Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

dottxt-ai/outlines

https://github.com/dottxt-ai/outlines · scanned 2026-07-23 10:40 UTC (1 month, 2 weeks ago)

305 raw signals (0 security + 305 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v5 · last Δ +16.1 (diff) · 305 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

70.0% cov · 305 findings

Severity distribution — click a segment to filter

Active filters: severity: critical × excluding tests × Reset all

Severity: Critical 4 High 50 Medium 215 Low 34 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 305 Crowd 0 Layer: Software 7 Security 102 Cicd 2 Quality 10 Dependencies 184

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 80.3/100 with 70.0% coverage. It contains 2062 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 305 findings — concentrated in dependencies (184), security (102), quality (10). Risk profile is high: 4 critical, 50 high, 215 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 4 of 305 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph dependencies dependencies conf 1.00 Vulnerable dependency transformers 4.38.2: GHSA-fgcw-684q-jj6r

OSV.dev reports `transformers` at version `4.38.2` (declared in `examples/bentoml/requirements.txt`) is affected by GHSA-fgcw-684q-jj6r (aka CVE-2026-5241). huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path Aliases: CVE-2026-5241, G…

examples/bentoml/requirements.txt ScaOsvGhsa fgcw 684q jj6r

critical System graph dependencies dependencies conf 1.00 Vulnerable dependency transformers 4.57.1: GHSA-fgcw-684q-jj6r

OSV.dev reports `transformers` at version `4.57.1` (resolved in `uv.lock`) is affected by GHSA-fgcw-684q-jj6r (aka CVE-2026-5241). huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path Aliases: CVE-2026-5241, GHSA-fgcw-684q-jj6r, PYSEC-…

uv.lock ScaOsvGhsa fgcw 684q jj6r

critical System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.5.0: GHSA-2xpw-w6gg-jr37

OSV.dev reports `urllib3` at version `2.5.0` (resolved in `uv.lock`) is affected by GHSA-2xpw-w6gg-jr37 (aka CVE-2025-66471). Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. urllib3 streaming API improperly handles highly compressed d…

uv.lock ScaOsvGhsa 2xpw w6gg jr37

critical System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.5.0: GHSA-38jv-5279-wg99

OSV.dev reports `urllib3` at version `2.5.0` (resolved in `uv.lock`) is affected by GHSA-38jv-5279-wg99 (aka CVE-2026-21441). Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Decompression-bomb safeguards bypassed when following HTTP r…

uv.lock ScaOsvGhsa 38jv 5279 wg99

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/f8ad4bb0-828f-4472-b03b-a63e56bb3308/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/f8ad4bb0-828f-4472-b03b-a63e56bb3308/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.