Not Safe for Production — fix 3 things before you ship.Not Safe for Production — fix 3 things before you make it live.Not Safe for Production — fix 3 things before you ship.
67/ 100executive score · higher is betterthe one overall score · higher is betterexecutive score · higher is better
Critical issues block production use. Do not ship as-is.Serious problems block using this for real users. Don't make it live as-is.Fix these serious problems before shipping.
This verdict covers the 17% of your repository we read — see what we didn’t read below.This result is based on the 17% of your project’s code we actually read — see what we didn’t read below.Covers 17% of your repo — see what we didn’t read below.
74Production ReadinessReady for real usersProduction Readiness62Security66Privacy77ArchitectureHow the code is put togetherArchitecture86IP ProtectionProtecting your ideasIP Protection
coverage · partialhow much we checked · partialcoverage · partial
This audit read 196 of your 1109 eligible source files — the ones most likely to hurt you first. Maximum coverage for now — this repository is larger than one full audit can read in a single run.
The scores and findings above cover only those files. The other 913 files haven’t been audited yet. The denominator counts eligible source and configuration files only — images, generated output and build directories are excluded before counting.
Read it:
3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship
A finite, ranked list — highest-severity, lowest-effort blockers first. Clear these and the verdict lifts.A short, ranked list — the most serious, easiest-to-fix problems first. Clear these and the verdict improves.Ranked by severity and effort. Clear these and the verdict lifts.
distance to ship
Your code scores 67. 2 blockers stand between it and shipping — the Not Safe for Production verdict above holds until they are resolved.
Resolving these 2 blockers is necessary but not sufficient: even setting them aside, at 67 this code sits in the High Risk band on its own and needs broader work before it is ready to ship. Fix these 2 blockers first — they force the Not Safe for Production verdict outright — then keep going.
What’s blocking — resolve to clear the Not Safe for Production verdict
1
Generic hardcoded secret committed to the repository
Fix — Remove the credential from source, purge it from git history, and rotate it — a committed secret must be treated as already compromised.
2
Critical vulnerability in chromadb
chromadb@1.5.9Small (hours)
GHSA-f4j7-r4q5-qw2c (CRITICAL) — ChromaDB Python project has a pre-authentication code injection vulnerability
Fix — Upgrade chromadb past the affected range to a patched release. Reachability from your own code was not verified — the floor stands on the vulnerable version being installed.
35 known-vulnerable dependency versions, including CRITICAL pre-auth code injection in chromadb (default vector DB)
Everything else we foundEverything else we noticedEverything else
5 more findings across 4 dimensions — none blocking, all worth a look.5 more problems across 4 categories — none blocking, all worth a look.5 more findings — none blocking.
8Findings in allTotal problems foundAll findings
1High
3Medium
3Low
1Info
Security
How we scored it
Five component scores roll up into the one number — and the verdict is held to the evidence, not to how the write-up reads.Five scores combine into the one overall number — and the verdict is checked against the actual evidence, not just how the write-up sounds.Five scores roll into one number. The verdict is held to the evidence, not the write-up.
Production ReadinessReady for real usersProduction Readiness74
Security62
Privacy66
What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t
We read the highest-priority 17% of your repository. This verdict covers only that — here is the record of which files, which modules, and what the snapshot was.We checked the highest-priority 17% of your project's code. This verdict covers only that — here is the record of which files, which checks, and what copy of the code was used.Read the highest-priority 17% of your repo. Record of files, modules, and snapshot below.
196 of 1109 source files were audited. This audit's size or file-count limit was reached, so some source and configuration files were left unread. The denominator counts eligible source and configuration files only — images, generated output and build directories are excluded before counting.
3922 other files aren’t code this audit reads — images, lockfiles, generated output, and similar non-source content.
Show the 500 files
images (469)
backend/open_webui/static/apple-touch-icon.png
In the model’s wordsWhat the AI wrote, in its own wordsThe model's words
The executive summary, as Claude wrote it. Evidence, scores and the verdict are computed by nittim.The summary, as Claude wrote it. The evidence, scores and verdict are computed by nittim, not by Claude.Claude wrote this summary. nittim computes the evidence, scores, and verdict.
executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words
Claude says
Evidence, scores, and the verdict above are computed by nittim. The written read below — this summary and every finding’s narrative — is Claude’s.The evidence, scores, and the verdict above are computed by nittim. The written explanation below — this summary and every finding’s write-up — is Claude’s, the AI assistant that reviewed your code.nittim computes the evidence, scores, and verdict. Claude writes the summary below.
This is the well-known public open-source project Open WebUI (v0.11.0), a mature, actively-maintained AI interface with a FastAPI/SQLAlchemy backend and a SvelteKit frontend. The codebase is high quality and unmistakably human-authored over a long history: layered Alembic migrations, idiosyncratic prose comments, robust and thoughtful security fundamentals (argon2/bcrypt hashing, JWT revocation via Redis, timing-attack mitigation on signin, SSRF-safe outbound sessions, LDAP unauthenticated-bind hardening, security-header middleware, rate limiting, encrypted OAuth token storage). The dominant risks are supply-chain: the deterministic OSV scan flags 35 vulnerable dependency versions, including a CRITICAL pre-authentication code-injection advisory in chromadb 1.5.9 — the default vector database — though reachability was not verified. Operational hardening gaps (container runs as root by default, unpinned CI actions and base image) and a scanner-flagged hardcoded credential in an Oracle vector-DB adapter round out the security findings. Privacy is largely the deployer's responsibility in this self-hosted single-tenant model; deletion and export paths exist and telemetry is off by default, but no formal retention or data-subject-rights tooling is present. As a public OSS project there is no meaningful IP-leak exposure — the code is intentionally open.
Impact
A reachable code-injection path in the default vector database could allow remote code execution; several other advisories enable path traversal, arbitrary file read, or DoS. In aggregate this is the largest exploitable surface in the deployment.
Root causeWhy it happensCause
Dependencies pinned to fixed versions that have since accrued published CVEs; no automated advisory gate blocking vulnerable pins beyond monthly Dependabot.
Recommended fixHow to fix itFix
Upgrade the flagged packages to patched releases (chromadb, langchain, mcp, nltk, pillow, cryptography, aiohttp, pyarrow) and verify whether the vulnerable code paths are reachable from this project. Add an OSV/pip-audit gate to CI. Note: OSV entries are version matches only; reachability was NOT verified here.
RemediationHow to fix itRemediationMedium (1–3d)Medium (1–3 days)Medium (1–3d)
Useful?
Scanner-flagged hardcoded credential in Oracle vector-DB adapter
Medium·Security·backend/open_webui/retrieval/vector/dbs/oracle23ai.py:12·Trivial (<1h)Very quick (under an hour)Trivial (<1h)
EvidenceWhat we foundEvidence
Secret scan: backend/open_webui/retrieval/vector/dbs/oracle23ai.py:12 — "ORACLE_DB_PASSWO…456" (line 18 is the same value in a comment, flagged as example/doc). The runtime config in backend/open_webui/config.py reads ORACLE_DB_PASSWORD = os.getenv('ORACLE_DB_PASSWORD', None), so production credentials come from the environment.
Business impactWhy it mattersImpact
If the flagged value is a real credential it is exposed in a public repo; if (as the sibling comment strongly suggests) it is an example/placeholder, the risk is limited to developer confusion and accidental reuse. The file was not in this snapshot, so the exact nature could not be confirmed.
Root causeWhy it happensCause
Example/placeholder connection credentials embedded directly in a driver module rather than in documentation-only fixtures.
Recommended fixHow to fix itFix
Confirm the value is a non-live placeholder; if so, move it to a clearly labelled docstring/example and rotate it if it was ever a real secret. Keep all credentials env-sourced (already the pattern in config.py).
RemediationHow to fix itRemediationTrivial (<1h)Very quick (under an hour)Trivial (<1h)
Dockerfile`ARG UID=0`, `ARG GID=0`, comment "Override at your own risk - non-root configurations are untested", and final `USER $UID:$GID`. Permission hardening is opt-in via USE_PERMISSION_HARDENING.
Business impactWhy it mattersImpact
A container escape or in-container compromise runs with root privileges, increasing blast radius. Non-root operation is explicitly noted as untested, discouraging safer deployments.
Root causeWhy it happensCause
Default UID/GID of 0 chosen for OpenShift arbitrary-UID compatibility and to avoid write-permission issues on bundled static assets.
Recommended fixHow to fix itFix
Provide and test a non-root default UID, or document a hardened non-root run configuration; ensure writable directories (open_webui/static, data) are group-writable so an arbitrary non-zero UID works.
RemediationHow to fix itRemediationMedium (1–3d)Medium (1–3 days)Medium (1–3d)
Useful?
Priority: Core
1 finding
Docker ENV secret-scan hits are false positives
Docker ENV secret-scan hits are false positives
Info·Security·Dockerfile:19·Trivial (<1h)Very quick (under an hour)Trivial (<1h)
None — these are an empty placeholder and a public tiktoken encoding name, not credentials. Recorded so a reviewer can see the scanner hits were assessed and dismissed.
Root causeWhy it happensCause
Pattern-based secret detector matching ENV/ARG assignments regardless of value content.
Recommended fixHow to fix itFix
No action required; optionally add scanner ignore annotations to reduce noise.
RemediationHow to fix itRemediationTrivial (<1h)Very quick (under an hour)Trivial (<1h)
Useful?
Privacy & Compliance
Priority: Core2 findings
No formal data-retention or data-subject-rights framework for personal data · Per-user analytics captured without documented retention or consent notice
No formal data-retention or data-subject-rights framework for personal data
Personal data is stored across user (email, name, oauth, date_of_birth, bio), chat/message, analytics (per-user message and token usage in src/lib/components/admin/Settings — getUserAnalytics), and oauth_session (encrypted tokens). Account deletion cascades (backend/open_webui/models/auths.py delete_auth_by_id -> Users.delete_user_by_id + delete Auth) and admin export exists (Database.svelte exportAllUserChats/exportUsers), but there is no configurable retention period, automated purge, or self-service access/rectification/erasure endpoint set surfaced in the snapshot.
Business impactWhy it mattersImpact
Deployers acting as GDPR/CCPA controllers must build retention and DSAR handling themselves; absent tooling raises compliance effort and risk of over-retention.
Root causeWhy it happensCause
Self-hosted single-tenant product design places controller responsibilities on the operator; the platform provides primitives (delete, export) but not a compliance workflow.
Recommended fixHow to fix itFix
Document controller responsibilities and provide optional retention/purge configuration plus a consolidated data-subject export/erasure path; note subprocessors (OAuth providers, optional analytics/search integrations) in deployment docs.
RemediationHow to fix itRemediationLarge (1–2wk)Big (1–2 weeks)Large (1–2wk)
Useful?
Per-user analytics captured without documented retention or consent notice
src/lib/components/admin/Settings/Analytics dashboards and backend analytics router aggregate per-user message counts, token usage, model usage and chat previews (getUserAnalytics, getModelChats). Telemetry to third parties is disabled by default (.env.example: ANONYMIZED_TELEMETRY=false, DO_NOT_TRACK=true, SCARF_NO_ANALYTICS=true).
Business impactWhy it mattersImpact
Internal profiling of user activity is stored indefinitely; without a retention window or notice this can conflict with data-minimisation expectations for organizational deployments.
Root causeWhy it happensCause
Analytics feature stores usage history keyed to user identity with no lifecycle policy.
Recommended fixHow to fix it
Infrastructure & DevOps
Priority: Important1 finding
Unpinned GitHub Actions and Docker base image in CI/build
Unpinned GitHub Actions and Docker base image in CI/build
Low·Infrastructure & DevOps·Dockerfile:27·Small (hours)Quick (a few hours)Small (hours)
Mutable action/image references allow a compromised or retagged upstream to inject code into the publish/build pipeline (which holds packages:write, PyPI id-token, and Docker Hub credentials).
Root causeWhy it happensCause
Common convention of pinning to major version tags rather than immutable commit SHAs/digests.
Recommended fixHow to fix itFix
Pin third-party actions to full commit SHAs and base images to digests; enable Dependabot updates for GitHub Actions (already partially configured).
RemediationHow to fix itRemediationSmall (hours)Quick (a few hours)Small (hours)
backend/open_webui/main.pyand backend/open_webui/config.py are each several thousand lines; main.py's chat_completion handler alone spans hundreds of lines mixing routing, chat persistence, event publishing and task fan-out.
Business impactWhy it mattersImpact
Concentration of routing, persistence and orchestration logic in single large files raises the cost and risk of future changes and slows onboarding.
Root causeWhy it happensCause
Organic growth of central entry points without extraction into focused service modules.
Recommended fixHow to fix itFix
Incrementally extract chat-persistence, event-publishing and model-routing concerns out of main.py into dedicated modules; split config.py by domain.
RemediationHow to fix itRemediationLarge (1–2wk)Big (1–2 weeks)Large (1–2wk)
Useful?
ArchitectureHow the code is put togetherArchitecture
77
IP ProtectionProtecting your ideasIP Protection86
How the executive score is composedHow the overall score is put togetherHow the exec score is composed
Security62
weightimportanceweight
Privacy66
weightimportanceweight
Production ReadinessReady for real usersProduction Readiness74
weightimportanceweight
ArchitectureHow the code is put togetherArchitecture77
weightimportanceweight
Weighted blend of 4 dimensions → ~67/100. Dimensions are weighted by importance (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting and precise scoring are proprietary, while the verdict is computed on exact internal values.4 categories combine into ~67/100. Some categories count for more than others (Security and Privacy count the most). The published numbers are approximate; nittim's exact math is kept private, while the verdict itself is worked out from the exact internal numbers.Weighted blend of 4 dimensions → ~67/100 (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting is proprietary. The verdict runs on exact internal values. IP Protection is an independent IP-defensibility lens and is excluded from this blend.IP Protection (checking whether your ideas are exposed) is judged separately and isn’t
part of this combined number.IP Protection is judged separately, excluded from this blend. Scores are a judgement, not a measurement: a re-audit of the same commit can land a few
points either side of this figure. The evidence underneath it is deterministic — the same
commit always yields the same committed-secret and vulnerable-dependency findings.Scores are a judgment call, not an exact measurement: checking the same saved snapshot of
your code twice can land a few points either side of this number. The evidence underneath
it is not — the same snapshot always turns up the same passwords-in-code and known-security-bug
findings.Scores are a judgment, not a measurement — a re-audit can land a few points either side. The evidence underneath is deterministic: the same commit always yields the same secret and vulnerable-dependency findings. Each score is the model's overall assessment of the dimensions it covers, across everything it reviewed — not a tally of the findings in this report. Findings are the subset worth acting on, so a score can sit above or below what the listed findings alone would suggest.Each score is the AI's overall judgment of everything it reviewed in that category — not a
count of the problems listed in this report. The listed problems are the ones worth acting
on, so a score can sit above or below what they alone would suggest.Each score is the model's overall assessment across everything it reviewed — not a tally of this report's findings. A score can sit above or below what the findings alone suggest.
nittim guardrail — nittim's safety check — nittim guardrail — The model proposed “ready_with_conditions”; nittim's deterministic layer set the final verdict to “not_safe” because of a committed production secret, a critical vulnerability in an installed runtime dependency (reachability from your own code was not verified). The written rationale below reflects the model's proposal — the verdict above is the one that governs.
AI-generated likelihoodHow much of this looks AI-writtenAI-generated likelihood12/100Informational only — an estimate of how the code was authored. It does not affect the
executive score or the verdict.This is just for information — a guess at how much of the code an AI wrote. It does not
change the overall score or the verdict.Informational only — it doesn't affect the score or the verdict.
Where this score sits on nittim's production-readiness scaleWhere this score falls on nittim's “is it ready to ship” scaleThis score's spot on nittim's scale.
67
0–49 Not Safe for Production
50–69 High Risk
70–84 Ready with Conditions
85–100 Production Ready
nittim grades against fixed production-readiness thresholds, not a peer corpus — this is a band on our own verdict scale, NOT a percentile or “better than X% of repos.”nittim grades against fixed, unmoving standards for “is this ready to ship” — not against other people’s projects. This is a spot on our own scale, NOT a percentile and NOT a claim that you beat some percent of other repos.nittim grades against fixed thresholds, not other repos. This is our own scale — never a percentile.
This audit's size limit was reached before it read the whole repository. The verdict and every score on this report were computed from what it did read — read them as evidence about that sample, not a clean bill of health for the rest.
backend/open_webui/utils/middleware.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/static/swagger-ui/swagger-ui-bundle.js — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/misc.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/model_ids.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/models.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/notifications.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/payload.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/pdf_generator.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/plugin.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/rate_limit.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/redis.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/response.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/sanitize.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/subagents.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/task.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/telemetry/__init__.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/telemetry/constants.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/telemetry/instrumentors.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/telemetry/logs.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/telemetry/metrics.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/telemetry/setup.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/terminals.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/timers.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/tools.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/validate.py — past this audit's file-count or size limit for this run — never selected to be read
backend/open_webui/utils/valves.py — past this audit's file-count or size limit for this run — never selected to be read
backend/start.sh — past this audit's file-count or size limit for this run — never selected to be read
contribution_stats.py — past this audit's file-count or size limit for this run — never selected to be read
docker-cleanup.sh — past this audit's file-count or size limit for this run — never selected to be read
docker-compose-launcher.sh — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.a1111-test.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.amdgpu.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.api.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.data.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.gpu.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.otel.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-compose.playwright.yaml — past this audit's file-count or size limit for this run — never selected to be read
docker-ollama.sh — past this audit's file-count or size limit for this run — never selected to be read
docker-run.sh — past this audit's file-count or size limit for this run — never selected to be read
docker-update-models.sh — past this audit's file-count or size limit for this run — never selected to be read
hatch_build.py — past this audit's file-count or size limit for this run — never selected to be read
i18next-parser.config.ts — past this audit's file-count or size limit for this run — never selected to be read
postcss.config.js — past this audit's file-count or size limit for this run — never selected to be read
scripts/generate-sbom.sh — past this audit's file-count or size limit for this run — never selected to be read
scripts/prepare-pyodide.js — past this audit's file-count or size limit for this run — never selected to be read
src/app.d.ts — past this audit's file-count or size limit for this run — never selected to be read
src/app.html — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/analytics/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/audio/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/automations/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/calendar/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/channels/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/chats/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/configs/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/evaluations/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/files/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/folders/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/groups/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/images/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/knowledge/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/memories/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/models/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/notes/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/notifications/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/ollama/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/openai/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/prompts/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/retrieval/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/skills/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/streaming/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/terminal/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/tools/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/users/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/apis/utils/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/AddConnectionModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/AddFilesPlaceholder.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/AddTerminalServerModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/AddToolServerModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/AutomationModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/ChangelogModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/ImportModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/NotificationToast.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/OnBoarding.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/app/AppSidebar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/AutomationEditor.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/AutomationItemHeaderActions.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/AutomationListHeaderActions.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/AutomationMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/FolderDropdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/ModelDropdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/ScheduleDropdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/automations/TerminalDropdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/calendar/CalendarEventChip.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/calendar/CalendarEventModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/calendar/CalendarSidebar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/calendar/CalendarView.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/calendar/CreateCalendarModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Channel.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/ChannelInfoModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/ChannelInfoModal/AddMembersModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/ChannelInfoModal/UserList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/MessageInput.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/MessageInput/InputMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/MessageInput/MentionList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Messages.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Messages/Message.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Messages/Message/ProfilePreview.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Messages/Message/UserStatus.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Messages/Message/UserStatusLinkPreview.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Navbar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/PinnedMessagesModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/channel/Thread.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Artifacts.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Chat.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ChatControls.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ChatControls/Embeds.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ChatPlaceholder.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ContentRenderer/FloatingButtons.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Controls/Controls.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Controls/Valves.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/EmbeddedChatHistoryDropdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/EmbeddedChatHistoryItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/BulkActionBar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/CellEditor.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/FileCodeEditor.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/FileEntryRow.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/FileNavToolbar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/FilePreview.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/JsonTreeView.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/NotebookView.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/PortList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/PortPreview.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/FileNav/SqliteView.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/AttachWebpageModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/CallOverlay.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/CallOverlay/VideoInputMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/CommandSuggestionList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/AtCommands.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/Emojis.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/Knowledge.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/Models.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/Prompts.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/Skills.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/Commands/SlashCommands.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/FilesOverlay.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputMenu/Chats.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputMenu/Files.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputMenu/Knowledge.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputMenu/Notes.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputMenu/SearchInput.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/InputVariablesModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/IntegrationsMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/QueuedMessageItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/TerminalMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/MessageInput/VoiceRecording.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Citations.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Citations/CitationModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Citations/CitationsModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/CodeBlock.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/CodeExecutionModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/CodeExecutions.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ContentRenderer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Error.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Markdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Markdown/AlertRenderer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Markdown/ColonFenceBlock.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Markdown/ConsecutiveDetailsGroup.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Markdown/Source.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Message.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/MultiResponseMessages.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Name.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/OutputEditView.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ProfileImage.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/RateComment.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage/FollowUps.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage/RegenerateMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage/StatusHistory.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage/StatusHistory/StatusItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage/TaskList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/ResponseMessage/WebSearchResults.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/Skeleton.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/StructuredOutputRenderer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/SubagentResultRow.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/UserMessage.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Messages/structuredOutput.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ModelSelector.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ModelSelector/ModelItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ModelSelector/ModelItemMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ModelSelector/Selector.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Navbar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Overview.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Overview/Flow.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Overview/Node.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Overview/View.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Placeholder.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Placeholder/ChatList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Placeholder/FolderKnowledge.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Placeholder/FolderPlaceholder.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Placeholder/FolderTitle.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/PyodideFileNav.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/About.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Account.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Account/UserProfileImage.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Advanced/AdvancedParams.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/ArchivedChats.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Audio.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Connections.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Connections/Connection.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/DataControls.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/General.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Integrations.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Integrations/Terminals.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Integrations/Terminals/Connection.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Interface.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Interface/ManageFloatingActionButtonsModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Interface/ManageImageCompressionModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Notifications.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Personalization.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Personalization/MemoryModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Shortcuts.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/SyncStatsModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Tools/Connection.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/Usage.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/UserSettingField.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/UserSettingRow.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Settings/UserSettingSection.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/SettingsModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ShareChatModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ShortcutItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/SkillsModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Suggestions.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/TagChatModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/Tags.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/ToolServersModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/chat/XTerminal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/AccessButton.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Badge.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Banner.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/ChatList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Checkbox.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/CodeEditor.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/CodeEditorModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Collapsible.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/ConfirmDialog.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/DragGhost.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Drawer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Dropdown.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/DropdownMenu.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/DropdownOptions.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/DropdownSub.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Emoji.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/EmojiPicker.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/FileItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/FileItemModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Folder.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/FullHeightIframe.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/HotkeyHint.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Image.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/ImagePreview.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/InputModal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Loader.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Marquee.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Modal.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/MultiSelect.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/NativeSelect.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Overlay.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/PDFViewer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Pagination.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/PanzoomContainer.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/AutoCompletion.js — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/Collaboration.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/FormattingButtons.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/Image/image.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/Image/index.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/commands.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/listDragHandlePlugin.js — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/RichTextInput/suggestions.ts — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/SVGPanZoom.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Select.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Selector.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/SensitiveInput.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/SettingsSelect.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Sidebar.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/SlideShow.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Spinner.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/SplitCreateButton.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Switch.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Tags.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Tags/TagInput.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Tags/TagItem.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Tags/TagList.svelte — past this audit's file-count or size limit for this run — never selected to be read
src/lib/components/common/Textarea.svelte — past this audit's file-count or size limit for this run — never selected to be read
and 613 more
The AI-generated likelihood estimate is based on 17% of repository files (196/1109) — read it cautiously. The audited files were selected by priority, but a large portion of the repository was not seen.The AI-written guess is based on only 17% of your project’s files (196/1109) — take it with a grain of salt. The files we checked were the most important ones, but a large part of your project was not seen.The AI-generated likelihood is based on 17% of files (196/1109) — read cautiously. Files were selected by priority; most of the repository wasn’t seen.
Dependency manifests: 1 package root found, 1 scanned; 2 Python manifests read — package list truncated at the vulnerability-lookup limit.
nittim audits a prioritized snapshot of the repository. It’s a strong, evidence-based trust signal — not a substitute for a full security review or penetration test.nittim checks a prioritized copy of your project’s code. It’s a strong, evidence-based signal you can trust — not a replacement for a full security review or a professional break-in test (a “penetration test”).nittim audits a snapshot — not a full security review or penetration test.
Verdict rationale — Why this verdict — Verdict rationale — Open WebUI is a mature, production-deployed open-source project with strong security fundamentals and solid operational maturity (health/readiness checks, graceful shutdown, connection pooling, OTEL/audit observability, structured migrations). It is not a deliberately vulnerable repo. The conditions to clear before/at deployment are supply-chain driven: the OSV scan flags 35 vulnerable dependency versions including a CRITICAL pre-auth code-injection advisory in the default vector database (chromadb 1.5.9) — reachability unverified but high-impact — which should be upgraded and reachability-assessed, plus running the container as root by default and unpinned CI/build references. None of the application-code security fundamentals are broken, so with dependency upgrades and container/CI hardening this is safe to run; hence ready_with_conditions rather than high_risk. IP and authorship lenses did not influence this verdict.
Fix
Add a configurable analytics retention window and surface admin documentation clarifying what per-user data is retained and for how long.
RemediationHow to fix itRemediationMedium (1–3d)Medium (1–3 days)Medium (1–3d)