jazzwedz/team-repo
BMbqQOvL from 2026-07-09, even if a newer public scan exists for this repo.
Nine dimensions
Deterministic findings
2 dependencies with known CVEs (OSV.dev)
js-yaml@4.1.1 — 1 vuln (GHSA-h67p-54hq-rp68)
mermaid@11.13.0 — 4 vulns (GHSA-6m6c-36f7-fhxh, GHSA-87f9-hvmw-gh4p, GHSA-ghcm-xqfw-q4vr)
Top findings (AI)
Zero automated tests on a 30+ route API surface
Test files: 0 per repo metadata. CI in .github/workflows/ci.yml only runs lint/typecheck/build — there is nothing to catch regressions in YAML parsing, lock refresh, blast-radius BFS, or Confluence pull-smart patch logic before customers hit them.
5 known CVEs in shipped dependencies
OSV scan flags js-yaml@4.1.1 (GHSA-h67p-54hq-rp68) and mermaid@11.13.0 (GHSA-6m6c-36f7-fhxh, GHSA-87f9-hvmw-gh4p, GHSA-ghcm-xqfw-q4vr, plus one more) — mermaid is rendered server-side in api/diagrams/*, exposing users to prototype pollution / ReDoS.
Single shared SITE_PASSWORD is the entire auth model
.env.local.example documents SITE_PASSWORD as the sole gate; api/auth/login/route.ts confirms it. Any paying customer means shared credential, no audit attribution, no rotation, no MFA — and src/app/admin/* is reachable by anyone with the password.
No error tracking in production
Error tracking: false per repo metadata. A web_app exposing LLM, Confluence, Git and mermaid endpoints with no Sentry/Datadog/equivalent means silent failures and no alerting when an Anthropic rate limit or GitHub 401 hits.
No backups or migration strategy for stored catalog
Catalog lives as YAML in a Git repo (GIT_PROVIDER=github|ado|filesystem), but there is no documented backup cadence, no export-as-of-date flow for tenants, and the filesystem provider has zero durability story if the volume is ephemeral.
Unbounded LLM cost exposure
src/lib/llm/anthropic.ts and with-logging.ts call Claude Sonnet 4 from agents/coach/propose, solutions/enrich, generate, and admin/llm-calls/export with no visible per-user or per-tenant budget cap — one runaway tenant can drain a small team's runway.