Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

kunchenguid/no-mistakes

https://github.com/kunchenguid/no-mistakes · scanned 2026-07-23 19:45 UTC (4 days, 16 hours ago)

80 raw signals (0 security + 80 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 16 hours ago · v8 · 80 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

90.0% cov · 80 findings

Severity distribution — click a segment to filter

Active filters: layer: dependencies × excluding tests × Reset all

Severity: Critical 0 High 14 Medium 45 Low 17 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 80 Crowd 0 Layer: Security 40 Quality 8 Frontend 1 Cicd 3 Dependencies 28

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 70.4/100 with 90.0% coverage. It contains 661 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 80 findings — concentrated in security (40), dependencies (28), quality (8). Risk profile is high: 0 critical, 14 high, 45 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 28 of 80 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299). Astro: Host header SSRF in prerendered error page fetch Aliases: CVE-2026-54299 Advisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7 Fix: upgrade `ast…

docs/package.json ScaOsvGhsa 2pvr wf23 7pc7

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146). Astro: Reflected XSS via unescaped slot name Aliases: CVE-2026-50146 Advisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp Fix: upgrade `astro` past th…

docs/package.json ScaOsvGhsa 8hv8 536x 4wqp

high System graph dependencies dependencies conf 0.90 Vulnerable dependency devalue 5.7.1: GHSA-77vg-94rm-hx3p

OSV.dev reports `devalue` at version `5.7.1` (resolved in `docs/package-lock.json`) is affected by GHSA-77vg-94rm-hx3p (aka CVE-2026-42570). Note: `devalue` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Svelte devalue: DoS via sparse array deserial…

docs/package-lock.json ScaOsvGhsa 77vg 94rm hx3p

high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m

OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `docs/package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. js-yaml: YAML merge-key chains can force quad…

docs/package-lock.json ScaOsvGhsa 52cp r559 cp3m

high System graph dependencies dependencies conf 1.00 Vulnerable dependency sharp 0.33.5: GHSA-f88m-g3jw-g9cj

OSV.dev reports `sharp` at version `0.33.5` (resolved in `docs/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 Advisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj Fix: upgrad…

docs/package.json ScaOsvGhsa f88m g3jw g9cj

high System graph dependencies dependencies conf 0.90 Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj

OSV.dev reports `sharp` at version `0.34.5` (resolved in `docs/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. Note: `sharp` is an optional dependency — installs may legitimately omit it. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-3…

docs/package-lock.json ScaOsvGhsa f88m g3jw g9cj

medium System graph dependencies dependencies conf 0.90 Dependency astro is two or more major versions behind

`astro` is pinned at `5.18.1` in `docs/package.json` while the latest release on the npm registry is `7.1.3` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`.

docs/package.json FreshnessOutdated

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-4g3v-8h47-v7g6. Astro: Reflected XSS via unescaped View Transition animation properties Advisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6 Fix: upgrade `astro` past the affected range p…

docs/package.json ScaOsvGhsa 4g3v 8h47 v7g6

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729). Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) Aliases: CVE-2026-59729 Advisory: https://osv.dev/vu…

docs/package.json ScaOsvGhsa f48w 9m4c m7f5

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-j687-52p2-xcff (aka CVE-2026-41067). Astro: XSS in define:vars via incomplete </script> tag sanitization Aliases: CVE-2026-41067 Advisory: https://osv.dev/vulnerability/GHSA-j687-52p2-xcff Fix: …

docs/package.json ScaOsvGhsa j687 52p2 xcff

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-jrpj-wcv7-9fh9 (aka CVE-2026-54298). Astro: XSS via Unescaped Attribute Names in Spread Props Aliases: CVE-2026-54298 Advisory: https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9 Fix: upgrade `as…

docs/package.json ScaOsvGhsa jrpj wcv7 9fh9

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-xr5h-phrj-8vxv (aka CVE-2026-45028). Astro: Server island encrypted parameters vulnerable to cross-component replay Aliases: CVE-2026-45028 Advisory: https://osv.dev/vulnerability/GHSA-xr5h-phrj…

docs/package.json ScaOsvGhsa xr5h phrj 8vxv

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-76mc-f452-cxcm

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-76mc-f452-cxcm (aka CVE-2026-65902). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Hook mutation of `data.allowed…

docs/package-lock.json ScaOsvGhsa 76mc f452 cxcm

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-cmwh-pvxp-8882

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-cmwh-pvxp-8882 (aka CVE-2026-65898). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Permanent `ALLOWED_ATTR` pollu…

docs/package-lock.json ScaOsvGhsa cmwh pvxp 8882

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-hpcv-96wg-7vj8

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-hpcv-96wg-7vj8 (aka CVE-2026-49458). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Cross-realm IN_PLACE sanitizat…

docs/package-lock.json ScaOsvGhsa hpcv 96wg 7vj8

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-r47g-fvhr-h676

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-r47g-fvhr-h676 (aka CVE-2026-49459). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: IN_PLACE mode preserves attrib…

docs/package-lock.json ScaOsvGhsa r47g fvhr h676

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-rp9w-3fw7-7cwq

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-rp9w-3fw7-7cwq (aka CVE-2026-49978). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify IN_PLACE Sanitization Bypass vi…

docs/package-lock.json ScaOsvGhsa rp9w 3fw7 7cwq

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68

OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `docs/package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. JS-YAML: Quadratic-complexity DoS in merge ke…

docs/package-lock.json ScaOsvGhsa h67p 54hq rp68

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-6m6c-36f7-fhxh

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-6m6c-36f7-fhxh (aka CVE-2026-41150). Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Aliases: CVE-2026-41150 Advisory: https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh Fix: upgra…

docs/package.json ScaOsvGhsa 6m6c 36f7 fhxh

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-87f9-hvmw-gh4p

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-87f9-hvmw-gh4p (aka CVE-2026-41159). Mermaid: Improper sanitization of configuration leads to CSS injection Aliases: CVE-2026-41159 Advisory: https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p…

docs/package.json ScaOsvGhsa 87f9 hvmw gh4p

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-ghcm-xqfw-q4vr

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-ghcm-xqfw-q4vr (aka CVE-2026-41149). Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection Aliases: CVE-2026-41149 Advisory: https://osv.dev/vulnerability/GHS…

docs/package.json ScaOsvGhsa ghcm xqfw q4vr

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-xcj9-5m2h-648r

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-xcj9-5m2h-648r (aka CVE-2026-41148). Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection Aliases: CVE-2026-41148 Advisory: https://osv.dev/vulnerability/GHSA-xcj9…

docs/package.json ScaOsvGhsa xcj9 5m2h 648r

low System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727). Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands Aliases: CVE-2026-59727 Advisory: https://osv.dev/vulnerability/G…

docs/package.json ScaOsvGhsa 7pw4 f3q4 r2p2

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-c2j3-45gr-mqc4

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-c2j3-45gr-mqc4. Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeEl…

docs/package-lock.json ScaOsvGhsa c2j3 45gr mqc4

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-gvmj-g25r-r7wr

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-gvmj-g25r-r7wr (aka CVE-2026-65900). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: SAFE_FOR_TEMPLATES bypass - te…

docs/package-lock.json ScaOsvGhsa gvmj g25r r7wr

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-vxr8-fq34-vvx9

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-vxr8-fq34-vvx9 (aka CVE-2026-65899). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Trusted Types policy survives …

docs/package-lock.json ScaOsvGhsa vxr8 fq34 vvx9

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-x4vx-rjvf-j5p4

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-x4vx-rjvf-j5p4 (aka CVE-2026-65901). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: `IN_PLACE` mode trusts attacke…

docs/package-lock.json ScaOsvGhsa x4vx rjvf j5p4

low System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr

OSV.dev reports `esbuild` at version `0.27.7` (resolved in `docs/package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr. Note: `esbuild` is a transitive dependency — pulled in by another package, not declared directly in a manifest. esbuild allows arbitrary file read when running the development s…

docs/package-lock.json ScaOsvGhsa g7r4 m6w7 qqqr

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/fd237a75-1287-4ab9-a934-013d916e3f44/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/fd237a75-1287-4ab9-a934-013d916e3f44/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.