dart-lang/sdk

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

108 of your 179 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Upstream (GitHub) caused delay on this scan — not Repobility.

GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
Clone from GitHub took 52.31s for a 285.8 MB repo slow.
Repobility's analysis ran in 83.22s after the clone landed.

https://github.com/dart-lang/sdk · scanned 2026-06-05 21:34 UTC (4 days, 11 hours ago) · 10 languages

489 raw signals (171 security + 318 graph) 11/13 scanners ran System graph score 70 (higher by 15)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 11 hours ago · v2 · 195 actionable findings from 2 signal sources. 135 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 142 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	100.0	0.25	25.00
`testing_score`	90.0	0.20	18.00
`documentation_score`	100.0	0.15	15.00
`practices_score`	69.0	0.15	10.35
`code_quality`	69.0	0.10	6.90
Overall		1.00	85.0

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 17 Medium 47 Low 66 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 53 System graph 142 Crowd 0 Layer: Quality 132 Security 13 Software 30 Api 1 Frontend 16 Network 1 Cicd 2

Exclude dismissed / FP Exclude test files

All 5936 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`is_cpp_file`	software	healthy	`PRESUBMIT.py:25`
`is_dart_file`	software	healthy	`PRESUBMIT.py:29`
`get_old_contents`	software	healthy	`PRESUBMIT.py:33`
`files_to_check_for_format`	software	healthy	`PRESUBMIT.py:41`
`_CheckFormat`	software	healthy	`PRESUBMIT.py:56`
`load_source`	software	healthy	`PRESUBMIT.py:93`
`_CheckDartFormat`	software	healthy	`PRESUBMIT.py:106`
`HasFormatErrors`	software	dead	`PRESUBMIT.py:211`
`skip_file`	software	healthy	`PRESUBMIT.py:126`
`_CheckStatusFiles`	software	healthy	`PRESUBMIT.py:192`
`_CheckValidHostsInDEPS`	software	healthy	`PRESUBMIT.py:245`
`_CheckLayering`	software	healthy	`PRESUBMIT.py:262`
`_CheckClangTidy`	software	healthy	`PRESUBMIT.py:294`
`_CheckClangFormat`	software	healthy	`PRESUBMIT.py:326`
`_CheckAnalyzerFiles`	software	healthy	`PRESUBMIT.py:378`
`_CheckTestMatrixValid`	software	healthy	`PRESUBMIT.py:418`
`test_matrix_filter`	software	dead	`PRESUBMIT.py:421`
`_CheckCopyrightYear`	software	healthy	`PRESUBMIT.py:448`
`_CheckDevCompilerSync`	software	healthy	`PRESUBMIT.py:472`
`_CheckDartApiWinCSync`	software	healthy	`PRESUBMIT.py:495`
`_CommonChecks`	software	healthy	`PRESUBMIT.py:524`
`CheckChangeOnCommit`	software	dead	`PRESUBMIT.py:542`
`CheckChangeOnUpload`	software	dead	`PRESUBMIT.py:546`
`runRichards`	software	healthy	`benchmarks/Richards/javascript/Richards.js:runRichards`
`Scheduler`	software	healthy	`benchmarks/Richards/javascript/Richards.js:Scheduler`
`TaskControlBlock`	software	healthy	`benchmarks/Richards/javascript/Richards.js:TaskControlBlock`
`IdleTask`	software	healthy	`benchmarks/Richards/javascript/Richards.js:IdleTask`
`DeviceTask`	software	healthy	`benchmarks/Richards/javascript/Richards.js:DeviceTask`
`WorkerTask`	software	healthy	`benchmarks/Richards/javascript/Richards.js:WorkerTask`
`HandlerTask`	software	healthy	`benchmarks/Richards/javascript/Richards.js:HandlerTask`
`Packet`	software	healthy	`benchmarks/Richards/javascript/Richards.js:Packet`
`runInt8ToInt8`	software	healthy	`benchmarks/TypedDataCopy/javascript/TypedDataCopy.js:runInt…`
`setup`	software	healthy	`benchmarks/TypedDataCopy/javascript/TypedDataCopy.js:setup`
`run`	software	healthy	`benchmarks/TypedDataCopy/javascript/TypedDataCopy.js:run`
`runInt8ToUint8Clamped`	software	healthy	`benchmarks/TypedDataCopy/javascript/TypedDataCopy.js:runInt…`
`runByteSwap`	software	healthy	`benchmarks/TypedDataCopy/javascript/TypedDataCopy.js:runByt…`
`check`	software	healthy	`benchmarks/TypedDataCopy/javascript/TypedDataCopy.js:check`
`CheckBannedFunctions`	software	healthy	`runtime/PRESUBMIT.py:25`
`RunLint`	software	healthy	`runtime/PRESUBMIT.py:48`
`CheckGn`	software	healthy	`runtime/PRESUBMIT.py:76`
`CheckFormatted`	software	healthy	`runtime/PRESUBMIT.py:80`
`convert_warning_to_error`	software	healthy	`runtime/PRESUBMIT.py:82`
`CheckChangeOnUpload`	software	dead	`runtime/PRESUBMIT.py:96`
`CheckChangeOnCommit`	software	dead	`runtime/PRESUBMIT.py:101`
`__init__`	software	healthy	`runtime/tools/compiler_layering_check.py:34`
`Check`	software	healthy	`runtime/tools/compiler_layering_check.py:44`
`CheckNotInRuntime`	software	healthy	`runtime/tools/compiler_layering_check.py:51`
`BuildIncludesGraph`	software	healthy	`runtime/tools/compiler_layering_check.py:63`
`PropagateLayers`	software	healthy	`runtime/tools/compiler_layering_check.py:75`
`AddAllSourcesToWorklist`	software	healthy	`runtime/tools/compiler_layering_check.py:97`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`pubspec.yaml`	software	healthy	`pubspec.yaml`
`README.md`	software	healthy	`README.md`
`CONTRIBUTING.md`	software	healthy	`CONTRIBUTING.md`
`PRESUBMIT.py`	software	healthy	`PRESUBMIT.py`
`sdk_packages.yaml`	software	healthy	`sdk_packages.yaml`
`SECURITY.md`	software	healthy	`SECURITY.md`
`CHANGELOG.md`	software	healthy	`CHANGELOG.md`
`README.md`	software	healthy	`tests/README.md`
`README.md`	software	healthy	`tests/language/subtyping_static/README.md`
`README.md`	software	healthy	`tests/language/mixin_legacy/README.md`
`README.md`	software	healthy	`tests/language/instantiate_to_bound/README.md`
`README.md`	software	healthy	`tests/language/void/README.md`
`regress_54516_test.sh`	software	healthy	`tests/standalone/io/regress_54516_test.sh`
`dart_std_io_pipe_test.sh`	software	healthy	`tests/standalone/io/dart_std_io_pipe_test.sh`
`create_sample_certificates.sh`	software	healthy	`tests/standalone/io/create_sample_certificates.sh`
`pubspec.yaml`	software	healthy	`tests/ffi/pubspec.yaml`
`analysis_options.yaml`	software	healthy	`tests/ffi/analysis_options.yaml`
`js_dispatch_property_test.html`	software	healthy	`tests/lib/html/js_dispatch_property_test.html`
`cross_domain_iframe_script.html`	software	healthy	`tests/lib/html/cross_domain_iframe_script.html`
`js_dispatch_property_test_js.js`	software	warning	`tests/lib/html/js_dispatch_property_test_js.js`
`dispatch_parent_event.js`	software	warning	`tests/lib/html/dispatch_parent_event.js`
`cross_domain_iframe_script.js`	software	warning	`tests/lib/html/cross_domain_iframe_script.js`
`README.md`	software	healthy	`tests/lib/fix_data_tests/README.md`
`analysis_options.yaml`	software	healthy	`tests/lib/fix_data_tests/analysis_options.yaml`
`modules.yaml`	software	healthy	`tests/modular/constants_2018/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/nested_constants/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/const_extension_type/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/constant_with_mixin/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/issue56498/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/mixin_super/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/diamond/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/private_class_exposed_by_typedef/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/impact_data/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/cross_module_constant_with_mixin/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/unused_library_and_module/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/int_js_number/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/export_and_mock/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/issue226161959/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/private_symbols/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/issue37794/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/extension_methods/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/subclass/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/js_interop_object_literal_constructor_with_ex…`
`modules.yaml`	software	healthy	`tests/modular/js_interop/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/package_imports/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/static_interop_erasure/modules.yaml`
`modules.yaml`	software	healthy	`tests/modular/issue38703/modules.yaml`
`config.json`	software	healthy	`tests/hot_reload/call_instance_setter_type_change_ddc/confi…`
`config.json`	software	healthy	`tests/hot_reload/hot_restart_late/config.json`
`config.json`	software	healthy	`tests/hot_reload/call_instance_method_return_change_ddc/con…`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`tests`	software	healthy	`tests`
`language`	software	healthy	`tests/language`
`subtyping_static`	software	healthy	`tests/language/subtyping_static`
`mixin_legacy`	software	healthy	`tests/language/mixin_legacy`
`instantiate_to_bound`	software	healthy	`tests/language/instantiate_to_bound`
`void`	software	healthy	`tests/language/void`
`standalone`	software	healthy	`tests/standalone`
`io`	software	healthy	`tests/standalone/io`
`ffi`	software	healthy	`tests/ffi`
`lib`	software	healthy	`tests/lib`
`html`	software	healthy	`tests/lib/html`
`fix_data_tests`	software	healthy	`tests/lib/fix_data_tests`
`modular`	software	healthy	`tests/modular`
`constants_2018`	software	healthy	`tests/modular/constants_2018`
`nested_constants`	software	healthy	`tests/modular/nested_constants`
`const_extension_type`	software	healthy	`tests/modular/const_extension_type`
`constant_with_mixin`	software	healthy	`tests/modular/constant_with_mixin`
`issue56498`	software	healthy	`tests/modular/issue56498`
`mixin_super`	software	healthy	`tests/modular/mixin_super`
`diamond`	software	healthy	`tests/modular/diamond`
`private_class_exposed_by_typedef`	software	healthy	`tests/modular/private_class_exposed_by_typedef`
`impact_data`	software	healthy	`tests/modular/impact_data`
`cross_module_constant_with_mixin`	software	healthy	`tests/modular/cross_module_constant_with_mixin`
`unused_library_and_module`	software	healthy	`tests/modular/unused_library_and_module`
`int_js_number`	software	healthy	`tests/modular/int_js_number`
`export_and_mock`	software	healthy	`tests/modular/export_and_mock`
`issue226161959`	software	healthy	`tests/modular/issue226161959`
`private_symbols`	software	healthy	`tests/modular/private_symbols`
`issue37794`	software	healthy	`tests/modular/issue37794`
`extension_methods`	software	healthy	`tests/modular/extension_methods`
`subclass`	software	healthy	`tests/modular/subclass`
`js_interop_object_literal_constructor_with_extension_types`	software	healthy	`tests/modular/js_interop_object_literal_constructor_with_ex…`
`js_interop`	software	healthy	`tests/modular/js_interop`
`package_imports`	software	healthy	`tests/modular/package_imports`
`static_interop_erasure`	software	healthy	`tests/modular/static_interop_erasure`
`issue38703`	software	healthy	`tests/modular/issue38703`
`hot_reload`	software	healthy	`tests/hot_reload`
`call_instance_setter_type_change_ddc`	software	healthy	`tests/hot_reload/call_instance_setter_type_change_ddc`
`hot_restart_late`	software	healthy	`tests/hot_reload/hot_restart_late`
`call_instance_method_return_change_ddc`	software	healthy	`tests/hot_reload/call_instance_method_return_change_ddc`
`hot_restart_js_interop_promise_reject`	software	healthy	`tests/hot_reload/hot_restart_js_interop_promise_reject`
`call_deleted_instance_method_ddc`	software	healthy	`tests/hot_reload/call_deleted_instance_method_ddc`
`const_to_non_const_class_empty`	software	healthy	`tests/hot_reload/const_to_non_const_class_empty`
`library_import_removed`	software	healthy	`tests/hot_reload/library_import_removed`
`call_deleted_instance_setter_vm`	software	healthy	`tests/hot_reload/call_deleted_instance_setter_vm`
`async_call_deleted_top_level_function_ddc`	software	healthy	`tests/hot_reload/async_call_deleted_top_level_function_ddc`
`call_deleted_instance_method_vm`	software	healthy	`tests/hot_reload/call_deleted_instance_method_vm`
`run_new_field_initializers_syntax_error2`	software	healthy	`tests/hot_reload/run_new_field_initializers_syntax_error2`
`not_enum_to_enum`	software	healthy	`tests/hot_reload/not_enum_to_enum`
`library_import_added`	software	healthy	`tests/hot_reload/library_import_added`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`LayeringChecker`	software	healthy	`runtime/tools/compiler_layering_check.py:32`
`Symbol`	software	healthy	`runtime/tools/dart_profiler_symbols.py:32`
`Error`	software	healthy	`runtime/tools/utils.py:275`
`or`	software	healthy	`runtime/tools/graphexplorer/graphexplorer.js:or`
`MaskGen`	software	healthy	`runtime/tools/dartfuzz/minimize.py:22`
`Library`	software	healthy	`tools/copy_dart.py:20`
`GNException`	software	healthy	`tools/gn_helpers.py:8`
`Enum`	software	healthy	`tools/minidump.py:13`
`Descriptor`	software	healthy	`tools/minidump.py:29`
`Raw`	software	healthy	`tools/minidump.py:52`
`MinidumpFile`	software	healthy	`tools/minidump.py:140`
`Version`	software	healthy	`tools/utils.py:142`
`Error`	software	healthy	`tools/utils.py:485`
`TempDir`	software	healthy	`tools/utils.py:532`
`UnexpectedCrash`	software	healthy	`tools/utils.py:546`
`PosixCoreDumpEnabler`	software	healthy	`tools/utils.py:558`
`LinuxCoreDumpEnabler`	software	healthy	`tools/utils.py:572`
`WindowsCoreDumpEnabler`	software	healthy	`tools/utils.py:584`
`BaseCoreDumpArchiver`	software	healthy	`tools/utils.py:613`
`PosixCoreDumpArchiver`	software	healthy	`tools/utils.py:816`
`LinuxCoreDumpArchiver`	software	healthy	`tools/utils.py:836`
`MacOSCoreDumpArchiver`	software	healthy	`tools/utils.py:843`
`WindowsCoreDumpArchiver`	software	healthy	`tools/utils.py:849`
`IncreasedNumberOfFileDescriptors`	software	healthy	`tools/utils.py:957`
`GSUtil`	software	healthy	`tools/bots/bot_utils.py:56`
`TemplateLoader`	software	healthy	`tools/dom/scripts/templateloader.py:20`
`GeneratorOptions`	software	healthy	`tools/dom/scripts/dartdomgenerator.py:73`
`HtmlRenamer`	software	healthy	`tools/dom/scripts/htmlrenamer.py:1099`
`Prototype_HtmlEventGenerator`	software	healthy	`tools/dom/scripts/prototype_htmleventgenerator.py:34`
`DartGenerator`	software	healthy	`tools/dom/scripts/dartgenerator.py:28`
`Database`	software	healthy	`tools/dom/scripts/database.py:20`
`HtmlEventGenerator`	software	healthy	`tools/dom/scripts/htmleventgenerator.py:277`
`DatabaseTestCase`	software	healthy	`tools/dom/scripts/database_test.py:17`
`DartGeneratorTestCase`	software	healthy	`tools/dom/scripts/dartgenerator_test.py:19`
`MultiEmitter`	software	healthy	`tools/dom/scripts/multiemitter.py:17`
`Emitter`	software	healthy	`tools/dom/scripts/emitter.py:20`
`Lookup`	software	healthy	`tools/dom/scripts/emitter.py:239`
`DeferredLookup`	software	healthy	`tools/dom/scripts/emitter.py:249`
`Template`	software	healthy	`tools/dom/scripts/emitter.py:259`
`Frame`	software	healthy	`tools/dom/scripts/emitter.py:266`
`IDLNode`	software	healthy	`tools/dom/scripts/idlnode.py:59`
`IDLDictNode`	software	healthy	`tools/dom/scripts/idlnode.py:349`
`IDLFile`	software	healthy	`tools/dom/scripts/idlnode.py:413`
`IDLModule`	software	healthy	`tools/dom/scripts/idlnode.py:535`
`IDLExtAttrs`	software	healthy	`tools/dom/scripts/idlnode.py:566`
`IDLExtAttrFunctionValue`	software	healthy	`tools/dom/scripts/idlnode.py:638`
`IDLType`	software	healthy	`tools/dom/scripts/idlnode.py:654`
`IDLEnum`	software	healthy	`tools/dom/scripts/idlnode.py:763`
`IDLCallbackFunction`	software	healthy	`tools/dom/scripts/idlnode.py:778`
`IDLTypeDef`	software	healthy	`tools/dom/scripts/idlnode.py:787`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`extract-deps`	cicd	healthy	`.github/workflows/third-party-deps-scan.yml`
`vuln-scan`	cicd	healthy	`.github/workflows/third-party-deps-scan.yml`
`analysis`	cicd	healthy	`.github/workflows/scorecards-analysis.yml`
`no-response`	cicd	healthy	`.github/workflows/no-response.yml`

Label	Layer	Status	Path
`gha::third-party-deps-scan`	cicd	healthy	`.github/workflows/third-party-deps-scan.yml`
`gha::scorecards-analysis`	cicd	healthy	`.github/workflows/scorecards-analysis.yml`
`gha::no-response`	cicd	healthy	`.github/workflows/no-response.yml`

Label	Layer	Status	Path
`repobility-clone-j51bmq_o`	software	healthy	`/tmp/repobility-clone-j51bmq_o`

Label	Layer	Status	Path
`127.0.0.1`	network	healthy	`tools/dom/docs.json`

Label	Layer	Status	Path
`port:42`	network	healthy	`pkg/front_end/messages.yaml`

Label	Layer	Status	Path
`gpu (detected)`	hardware	healthy	`benchmarks/IsolateJson/dart/sample.json`

Label	Layer	Status	Path
`vps::azure`	hardware	healthy	`third_party/d3/src/d3.js`

Label	Layer	Status	Path
`auth::.github/workflows/scorecards-analysis.yml`	security	healthy	`.github/workflows/scorecards-analysis.yml`

Label	Layer	Status	Path
`SCORECARD_READ_TOKEN`	cicd	healthy	`—`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/f5b96adb-5804-45f3-aac0-143eaa16ddce/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/f5b96adb-5804-45f3-aac0-143eaa16ddce/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

dart-lang/sdk

Complete repo analysis

function 50+

file 50+

directory 50+

class 50+

job 4

pipeline 3

repo 1

service 1

port 1

gpu 1

vps 1

auth 1

env_var 1