#731 Code quality scan: 9 findings (C-, 68/100)

Hi @karpathy, an automated scan of this repository surfaced 9 code-quality findings that may be worth a look. Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

Full interactive report

https://repobility.com/scan/1fb3d71a-fce0-4d5e-a586-e047fbb6ac8c/

At a glance

Score: 68/100 • Grade: C-
Scanned: 2026-05-16 09:40 UTC
Lines of code: 1,220
Total findings: 9
Security-tagged: 6
Credential / secret patterns: 1

Top issues, with file & line

These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree.

[high] No test files found Add a test directory (tests/ or tests/) with unit tests for core functionality. Use pytest (Python), Jest (JS/TS), or go test (Go). Start with tests for critical business lo…
[high] [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting. — train.py:102 Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs.
[high] [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files. — data/shakespeare/prepare.py:7 Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
[high] [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files. — data/shakespeare_char/prepare.py:13 Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
[medium] No CI/CD configuration found Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request.

See all 9 findings, with severity filters and AI fix prompts: https://repobility.com/scan/1fb3d71a-fce0-4d5e-a586-e047fbb6ac8c/

What is this? Repobility is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is not a sales pitch — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

To re-run after fixes land: paste your repo URL at repobility.com — fresh scan, free.

Issue filed via the public Repobility report at https://repobility.com/scan/1fb3d71a-fce0-4d5e-a586-e047fbb6ac8c/.