Qodo AntiSlop scan found 35 issues across 10 recent PRs

[gvago]

Hey team,

A user recently scanned this repo using Qodo's AntiSlop Scanner. The analysis reviewed 10 recent PRs and found 35 issues, all confirmed to still exist on main.

Here's one example:

NaN size limit bypass in file upload

Severity: action_required | Category: security

uploadFile() uses parseInt() on NEXT_PUBLIC_USER_FILE_SIZE_LIMIT without validating the result. If it parses to NaN then file.size > SIZE_LIMIT is always false and the limit is effectively disabled, allowing unexpectedly large uploads and increasing the chance of server-side memory/CPU issues during embedding processing.

How to validate: Set NEXT_PUBLIC_USER_FILE_SIZE_LIMIT to an empty string or non-numeric value, then upload a large file. The size check will pass regardless of file size.

Agent prompt to fix:

In uploadFile(), add a guard after parseInt(NEXT_PUBLIC_USER_FILE_SIZE_LIMIT) to check for isNaN(). If the parsed value is NaN, fall back to a sensible default limit (e.g. 10MB) instead of silently disabling the check.

---

Other confirmed issues

#	Title	Category	PR
1	Vision parts wrong shape crashes Gemini requests	correctness	#1772
2	Mistral ID rename crashes limits lookup for existing users	correctness	#1628
3	Invalid Anthropic image blocks sent with null data	correctness	#1557
4	Sidebar forces horizontal overflow on all screen sizes	correctness	#1567
5	Workspace defaults not applied to new chats	correctness	#1492
6	Onboarded without API keys, hosted chat throws on empty string	correctness	#1260

28 additional findings (including suspected issues) are available in the full report.

Enjoy!

P.S. Qodo offers free tooling for open-source maintainers: https://www.qodo.ai/solutions/open-source/

cc @mckaywrigley