Code quality scan: 11 findings (C+, 74/100) #35309

Hi @bitcoin, an automated scan of this repository surfaced 11 code-quality findings that may be worth a look. Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

Full interactive report

https://repobility.com/scan/fe4bfc8c-abb6-4944-80b1-2ce18ee6050a/

At a glance

• Score: 74/100 • Grade: C+
• Scanned: 2026-05-17 20:36 UTC
• Lines of code: 60,779
• Total findings: 11
• Security-tagged: 2
• Credential / secret patterns: 1

Top issues, with file & line

These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree.

1. [high] [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting. — share/rpcauth/rpcauth.py:45 Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs.
2. [high] [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files. — src/common/run_command.cpp:28 Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
3. [high] [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files. — src/dbwrapper.cpp:248 Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
4. [low] No LICENSE file Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).
5. [low] Duplicated implementation block across source files — contrib/devtools/deterministic-unittest-coverage/src/main.rs:67 Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

See all 11 findings, with severity filters and AI fix prompts: https://repobility.com/scan/fe4bfc8c-abb6-4944-80b1-2ce18ee6050a/

What is this? Repobility is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is not a sales pitch — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

To re-run after fixes land: paste your repo URL at repobility.com — fresh scan, free.

Issue filed via the public Repobility report at https://repobility.com/scan/fe4bfc8c-abb6-4944-80b1-2ce18ee6050a/.