Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

zkann/smbos

https://github.com/zkann/smbos · scanned 2026-06-16 01:13 UTC (2 months, 1 week ago)

43 raw signals (0 security + 43 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 43 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
67.7
/100
Security checks
68
0 findings
System graph
68
100.0% cov · 43 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 10 Medium 7 Low 21 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 43 Crowd 0 Layer: Software 11 Security 2 Quality 15 Api 15
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 67.7/100 with 100.0% coverage. It contains 601 nodes across 5 cross-layer flows, written primarily in mixed languages. Engine surfaced 43 findings — concentrated in quality (15), api (15), software (11). Risk profile is high: 0 critical, 10 high, 7 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 38 of 43 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph api Wiring conf 1.00 Dangling fetch: GET /api/ping (assets/app.js:704)
`assets/app.js:704` calls `GET /api/ping` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/ping` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/apply-item (assets/app.js:205)
`assets/app.js:205` calls `POST /api/apply-item` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/apply-item` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/clear-run (assets/app.js:264)
`assets/app.js:264` calls `POST /api/clear-run` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/clear-run` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/launch (assets/app.js:518)
`assets/app.js:518` calls `POST /api/launch` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/launch` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/launch-permission (assets/app.js:657)
`assets/app.js:657` calls `POST /api/launch-permission` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/launch-permission` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/queue (assets/app.js:535)
`assets/app.js:535` calls `POST /api/queue` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/queue` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/resolve (assets/app.js:185)
`assets/app.js:185` calls `POST /api/resolve` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/resolve` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/run (assets/app.js:439)
`assets/app.js:439` calls `POST /api/run` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/run` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/settings (assets/app.js:614)
`assets/app.js:614` calls `POST /api/settings` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/settings` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/suggest (assets/app.js:568)
`assets/app.js:568` calls `POST /api/suggest` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/suggest` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — assets/app.js:185
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in assets/app.js:121
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
assets/app.js:121 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in mockups/the-brief.html:317
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
mockups/the-brief.html:317 Direct innerhtml assignment
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/canary_prepare.py:132
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/serve_dashboard.py:177
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/sop_triggers.py:221
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 64 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: scripts/serve_dashboard.py:launch_permission, scripts/serve_dashboard.py:launch This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_run_marker_stalled_when_too_old` in tests/test_lib.py:115
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: do_GET
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/serve_dashboard.py:769
low System graph software Dead code conf 1.00 Possibly dead Python function: do_POST
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/serve_dashboard.py:799
low System graph software Dead code conf 1.00 Possibly dead Python function: log_message
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/serve_dashboard.py:758
low System graph software Dead code conf 1.00 Possibly dead Python function: m
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/serve_dashboard.py:436
low System graph software Dead code conf 1.00 Possibly dead Python function: t_automation_costs
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:183
low System graph software Dead code conf 1.00 Possibly dead Python function: t_create_draft_sop
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:118
low System graph software Dead code conf 1.00 Possibly dead Python function: t_list_sops
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:79
low System graph software Dead code conf 1.00 Possibly dead Python function: t_pending_runs
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:144
low System graph software Dead code conf 1.00 Possibly dead Python function: t_read_sop
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:92
low System graph software Dead code conf 1.00 Possibly dead Python function: t_resolve_pending
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:162
low System graph software Dead code conf 1.00 Possibly dead Python function: t_suggest_change
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
scripts/mcp_server.py:97
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph quality Integrity conf 1.00 Stub function `log_message` (body is just `pass`/`return`) — scripts/serve_dashboard.py:758
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`scripts/dashboard_app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/plate
`scripts/dashboard_app.py` declares `GET /api/plate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /api/runs
`scripts/dashboard_app.py` declares `GET /api/runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /assets/{path:path}
`scripts/dashboard_app.py` declares `GET /assets/{path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /events
`scripts/dashboard_app.py` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/fd7a7853-2e89-48e6-bb1a-d98dbb5e1fd0/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/fd7a7853-2e89-48e6-bb1a-d98dbb5e1fd0/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.