critical Security checks security secrets conf 0.95 5 occurrences Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Gitleaks detected a committed secret or credential pattern.

5 files, 5 locations

docs/_archive/LOVABLE_PROMPT.md:542

public/docs/API.md:46

public/docs/merchant-onboarding.html:129

public/docs/testing-guide.html:112

src/services/consolidationService.ts:24

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /:invoiceId.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /:invoiceId.

src/routes/invoices.ts:288

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:invoiceId.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:invoiceId.

src/routes/invoices.ts:321

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:invoiceId/pdf.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:invoiceId/pdf.

src/routes/invoices.ts:129

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:receiptId.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:receiptId.

src/routes/receipts.ts:256

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /by-order/:orderId.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /by-order/:orderId.

src/routes/receipts.ts:16

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:invoiceId/cancel.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:invoiceId/cancel.

src/routes/invoices.ts:213

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:invoiceId/order.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:invoiceId/order.

src/routes/invoices.ts:440

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:invoiceId/send.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:invoiceId/send.

src/routes/invoices.ts:157

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:receiptId/resend.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:receiptId/resend.

src/routes/receipts.ts:209

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: PUT /:invoiceId.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: PUT /:invoiceId.

src/routes/invoices.ts:250

high Security checks software dependencies conf 0.88 axios: GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-777c-7fjr-54vf

Allocation of Resources Without Limits or Throttling in Axios

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-pf86-5x62-jrwf

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-pjwm-pj3p-43mv

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

package-lock.json

high Security checks software dependencies conf 0.88 axios: GHSA-q8qp-cvcw-x6jj

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

package-lock.json

high Security checks software dependencies conf 0.88 bigint-buffer: GHSA-3gc7-fjrx-p6mg

bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function

package-lock.json

high Security checks software dependencies conf 0.88 esbuild: GHSA-gv7w-rqvm-qjhr

esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

package-lock.json

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /:invoiceId has no auth

Express route DELETE /:invoiceId declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/invoices.ts:288

high Security checks quality Quality conf 0.80 ✓ Repobility Express DELETE /api/v1/orders/:orderId has no auth

Express route DELETE /api/v1/orders/:orderId declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/index.ts:234

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST / has no auth

Express route POST / declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/invoices.ts:91

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /:invoiceId/cancel has no auth

Express route POST /:invoiceId/cancel declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/invoices.ts:213

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /:invoiceId/send has no auth

Express route POST /:invoiceId/send declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/invoices.ts:157

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /:receiptId/resend has no auth

Express route POST /:receiptId/resend declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/receipts.ts:209

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/v1/orders has no auth

Express route POST /api/v1/orders declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/index.ts:231

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/v1/orders/:orderId/cancel has no auth

Express route POST /api/v1/orders/:orderId/cancel declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/index.ts:236

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /api/v1/orders/:orderId/confirm has no auth

Express route POST /api/v1/orders/:orderId/confirm declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/index.ts:235

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /for-order/:orderId/email has no auth

Express route POST /for-order/:orderId/email declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/receipts.ts:113

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /forgot-password has no auth

Express route POST /forgot-password declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:509

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /login has no auth

Express route POST /login declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:23

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /merchant-wallets has no auth

Express route POST /merchant-wallets declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:176

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /resend-verification has no auth

Express route POST /resend-verification declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:470

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /reset-password has no auth

Express route POST /reset-password declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:541

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /secret has no auth

Express route POST /secret declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/webhooks.ts:100

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /test has no auth

Express route POST /test declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/webhooks.ts:250

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /v1/signup has no auth

Express route POST /v1/signup declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:273

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /v1/signup-test has no auth

Express route POST /v1/signup-test declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:240

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /v1/signup-test-DISABLED has no auth

Express route POST /v1/signup-test-DISABLED declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:243

high Security checks quality Quality conf 0.80 ✓ Repobility Express POST /verify-email has no auth

Express route POST /verify-email declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:370

high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT / has no auth

Express route PUT / declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/webhooks.ts:65

high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /:invoiceId has no auth

Express route PUT /:invoiceId declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/invoices.ts:250

high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /api/v1/orders has no auth

Express route PUT /api/v1/orders declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/index.ts:233

high Security checks quality Quality conf 0.80 ✓ Repobility Express PUT /merchant-profile has no auth

Express route PUT /merchant-profile declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

src/routes/auth.ts:140

high Security checks software dependencies conf 0.88 express-rate-limit: GHSA-46wh-pxpv-q5gq

express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

package-lock.json

high Security checks software dependencies conf 0.88 form-data: GHSA-hmw2-7cc7-3qxx

form-data: CRLF injection in form-data via unescaped multipart field names and filenames

package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

package-lock.json

high Security checks software dependencies conf 0.88 minimatch: GHSA-7r86-cg39-jmmj

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

package-lock.json

high Security checks software dependencies conf 0.88 path-to-regexp: GHSA-37ch-88jc-xwx2

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

package-lock.json

high Security checks software dependencies conf 0.88 path-to-regexp: GHSA-9wv6-86v2-598j

path-to-regexp outputs backtracking regular expressions

package-lock.json

high Security checks software dependencies conf 0.88 picomatch: GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

package-lock.json

high Security checks software dependencies conf 0.88 tar: GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

package-lock.json

high Security checks software dependencies conf 0.88 tar: GHSA-83g3-92jg-28cx

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

package-lock.json

high Security checks software dependencies conf 0.88 tar: GHSA-8qq5-rm4j-mr97

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

package-lock.json

high Security checks software dependencies conf 0.88 tar: GHSA-9ppj-qmqm-q256

node-tar Symlink Path Traversal via Drive-Relative Linkpath

package-lock.json

high Security checks software dependencies conf 0.88 tar: GHSA-qffp-2rhf-9h96

tar has Hardlink Path Traversal via Drive-Relative Linkpath

package-lock.json

high Security checks software dependencies conf 0.88 tar: GHSA-r6q2-hw4h-h46w

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

package-lock.json

high Security checks software dependencies conf 0.88 undici: GHSA-v9p9-hfj2-hcw8

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

package-lock.json

high Security checks software dependencies conf 0.88 undici: GHSA-vrm6-8vpv-qv8q

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-fx2h-pf6j-xcff

vite: `server.fs.deny` bypass on Windows alternate paths

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-p9ff-h696-f583

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

package-lock.json

high Security checks software dependencies conf 0.88 vite: GHSA-v2wj-q39q-566r

Vite: `server.fs.deny` bypassed with queries

package-lock.json

high Security checks software dependencies conf 0.88 ws: GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

package-lock.json

medium Security checks software dependencies conf 0.88 @opentelemetry/core: GHSA-8988-4f7v-96qf

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

package-lock.json

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 45.6% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

Only 45.6% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: DELETE /.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: DELETE /.

src/routes/admin.ts:630

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /.

src/routes/admin.ts:93

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /managed-wallets.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /managed-wallets.

src/routes/treasury.ts:259

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /platform-wallets.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /platform-wallets.

src/routes/admin.ts:678

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /.

src/routes/admin.ts:247

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /check-overdue.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /check-overdue.

src/routes/fees.ts:282

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /managed.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /managed.

src/routes/refunds.ts:114

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /suspend.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /suspend.

src/routes/fees.ts:363

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /wallets.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /wallets.

src/routes/admin.ts:440

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /.

src/routes/admin.ts:520

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /:invoiceId.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /:invoiceId.

src/routes/invoices.ts:288

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /api/v1/orders/:orderId.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /api/v1/orders/:orderId.

src/index.ts:234

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /:invoiceId.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /:invoiceId.

src/routes/invoices.ts:321

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/v1/chains.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/v1/chains.

src/index.ts:237

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/v1/orders.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /api/v1/orders.

src/index.ts:232

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /:invoiceId/order.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /:invoiceId/order.

src/routes/invoices.ts:440

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/v1/orders.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/v1/orders.

src/index.ts:231

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/v1/orders/:orderId/cancel.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/v1/orders/:orderId/cancel.

src/index.ts:236

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/v1/orders/:orderId/confirm.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /api/v1/orders/:orderId/confirm.

src/index.ts:235

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /api/v1/orders.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /api/v1/orders.

src/index.ts:233

medium Security checks software dependencies conf 0.88 ajv: GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-3w6x-2g7m-8v23

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-445q-vr5w-6q77

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-5c9x-8gcm-mpgx

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-62hf-57xw-28j9

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-898c-q2cr-xwhg

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-fvcv-3m26-pcqx

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-m7pr-hjqh-92cm

Axios: no_proxy bypass via IP alias allows SSRF

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-vf2m-468p-8v99

Axios: HTTP adapter streamed responses bypass maxContentLength

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-w9j2-pvgh-6h63

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

package-lock.json

medium Security checks software dependencies conf 0.88 axios: GHSA-xx6v-rp6x-q39c

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

package-lock.json

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-jxxr-4gwj-5jf2

brace-expansion: Large numeric range defeats documented `max` DoS protection

package-lock.json

high Security checks security auth conf 0.82 12 occurrences Browser storage is used for session token material

localStorage and sessionStorage are readable by injected JavaScript. For sensitive sessions, this turns XSS into account compromise.

lines 2533, 2669, 2694, 3114, 3145, 3284, 3309, 3337, +4 more

public/dashboard.html:2533, 2669, 2694, 3114, 3145, 3284, 3309, 3337, +4 more (12 hits)

medium Security checks software dependencies conf 0.88 esbuild: GHSA-67mh-4wv8-2f99

esbuild enables any website to send any requests to the development server and read the response

package-lock.json

medium Security checks software dependencies conf 0.88 follow-redirects: GHSA-r4q5-vmmm-2653

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

package-lock.json

high Security checks quality Quality conf 0.74 15 occurrences Frontend API reference is not matched by discovered backend routes

A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys.

lines 1115, 1117, 1179, 1181, 1864, 1902, 1903, 2001, +7 more

public/crypto-pay.html:1115, 1117, 1179, 1181, 1864, 1902, 1903, 2001, +7 more (15 hits)

medium Security checks software dependencies conf 0.88 ip-address: GHSA-v2v4-37r5-5v8g

ip-address has XSS in Address6 HTML-emitting methods

package-lock.json

high Security checks quality Quality conf 0.80 localStorage write failures are swallowed silently

localStorage quotas are small and writes can fail. Catching storage errors without a user-visible warning causes silent data loss when notes, images, or snapshots exceed quota.

public/js/lang.js:35

high Security checks software dependencies conf 0.90 npm package `@types/bcryptjs` is 1 major version(s) behind (2.4.6 -> 3.0.0)

`@types/bcryptjs` is pinned/resolved at 2.4.6 but the latest stable release on the npm registry is 3.0.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@types/bs58` is 1 major version(s) behind (4.0.4 -> 5.0.0)

`@types/bs58` is pinned/resolved at 4.0.4 but the latest stable release on the npm registry is 5.0.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@types/express` is 1 major version(s) behind (4.17.25 -> 5.0.6)

`@types/express` is pinned/resolved at 4.17.25 but the latest stable release on the npm registry is 5.0.6 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `dotenv` is 1 major version(s) behind (16.6.1 -> 17.4.2)

`dotenv` is pinned/resolved at 16.6.1 but the latest stable release on the npm registry is 17.4.2 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `express` is 1 major version(s) behind (4.22.1 -> 5.2.1)

`express` is pinned/resolved at 4.22.1 but the latest stable release on the npm registry is 5.2.1 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `helmet` is 1 major version(s) behind (7.2.0 -> 8.2.0)

`helmet` is pinned/resolved at 7.2.0 but the latest stable release on the npm registry is 8.2.0 (1 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.88 picomatch: GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

package-lock.json

medium Security checks software dependencies conf 0.88 postcss: GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

package-lock.json

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 qs: GHSA-q8mj-m7cp-5q26

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

package-lock.json

medium Security checks software dependencies conf 0.88 tar: GHSA-vmf3-w455-68vh

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

package-lock.json

medium Security checks software dependencies conf 0.88 undici: GHSA-2mjp-6q6p-2qxm

Undici has an HTTP Request/Response Smuggling issue

package-lock.json

medium Security checks software dependencies conf 0.88 undici: GHSA-4992-7rv2-5pvq

Undici has CRLF Injection in undici via `upgrade` option

package-lock.json

medium Security checks software dependencies conf 0.88 undici: GHSA-c76h-2ccp-4975

Use of Insufficiently Random Values in undici

package-lock.json

medium Security checks software dependencies conf 0.88 undici: GHSA-g9mf-h72j-4rw9

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

package-lock.json

medium Security checks software dependencies conf 0.88 uuid: GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

package-lock.json

medium Security checks software dependencies conf 0.88 vite: GHSA-4w7w-66w2-5vf9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

package-lock.json

medium Security checks software dependencies conf 0.88 vite: GHSA-v6wh-96g9-6wx3

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

package-lock.json

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

package-lock.json

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

low Security checks security auth conf 0.76 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

low Security checks software dependencies conf 0.88 axios: GHSA-xhjh-pmcv-23jw

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

package-lock.json

low Security checks software dependencies conf 0.88 diff: GHSA-73rr-hh4g-fpgx

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

package-lock.json

low Security checks software dependencies conf 0.88 esbuild: GHSA-g7r4-m6w7-qqqr

esbuild allows arbitrary file read when running the development server on Windows

package-lock.json

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 12, 13

.github/workflows/ci.yml:12, 13 (2 hits)

CI/CD securitySupply chainGitHub Actions

low Security checks quality Documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

high Security checks software dependencies conf 0.90 npm package `axios` is minor version(s) behind (1.13.2 -> 1.18.0)

`axios` is pinned/resolved at 1.13.2 but the latest stable release on the npm registry is 1.18.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `express-rate-limit` is minor version(s) behind (8.2.1 -> 8.5.2)

`express-rate-limit` is pinned/resolved at 8.2.1 but the latest stable release on the npm registry is 8.5.2 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `pdfkit` is minor version(s) behind (0.17.2 -> 0.19.1)

`pdfkit` is pinned/resolved at 0.17.2 but the latest stable release on the npm registry is 0.19.1 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `pg` is minor version(s) behind (8.16.3 -> 8.21.0)

`pg` is pinned/resolved at 8.16.3 but the latest stable release on the npm registry is 8.21.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `resend` is minor version(s) behind (6.9.2 -> 6.12.4)

`resend` is pinned/resolved at 6.9.2 but the latest stable release on the npm registry is 6.12.4 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `tsx` is minor version(s) behind (4.21.0 -> 4.22.4)

`tsx` is pinned/resolved at 4.21.0 but the latest stable release on the npm registry is 4.22.4 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

AI coding agents increasingly read llms.txt to find canonical docs and API workflows. Without it, agents are more likely to browse pages repeatedly or use stale instructions.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

humans.txt is optional, but it gives operators and reviewers a simple place to find ownership, contact, and important public documentation links.

humans.txt

low Security checks quality Quality conf 0.74 Public web app has no robots.txt

Public websites should publish a robots.txt file so crawlers and AI agents can discover crawl rules and sitemap locations without guessing.

robots.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

A sitemap gives search engines, docs crawlers, and AI agents a structured list of public pages. Without one, important docs and product pages are easy to miss.

sitemap.xml

low Security checks software dependencies conf 0.88 qs: GHSA-w7fw-mjwx-w883

qs's arrayLimit bypass in comma parsing allows denial of service

package-lock.json

low Security checks software dependencies conf 0.88 undici: GHSA-cxrh-j4jr-qwg3

undici Denial of Service attack via bad certificate data

package-lock.json

low System graph quality Production readiness conf 1.00 Composite production-readiness gap

Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.

Repo hardeningGenerated repo pattern

low System graph quality License conf 1.00 No license file detected

No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.

Repo hardeningGenerated repo pattern

high Security checks software dependencies conf 0.90 npm package `@anthropic-ai/sdk` is patch version(s) behind (0.104.1 -> 0.104.2)

`@anthropic-ai/sdk` is pinned/resolved at 0.104.1 but the latest stable release on the npm registry is 0.104.2 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `@types/pdfkit` is patch version(s) behind (0.17.4 -> 0.17.6)

`@types/pdfkit` is pinned/resolved at 0.17.4 but the latest stable release on the npm registry is 0.17.6 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

high Security checks software dependencies conf 0.90 npm package `cors` is patch version(s) behind (2.8.5 -> 2.8.6)

`cors` is pinned/resolved at 2.8.5 but the latest stable release on the npm registry is 2.8.6 (patch version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	8.4	0.25	2.10
`testing_score`	31.0	0.20	6.20
`documentation_score`	43.7	0.15	6.56
`practices_score`	75.0	0.15	11.25
`code_quality`	67.6	0.10	6.76
Overall		1.00	47.9

0xgasc/stablepay

Complete repo analysis