jazzwedz/team-repo

27/100
// permanent record of scan from 2026-07-09 · classified as web app · stack: Next.js 15 · TypeScript · React 18 · Tailwind CSS · Radix UI · Anthropic Claude SDK · Octokit (GitHub API) · Azure DevOps Git API · js-yaml · mermaid · Confluence API · filesystem locks · Docker (node:20-alpine)
// permalink — this URL always shows scan BMbqQOvL from 2026-07-09, even if a newer public scan exists for this repo.

Nine dimensions

DevOps
32
CI runs lint/typecheck/build and Dockerfile uses non-root user, but no deploy pipeline, no test stage, no staging env.
Security
14
Capped by vulnerable deps (js-yaml 4.1.1, mermaid 11.13.0 with 5 CVEs) and SITE_PASSWORD single-string auth in .env.local.example.
Cost & infra
42
MIT license and single container keep infra cheap, but unbounded Anthropic API calls with no rate/cost guardrails per user.
QA & testing
6
Explicit zero test files despite 30+ API routes and complex business logic; CI has no test stage to fail.
Performance
20
No caching, no profiling, no load tests; LLM and Confluence calls hit on every request without batching or memoization visible.
Architecture
30
Filesystem locks and _history/ suggest versioning, but no backups, no DB migrations, and storage is just YAML in Git.
Code quality
30
TypeScript strict + ESLint configured, but no tests and AI-vibe-coded sprawl across 100+ files in src/lib and src/app/api.
Observability
22
src/lib/log/ has sinks/redaction but no error tracking (Sentry/equivalent) for a public web_app with AI calls.
Maintainability
48
LICENSE MIT, CHANGELOG, SECURITY.md, docs/ present; but 0 stars, single contributor, and zero adoption signals.

Deterministic findings

high

2 dependencies with known CVEs (OSV.dev)

js-yaml@4.1.1 — 1 vuln (GHSA-h67p-54hq-rp68)
mermaid@11.13.0 — 4 vulns (GHSA-6m6c-36f7-fhxh, GHSA-87f9-hvmw-gh4p, GHSA-ghcm-xqfw-q4vr)

Top findings (AI)

critical

Zero automated tests on a 30+ route API surface

Test files: 0 per repo metadata. CI in .github/workflows/ci.yml only runs lint/typecheck/build — there is nothing to catch regressions in YAML parsing, lock refresh, blast-radius BFS, or Confluence pull-smart patch logic before customers hit them.

critical

5 known CVEs in shipped dependencies

OSV scan flags js-yaml@4.1.1 (GHSA-h67p-54hq-rp68) and mermaid@11.13.0 (GHSA-6m6c-36f7-fhxh, GHSA-87f9-hvmw-gh4p, GHSA-ghcm-xqfw-q4vr, plus one more) — mermaid is rendered server-side in api/diagrams/*, exposing users to prototype pollution / ReDoS.

high

Single shared SITE_PASSWORD is the entire auth model

.env.local.example documents SITE_PASSWORD as the sole gate; api/auth/login/route.ts confirms it. Any paying customer means shared credential, no audit attribution, no rotation, no MFA — and src/app/admin/* is reachable by anyone with the password.

high

No error tracking in production

Error tracking: false per repo metadata. A web_app exposing LLM, Confluence, Git and mermaid endpoints with no Sentry/Datadog/equivalent means silent failures and no alerting when an Anthropic rate limit or GitHub 401 hits.

medium

No backups or migration strategy for stored catalog

Catalog lives as YAML in a Git repo (GIT_PROVIDER=github|ado|filesystem), but there is no documented backup cadence, no export-as-of-date flow for tenants, and the filesystem provider has zero durability story if the volume is ephemeral.

medium

Unbounded LLM cost exposure

src/lib/llm/anthropic.ts and with-logging.ts call Claude Sonnet 4 from agents/coach/propose, solutions/enrich, generate, and admin/llm-calls/export with no visible per-user or per-tenant budget cap — one runaway tenant can drain a small team's runway.

Scan your own repo

Free 60-second scan. No signup.

Run a free scan →