elebumm/redditvideomakerbot

[MINED107] Missing import: `time` used but not imported: The file uses `time.something(...)` but never imports `time`. This raises NameError at runtime the first time the line executes.

No test files found

Secret-like setting is echoed into a password input value

[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection.

[MINED036] Python Os System Call: os.system() invokes shell with no escaping.

[MINED036] Python Os System Call: os.system() invokes shell with no escaping.

[MINED108] `self.randomvoice` used but never assigned in __init__: Method `run` of class `AWSPolly` reads `self.randomvoice`, but no assignment to it exists in __init__ (and no class-level fallback).…

[MINED108] `self.initialize` used but never assigned in __init__: Method `run` of class `elevenlabs` reads `self.initialize`, but no assignment to it exists in __init__ (and no class-level fallback).…

[MINED108] `self.randomvoice` used but never assigned in __init__: Method `run` of class `elevenlabs` reads `self.randomvoice`, but no assignment to it exists in __init__ (and no class-level fallback…

[MINED108] `self.initialize` used but never assigned in __init__: Method `randomvoice` of class `elevenlabs` reads `self.initialize`, but no assignment to it exists in __init__ (and no class-level fa…

[MINED108] `self.add_periods` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.add_periods`, but no assignment to it exists in __init__ (and no class-level fallback)…

[MINED108] `self.call_tts` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.call_tts`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.split_post` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.split_post`, but no assignment to it exists in __init__ (and no class-level fallback). …

[MINED108] `self.call_tts` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.call_tts`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.call_tts` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.call_tts`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.split_post` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.split_post`, but no assignment to it exists in __init__ (and no class-level fallback). …

[MINED108] `self.call_tts` used but never assigned in __init__: Method `run` of class `TTSEngine` reads `self.call_tts`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.create_silence_mp3` used but never assigned in __init__: Method `split_post` of class `TTSEngine` reads `self.create_silence_mp3`, but no assignment to it exists in __init__ (and no …

[MINED108] `self.call_tts` used but never assigned in __init__: Method `split_post` of class `TTSEngine` reads `self.call_tts`, but no assignment to it exists in __init__ (and no class-level fallback…

[MINED108] `self.randomvoice` used but never assigned in __init__: Method `run` of class `OpenAITTS` reads `self.randomvoice`, but no assignment to it exists in __init__ (and no class-level fallback)…

[MINED108] `self.randomvoice` used but never assigned in __init__: Method `run` of class `pyttsx` reads `self.randomvoice`, but no assignment to it exists in __init__ (and no class-level fallback). T…

[MINED108] `self.randomvoice` used but never assigned in __init__: Method `run` of class `StreamlabsPolly` reads `self.randomvoice`, but no assignment to it exists in __init__ (and no class-level fal…

[MINED108] `self.run` used but never assigned in __init__: Method `run` of class `StreamlabsPolly` reads `self.run`, but no assignment to it exists in __init__ (and no class-level fallback). This rai…

[MINED108] `self.random_voice` used but never assigned in __init__: Method `run` of class `TikTok` reads `self.random_voice`, but no assignment to it exists in __init__ (and no class-level fallback).…

[MINED108] `self.get_voices` used but never assigned in __init__: Method `run` of class `TikTok` reads `self.get_voices`, but no assignment to it exists in __init__ (and no class-level fallback). Thi…

[MINED108] `self.get_latest_ms_progress` used but never assigned in __init__: Method `run` of class `ProgressFfmpeg` reads `self.get_latest_ms_progress`, but no assignment to it exists in __init__ (a…

[MINED108] `self.start` used but never assigned in __init__: Method `__enter__` of class `ProgressFfmpeg` reads `self.start`, but no assignment to it exists in __init__ (and no class-level fallback).…

[MINED108] `self.stop` used but never assigned in __init__: Method `__exit__` of class `ProgressFfmpeg` reads `self.stop`, but no assignment to it exists in __init__ (and no class-level fallback). Th…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `github/codeql-action/init` pinned to mutable ref `@v2`: `uses: github/codeql-action/init@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …

[MINED115] Action `github/codeql-action/autobuild` pinned to mutable ref `@v2`: `uses: github/codeql-action/autobuild@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the acti…

[MINED115] Action `github/codeql-action/analyze` pinned to mutable ref `@v2`: `uses: github/codeql-action/analyze@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action o…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …

[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `psf/black` pinned to mutable ref `@stable`: `uses: psf/black@stable` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…

[MINED115] Action `isort/isort-action` pinned to mutable ref `@v1`: `uses: isort/isort-action@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

[MINED115] Action `actions/stale` pinned to mutable ref `@v9`: `uses: actions/stale@v9` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…

[MINED118] Dockerfile FROM `python:3.10.14-slim` not pinned by digest: `FROM python:3.10.14-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC035] Unbounded Resource Allocation — DoS risk: Allocating resources (buffers, recursion stack, large ranges) based on user input without an upper bound. Attackers send `size=10000000` to exhaust …

[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…

[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…

[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…

[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

[AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…

[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…

[COMP001] High cognitive complexity: Function `run` has cognitive complexity 23 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches…

Docker final stage has no non-root USER

Dockerfile separates apt update from install

Dockerfile installs dependencies after copying the full source tree

[MINED109] Mutable default argument in `crawl_and_check` (dict): `def crawl_and_check(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across al…

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.

[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.

[SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.

[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.

[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …

[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …

[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …

Public web service has no security.txt

Duplicated implementation block across source files

Duplicated implementation block across source files

[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.

[COMP001] High cognitive complexity: Function `run` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches,…

[COMP001] High cognitive complexity: Function `split_post` has cognitive complexity 11 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested b…

.dockerignore misses sensitive defaults

Dockerfile installs recommended OS packages

Dockerfile installs recommended OS packages

Dockerfile keeps pip download cache

[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated …

[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…

[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…

[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…

[COMP001] High cognitive complexity (and 13 more): Same pattern found in 13 additional files. Review if needed.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED064] Python Input Call (and 3 more): Same pattern found in 3 additional files. Review if needed.

[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.

[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.

[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.

[MINED067] Python Requests No Timeout (and 1 more): Same pattern found in 1 additional files. Review if needed.

[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.

[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.

[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.

[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles.

[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles.

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

[SEC078] Python: requests without timeout (and 1 more): Same pattern found in 1 additional files. Review if needed.