← Legacy view v2 (rp.*)

puneetv503-dot/smartdukan-backend

https://github.com/puneetv503-dot/smartdukan-backend.git · lang: python · LOC: · source: user_submitted

Quality

64.9

Grade C+

Security

95.5

Findings

0 critical · 2 high

Status

completed

May 26, 2026 07:22

medium: 11 high: 2 info: 2 low: 2

Top rules by occurrence

Rule	Severity	Count
`MINED124` requirements.txt entry has no version pin	medium	5
`CORE_NO_LICENSE` No LICENSE file	low	1
`MINED111` Bare except continues silently	medium	1
`AUC005` [AUC005] No authorization-focused tests detected: No test f…	low	1
`AUC012` [AUC012] FastAPI interactive docs may be exposed by framewo…	medium	1
`AUC001` [AUC001] No Repobility access matrix policy found: The repo…	medium	1
`CFG006` [CFG006] Missing .gitignore: No .gitignore file. Risk of co…	medium	1
`CORE_NO_CI` No CI/CD configuration found	medium	1
`AUC002` [AUC002] Low visible authorization coverage in route invent…	medium	1
`WEB003` Public web service has no security.txt	medium	1

First 17 findings (severity-sorted)

high MINED112 FastAPI POST/PUT/DELETE/PATCH endpoint without auth CWE-306CWE-862

main.py:29 · conf 0.80

[MINED112] FastAPI POST /scan-bill has no auth: Handler `scan_bill` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function bo…

high SEC135 Auth/permission check missing on AI-generated endpoint

main.py:28 · conf 1.00

[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…

medium AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

· conf 0.92

[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

medium AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

· conf 0.74

[AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

medium AUC012 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

· conf 0.72

[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, p…

medium CFG006 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.

· conf 1.00

[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.

medium MINED111 Bare except continues silently

main.py:61 · conf 1.00

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.