← Legacy view v2 (rp.*)

mempalace/mempalace

https://github.com/MemPalace/mempalace · lang: python · LOC: · source: corpus_mined

Quality

82.4

Grade A-

Security

80.1

Findings

0 critical · 4 high

Status

completed

May 15, 2026 13:34

high: 4 info: 2 low: 1 medium: 1

Top rules by occurrence

Rule	Severity	Count
`SEC020` Secret Printed to Logs	high	4
`SEC006` XSS Risk	high	1
`SEC015` Insecure Randomness for Security	medium	1
`SEC017` Unbounded Input to LLM/External API	medium	1
`SEC016` LLM Prompt Injection — User Input in AI Prompt	high	1

First 8 findings (severity-sorted)

high SEC016 LLM Prompt Injection — User Input in AI Prompt

mempalace/corpus_origin.py:387 · conf 0.90

[SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL i…

high SEC020 Secret Printed to Logs

mempalace/cli.py:685 · conf 0.85

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

high SEC020 Secret Printed to Logs

mempalace/dialect.py:1040 · conf 0.85

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

high SEC020 Secret Printed to Logs

mempalace/layers.py:481 · conf 0.85

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

medium SEC017 Unbounded Input to LLM/External API

mempalace/corpus_origin.py:387 · conf 0.80

[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Co…

low SEC006 XSS Risk

website/.vitepress/theme/landing/useLandingEffects.js:139 · conf 0.40

[SEC006] XSS Risk: Direct HTML injection without sanitization.

info SEC015 Insecure Randomness for Security

website/.vitepress/theme/landing/useLandingEffects.js:154 · conf 0.25

[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.

info SEC020 Secret Printed to Logs

· conf 0.20

[SEC020] Secret Printed to Logs (and 1 more): Same pattern found in 1 additional files. Review if needed.

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/84cfce0a-b220-4710-a5f8-48ca55fda826/.