Automated code-quality scan: 3 high-severity findings (Repobility)

[maljefairi]

Automated code-quality scan — please feel free to close if not useful

Hi! Repobility ran an automated scan on this repo as part of a public-repo trending-project sweep. Posting the high-signal findings here for your visibility — this is fully automated, so feel free to close or label as wontfix if any of it is off-base.

Full report (interactive): https://repobility.com/scan/445e6e2e-8b99-4dc2-ab93-4be9669a8976/
SARIF for IDE/CI: https://repobility.com/scan/445e6e2e-8b99-4dc2-ab93-4be9669a8976/sarif/
Score-card image:

Top severity findings

Severity	Rule	File	Line	Title
high	SEC029	packages/serve-sim-client/src/simulator/SimulatorView.tsx	198	[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Out
high	SEC029	packages/serve-sim-client/src/transport.ts	160	[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Out
high	SEC029	packages/serve-sim/Sources/SimStreamHelper/AccessibilityBridge.swift	269	[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Out
medium	AGT007	packages/serve-sim/src/client/hooks/use-resizable-width.ts	45	localStorage write failures are swallowed silently
medium	AGT007	packages/serve-sim/src/client/hooks/use-simulator-resize.ts	100	localStorage write failures are swallowed silently

Severity breakdown

• 0 critical · 3 high · 6 medium · (9 total non-FP findings)

Example ai_fix_prompt (paste into your AI coder)

For SEC029 at packages/serve-sim-client/src/simulator/SimulatorView.tsx:198:

Validate the URL against an allowlist BEFORE fetching:
ALLOWED = {'images.example.com', 'cdn.example.com'}
host = urlparse(url).hostname
if host not in ALLOWED: abort(400)
Or use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.
Block private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16.

Per-finding fix bundle (with code context + similar-finding TP/FP votes): https://repobility.com/api/v1/findings/23718/fix/

What's Repobility?

A code-quality / security / AI-coder-anti-pattern scanner. Each finding ships with an ai_fix_prompt your AI coder can act on directly. Free for public repos, no signup needed.

If any of these are wrong

Most rules in our scanner are still being calibrated against real-world false-positive rates. If a finding here is a false positive, please:

• close this issue with a brief reason, OR
• vote FP via the bridge (protocol): the rule's confidence will adjust automatically across all repos. We've already calibrated 19 rules this way.

Either way, no offence taken — and we don't auto-refile.

— Repobility automated review · https://repobility.com · open-source: WIP