← Legacy view v2 (rp.*)

xxdhenzxx/saweria-roblox-server

https://github.com/xxdhenzxx/SAWERIA-ROBLOX-SERVER.git · lang: javascript · LOC: · source: user_submitted

Quality
45.6
Grade D+
Security
96.4
Findings
11
0 critical · 3 high
Status
completed
May 29, 2026 07:06
medium: 5 high: 3 low: 2 info: 1
Top rules by occurrence
RuleSeverityCount
SEC135 Auth/permission check missing on AI-generated endpoint high 1
CORE_NO_LICENSE No LICENSE file low 1
AUC005 [AUC005] No authorization-focused tests detected: No test f… low 1
AUC001 [AUC001] No Repobility access matrix policy found: The repo… medium 1
CFG006 [CFG006] Missing .gitignore: No .gitignore file. Risk of co… medium 1
CORE_NO_CI No CI/CD configuration found medium 1
MINED044 Js Console Log Prod info 1
AUC002 [AUC002] Low visible authorization coverage in route invent… medium 1
WEB003 Public web service has no security.txt medium 1
CORE_NO_TESTS No test files found high 1
First 11 findings (severity-sorted)
high CORE_NO_TESTS No test files found 
No test files found
high MINED113 Express POST/PUT/DELETE/PATCH route without auth CWE-306CWE-862
server.js:10 · conf 0.80 
[MINED113] Express POST /saweria-webhook has no auth: Express route POST /saweria-webhook declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unau…
high SEC135 Auth/permission check missing on AI-generated endpoint
server.js:10 · conf 1.00 
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…
medium AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
· conf 0.92 
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
medium AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
· conf 0.74 
[AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
medium CFG006 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.
· conf 1.00 
[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.
medium CORE_NO_CI No CI/CD configuration found 
No CI/CD configuration found
medium WEB003 Public web service has no security.txt
.well-known/security.txt · conf 0.78 
Public web service has no security.txt
low AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
· conf 0.76 
[AUC005] No authorization-focused tests detected: No test files with common authorization, ownership, 403, admin, or super_admin assertions were found.
low CORE_NO_LICENSE No LICENSE file 
No LICENSE file
info MINED044 Js Console Log Prod CWE-532
server.js:11 · conf 1.00 
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/e02a8e83-8c9b-4913-b537-2e6d7da09af9/.