578: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-48801: linkify-it 5.0.0 — frontend/pnpm-lock.yaml
linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy lin…
VulnCve 2026 48801
high System graph security Trivy conf 1.00 CVE-2026-53539: python-multipart 0.0.20 — backend/requirements.txt
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it fir…
VulnCve 2026 53539
high System graph security Trivy conf 1.00 CVE-2026-59887: linkify-it 5.0.0 — frontend/pnpm-lock.yaml
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaini…
VulnCve 2026 59887
high System graph security Trivy conf 1.00 CVE-2026-64641: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Denial of Service in App Router using Server Actions ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exis…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64645: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffi…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64649: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js: Server-Side Request Forgery in Server Actions on custom servers ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to contro…
VulnCve 2026 64649
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — backend/Dockerfile.app
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: backend/Dockerfile.app
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.app
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.app
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.server-cpu
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y build-essential cmake git wget pkg-config libsdl2-dev && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.ser…
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.server-gpu
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y build-essential cmake git wget pkg-config libsdl2-dev && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.ser…
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile.server-macos
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y build-essential cmake git wget pkg-config libsdl2-dev && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: backend/Dockerfile.ser…
Misconfig
high System graph security auth conf 0.75 FastAPI POST `delete_meeting` without auth dependency — backend/app/main.py:206
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:206 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `get_api_key` without auth dependency — backend/app/main.py:589
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:589 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `get_transcript_api_key` without auth dependency — backend/app/main.py:596
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:596 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `process_transcript_api` without auth dependency — backend/app/main.py:329
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:329 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_meeting_summary` without auth dependency — backend/app/main.py:607
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:607 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_meeting_title` without auth dependency — backend/app/main.py:196
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:196 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_model_config` without auth dependency — backend/app/main.py:560
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:560 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_transcript_config` without auth dependency — backend/app/main.py:578
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:578 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `save_transcript` without auth dependency — backend/app/main.py:511
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:511 securityAuth fastapi unauth mutation
high System graph security auth conf 0.75 FastAPI POST `search_transcripts` without auth dependency — backend/app/main.py:623
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
backend/app/main.py:623 securityAuth fastapi unauth mutation
high System graph security Trivy conf 1.00 GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 — Cargo.lock
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING ### Summary `bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public…
VulnGhsa 82j2 j2ch gfr8
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-h25m-26qc-wcjf: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x usin…
VulnGhsa h25m 26qc wcjf
high System graph security Trivy conf 1.00 GHSA-q4gf-8mx6-v5v3: next 14.2.35 — frontend/pnpm-lock.yaml
Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-238…
VulnGhsa q4gf 8mx6 v5v3
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in frontend/scripts/auto-detect-gpu.js:7
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/auto-detect-gpu.js:7 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in frontend/scripts/tauri-auto.js:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
frontend/scripts/tauri-auto.js:6 Node child process
high System graph security Secrets conf 0.72 Possible secret in frontend/src-tauri/src/analytics/commands.rs
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
frontend/src-tauri/src/analytics/commands.rs:12 Generic api key
high System graph security Secrets conf 0.72 Possible secret in frontend/src-tauri/src/lib_old_complex.rs
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
frontend/src-tauri/src/lib_old_complex.rs:1818 Generic api key
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr…
frontend/package.json ScaOsvGhsa 36qx fr4f 26g5
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x…
frontend/package.json ScaOsvGhsa 89xv 2m56 2m9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the ad…
frontend/package.json ScaOsvGhsa 8h8q 6873 q5fj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Aliases: CVE-2026-45623 Advisory: https:/…
frontend/package.json ScaOsvGhsa 6g55 p6wh 862q
high System graph dependencies dependencies conf 1.00 Vulnerable dependency pydantic-ai 0.2.15: GHSA-2jrp-274c-jhv3
OSV.dev reports `pydantic-ai` at version `0.2.15` (declared in `backend/requirements.txt`) is affected by GHSA-2jrp-274c-jhv3 (aka CVE-2026-25580). Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling Aliases: CVE-2026-25580, PYSEC-2026-2976, PYSEC-2026-2980 Advisory: https…
backend/requirements.txt ScaOsvGhsa 2jrp 274c jhv3
high System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-5rvq-cxj2-64vf
OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-5rvq-cxj2-64vf (aka CVE-2026-53539). python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service Aliases: CVE-2026-53539, PYSEC-2026-…
backend/requirements.txt ScaOsvGhsa 5rvq cxj2 64vf
high System graph dependencies dependencies conf 0.70 Vulnerable dependency tauri 2.6.2: GHSA-7gmj-67g7-phm9
OSV.dev reports `tauri` at version `2.6.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184). Note: `2.6.2` is the declared floor of a range — the installed version may be newer. Tauri has an Origin Confusion Issue that Allows Remote Pages to Inv…
frontend/src-tauri/Cargo.toml ScaOsvGhsa 7gmj 67g7 phm9
high System graph dependencies dependencies conf 0.70 Vulnerable dependency zip 2.2: GHSA-94vh-gphv-8pm8
OSV.dev reports `zip` at version `2.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-94vh-gphv-8pm8 (aka CVE-2025-29787). Note: `2.2` is the declared floor of a range — the installed version may be newer. zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to …
frontend/src-tauri/Cargo.toml ScaOsvGhsa 94vh gphv 8pm8
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/f5451e83-66f9-442b-a2ca-8313459d230e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/f5451e83-66f9-442b-a2ca-8313459d230e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.