DEMO INDEX. Everything on this site is derived from three synthetic fixture repositories, indexed by the real engine at build time. No real portfolio, repository name, or line of private code appears here. The full system runs locally against a private index.

Security & code observations

Static observations, ordered by severity then confidence. Each one states how it could be wrong. Nothing here has been executed, proven, or verified against a running system.

These are review leads, not vulnerabilities. This engine has no type checker, no data-flow analysis and no runtime knowledge. It can see that a route mutates and contains no auth call; it cannot see a middleware matcher, a platform rule, or an ownership predicate inside a query. Read the caveat on every row before acting on it.
AllSecurity (5)Anti-patternsDead code (6)Medium+ confidence only
No observations.
Run: yci analyze