← Legacy view v2 (rp.*)

smartqa-api/smartqa-api

https://github.com/smartqa-api/smartqa-api.git · lang: python · LOC: · source: user_submitted

Quality
49.8
Grade D+
Security
75.4
Findings
51
1 critical · 12 high
Status
completed
May 28, 2026 05:37
medium: 23 high: 12 low: 10 info: 5 critical: 1
Top rules by occurrence
RuleSeverityCount
MINED111 Bare except continues silently medium 10
COMP001 [COMP001] High cognitive complexity: Function `load_yfinanc… low 4
AUC009 [AUC009] Sensitive function route lacks elevated authorizat… medium 3
SEC135 Auth/permission check missing on AI-generated endpoint high 3
MINED050 Stub Only Function info 3
MINED112 FastAPI POST/PUT/DELETE/PATCH endpoint without auth high 2
MINED001 Bare Except Pass high 2
DKC006 Compose service does not declare a runtime user low 2
ERR001 [ERR001] Silent Exception Swallowing (and 2 more): Same pat… info 2
DKC015 Database service has no healthcheck low 2
First 51 findings (severity-sorted)
critical DKC007 Compose service contains a literal secret environment value
docker-compose.yml:16 · conf 0.96 
Compose service contains a literal secret environment value
high COMP001 [COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
app/services/kb_search.py:146 · conf 0.95 
[COMP001] High cognitive complexity: Function `_split_long_text` has cognitive complexity 32 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — ne…
high CORE_NO_TESTS No test files found 
No test files found
high DKC011 Database service publishes a host port
docker-compose.yml:28 · conf 0.84 
Database service publishes a host port
high DKR014 Dockerfile copies the entire context without .dockerignore
Dockerfile:12 · conf 0.92 
Dockerfile copies the entire context without .dockerignore
high MINED001 Bare Except Pass CWE-755
app/services/kb_search.py:23 · conf 1.00 
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.
high MINED001 Bare Except Pass CWE-755
convert_docs.py:221 · conf 1.00 
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.
high MINED112 FastAPI POST/PUT/DELETE/PATCH endpoint without auth CWE-306CWE-862
app/api/chat.py:28 · conf 0.80 
[MINED112] FastAPI POST /send has no auth: Handler `chat_send` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
high MINED112 FastAPI POST/PUT/DELETE/PATCH endpoint without auth CWE-306CWE-862
app/api/chat.py:80 · conf 0.80 
[MINED112] FastAPI POST /send-sync has no auth: Handler `chat_send_sync` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the functi…
high MINED118 Dockerfile FROM not pinned by sha256 digest CWE-829
Dockerfile:1 · conf 0.90 
[MINED118] Dockerfile FROM `python:3.11-slim` not pinned by digest: `FROM python:3.11-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build…
high SEC135 Auth/permission check missing on AI-generated endpoint
app/api/auth.py:20 · conf 1.00 
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…
high SEC135 Auth/permission check missing on AI-generated endpoint
app/api/chat.py:27 · conf 1.00 
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…
high SEC135 Auth/permission check missing on AI-generated endpoint
app/api/knowledge.py:23 · conf 1.00 
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…
medium AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
· conf 0.92 
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
medium AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
app/api/knowledge.py:97 · conf 0.68 
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…
medium AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
app/api/knowledge.py:121 · conf 0.68 
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…
medium AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
app/api/knowledge.py:211 · conf 0.68 
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…
medium AUC012 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.
· conf 0.72 
[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, p…
medium CORE_NO_CI No CI/CD configuration found 
No CI/CD configuration found
medium CORE_NO_README No README file found 
No README file found
medium DKR001 Docker final stage has no non-root USER
Dockerfile:1 · conf 0.82 
Docker final stage has no non-root USER
medium DKR007 Docker build context has no .dockerignore
.dockerignore · conf 0.90 
Docker build context has no .dockerignore
medium ERR001 [ERR001] Silent Exception Swallowing (and 2 more): Same pattern found in 2 additional files. Review if needed.
app/services/kb_search.py:23 · conf 1.00 
[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
medium ERR001 [ERR001] Silent Exception Swallowing (and 2 more): Same pattern found in 2 additional files. Review if needed.
convert_docs.py:221 · conf 1.00 
[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
medium MINED111 Bare except continues silently
app/api/chat.py:35 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
app/api/chat.py:61 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
app/api/chat.py:88 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
app/api/chat.py:111 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
app/api/knowledge.py:186 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
app/services/kb_search.py:82 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
app/services/rag_service.py:33 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
convert_docs.py:57 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
convert_docs.py:111 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium MINED111 Bare except continues silently
convert_docs.py:152 · conf 1.00 
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.
medium SEC015 Insecure Randomness for Security
app/core/security.py:19 · conf 1.00 
[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.
medium WEB003 Public web service has no security.txt
.well-known/security.txt · conf 0.78 
Public web service has no security.txt
low AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
· conf 0.76 
[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
low COMP001 [COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
app/api/auth.py:21 · conf 0.95 
[COMP001] High cognitive complexity: Function `wechat_login` has cognitive complexity 10 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested…
low COMP001 [COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
app/api/knowledge.py:122 · conf 0.95 
[COMP001] High cognitive complexity: Function `upload_document` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nest…
low CORE_NO_LICENSE No LICENSE file 
No LICENSE file
low DKC006 Compose service does not declare a runtime user
docker-compose.yml:3 · conf 0.56 
Compose service does not declare a runtime user
low DKC006 Compose service does not declare a runtime user
docker-compose.yml:16 · conf 0.56 
Compose service does not declare a runtime user
low DKC010 Compose service lacks no-new-privileges hardening
docker-compose.yml:3 · conf 0.62 
Compose service lacks no-new-privileges hardening
low DKC015 Database service has no healthcheck
docker-compose.yml:16 · conf 0.72 
Database service has no healthcheck
low DKC015 Database service has no healthcheck
docker-compose.yml:28 · conf 0.72 
Database service has no healthcheck
low DKC016 App service does not wait for database health
docker-compose.yml:3 · conf 0.68 
App service does not wait for database health
info COMP001 [COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
· conf 0.20 
[COMP001] High cognitive complexity (and 7 more): Same pattern found in 7 additional files. Review if needed.
info MINED050 Stub Only Function CWE-1188
app/models/database.py:43 · conf 1.00 
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.
info MINED050 Stub Only Function CWE-1188
app/services/kb_search.py:24 · conf 1.00 
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.
info MINED050 Stub Only Function CWE-1188
convert_docs.py:222 · conf 1.00 
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.
info MINED072 Python Pass Only Class CWE-1188
app/models/database.py:42 · conf 1.00 
[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/c0c32f91-de68-4edd-b837-1420c0881687/.