https://github.com/SayantanBasak1986/skills-getting-started-with-github-copilot.git ·
lang: javascript ·
LOC: ·
source: user_submitted
| Rule | Severity | Count |
|---|---|---|
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) |
high | 25 |
MINED124 requirements.txt entry has no version pin |
medium | 4 |
AUC005 [AUC005] No authorization-focused tests detected: No test f… |
low | 1 |
AUC012 [AUC012] FastAPI interactive docs may be exposed by framewo… |
medium | 1 |
AUC001 [AUC001] No Repobility access matrix policy found: The repo… |
medium | 1 |
SEC006 XSS Risk |
high | 1 |
MINED044 Js Console Log Prod |
info | 1 |
AUC002 [AUC002] Low visible authorization coverage in route invent… |
medium | 1 |
WEB003 Public web service has no security.txt |
medium | 1 |
CORE_NO_TESTS No test files found |
high | 1 |
MINED112
FastAPI POST/PUT/DELETE/PATCH endpoint without auth
CWE-306CWE-862
src/app.py:56
· conf 0.80
[MINED112] FastAPI POST /activities/{activity_name}/signup has no auth: Handler `signup_for_activity` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:20
· conf 0.90
[MINED115] Action `skills/exercise-toolkit/.github/workflows/find-exercise-issue.yml` pinned to mutable ref `@v0.8.1`: `uses: skills/exercise-toolkit/.github/workflows/[email protected]`…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:32
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:35
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:43
· conf 0.90
[MINED115] Action `peter-evans/find-comment` pinned to mutable ref `@v3`: `uses: peter-evans/find-comment@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; th…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:50
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:63
· conf 0.90
[MINED115] Action `skills/action-keyphrase-checker` pinned to mutable ref `@v1`: `uses: skills/action-keyphrase-checker@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the ac…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:73
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:102
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:105
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:112
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:121
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/1-step.yml:128
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:20
· conf 0.90
[MINED115] Action `skills/exercise-toolkit/.github/workflows/find-exercise-issue.yml` pinned to mutable ref `@v0.8.1`: `uses: skills/exercise-toolkit/.github/workflows/[email protected]`…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:32
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:35
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:43
· conf 0.90
[MINED115] Action `peter-evans/find-comment` pinned to mutable ref `@v3`: `uses: peter-evans/find-comment@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; th…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:50
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:63
· conf 0.90
[MINED115] Action `skills/action-keyphrase-checker` pinned to mutable ref `@v1`: `uses: skills/action-keyphrase-checker@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the ac…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/2-step.yml:71
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/5-step.yml:21
· conf 0.90
[MINED115] Action `skills/exercise-toolkit/.github/workflows/find-exercise-issue.yml` pinned to mutable ref `@v0.8.1`: `uses: skills/exercise-toolkit/.github/workflows/[email protected]`…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/5-step.yml:33
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/5-step.yml:36
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/5-step.yml:43
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/5-step.yml:50
· conf 0.90
[MINED115] Action `GrantBirki/comment` pinned to mutable ref `@v2.1.1`: `uses: GrantBirki/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/5-step.yml:64
· conf 0.90
[MINED115] Action `skills/exercise-toolkit/.github/workflows/finish-exercise.yml` pinned to mutable ref `@v0.8.1`: `uses: skills/exercise-toolkit/.github/workflows/[email protected]` resolve…SEC040
innerHTML XSS — template literal with server-supplied data
src/static/app.js:23
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC135
Auth/permission check missing on AI-generated endpoint
src/app.py:55
· conf 1.00
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…AUC001
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.AUC002
[AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
[AUC002] Low visible authorization coverage in route inventory: Only 33.3% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.AUC012
[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.
[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, p…MINED124
requirements.txt entry has no version pin
CWE-1357
requirements.txt:1
· conf 0.90
[MINED124] requirements.txt: `fastapi` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats,…MINED124
requirements.txt entry has no version pin
CWE-1357
requirements.txt:2
· conf 0.90
[MINED124] requirements.txt: `uvicorn` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats,…MINED124
requirements.txt entry has no version pin
CWE-1357
requirements.txt:3
· conf 0.90
[MINED124] requirements.txt: `httpx` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, a…MINED124
requirements.txt entry has no version pin
CWE-1357
requirements.txt:4
· conf 0.90
[MINED124] requirements.txt: `watchfiles` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosqua…WEB003
Public web service has no security.txt
.well-known/security.txt
· conf 0.78
Public web service has no security.txtAUC005
[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.SEC006
XSS Risk
src/static/app.js:23
· conf 0.40
[SEC006] XSS Risk: Direct HTML injection without sanitization.CORE_NO_TESTS
No test files found
No test files found in a documentation, catalog, or template-heavy repositoryMINED044
Js Console Log Prod
CWE-532
src/static/app.js:40
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/a933b266-1de2-4a0e-af83-ac760a9b0ad1/.