User-friendly AI Interface (Supports Ollama, OpenAI API, ...)
This report summarizes scanner evidence for open-webui/open-webui, a Python project with 154,202 GitHub stars. SynthScan examined 542,686 lines of code across 1098 source files, recording 2768 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 6.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1139 finding(s).
Are imports declared and package/API names verified? 325 finding(s).
Are wrappers, guards, and repeated structures necessary? 1930 finding(s).
Which changes need focused human review? 2768 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2768 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | contribution_stats.py | 16 | except Exception: | CODE |
| MEDIUM | contribution_stats.py | 38 | print('Error: Are you in a git repository?') | CODE |
| LOW | contribution_stats.py | 59 | except Exception: | CODE |
| MEDIUM | backend/open_webui/functions.py | 308 | def stream_content(): | CODE |
| LOW | backend/open_webui/functions.py | 62 | except Exception as e: | CODE |
| LOW | backend/open_webui/functions.py | 99 | except Exception as e: | CODE |
| LOW | backend/open_webui/functions.py | 146 | except Exception as e: | CODE |
| LOW | backend/open_webui/functions.py | 180 | except Exception: | CODE |
| LOW | backend/open_webui/functions.py | 209 | except Exception as e: | CODE |
| LOW | backend/open_webui/functions.py | 265 | except Exception as e: | CODE |
| LOW | backend/open_webui/functions.py | 321 | except Exception as e: | CODE |
| LOW | backend/open_webui/functions.py | 348 | except Exception as e: | CODE |
| LOW | backend/open_webui/tasks.py | 53 | except Exception as e: | CODE |
| LOW | backend/open_webui/tasks.py | 58 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/tasks.py | 79 | except Exception: | CODE |
| LOW | backend/open_webui/tasks.py | 239 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 106 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/config.py | 108 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/config.py | 117 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/config.py | 128 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/config.py | 136 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/config.py | 144 | except Exception as e: | CODE |
| LOW⚡ | backend/open_webui/config.py | 548 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 558 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 568 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 578 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 677 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 687 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 697 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 707 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 721 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 731 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 741 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 758 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 768 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 778 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 788 | except Exception: | CODE |
| LOW | backend/open_webui/config.py | 76 | except Exception as e: | CODE |
| LOW | backend/open_webui/config.py | 221 | except Exception as e: | CODE |
| LOW | backend/open_webui/config.py | 365 | except Exception: | CODE |
| LOW | backend/open_webui/config.py | 383 | except Exception as e: | CODE |
| LOW | backend/open_webui/config.py | 402 | except Exception: | CODE |
| LOW | backend/open_webui/config.py | 592 | except Exception: | CODE |
| LOW⚡ | backend/open_webui/config.py | 1681 | except Exception as e: | STRING |
| LOW⚡ | backend/open_webui/config.py | 1689 | except Exception as e: | STRING |
| LOW⚡ | backend/open_webui/config.py | 1697 | except Exception as e: | STRING |
| LOW⚡ | backend/open_webui/config.py | 1705 | except Exception as e: | STRING |
| LOW⚡ | backend/open_webui/config.py | 1714 | except Exception as e: | STRING |
| LOW | backend/open_webui/config.py | 1184 | except Exception as e: | STRING |
| LOW | backend/open_webui/config.py | 2061 | except Exception as e: | STRING |
| LOW | backend/open_webui/config.py | 2163 | except Exception as e: | STRING |
| LOW | backend/open_webui/config.py | 2186 | except Exception as e: | STRING |
| LOW | backend/open_webui/env.py | 58 | except Exception as exc: | CODE |
| LOW | backend/open_webui/env.py | 69 | except Exception: | CODE |
| LOW | backend/open_webui/env.py | 148 | except Exception: | CODE |
| LOW | backend/open_webui/env.py | 189 | except Exception: | CODE |
| LOW | backend/open_webui/env.py | 454 | except Exception: | CODE |
| LOW | backend/open_webui/env.py | 489 | except Exception: | CODE |
| LOW | backend/open_webui/env.py | 674 | except Exception: | CODE |
| LOW | backend/open_webui/env.py | 693 | except Exception: | CODE |
| 984 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/open_webui/functions.py | 52 | async def get_function_module_by_id(request: Request, pipe_id: str): | CODE |
| LOW | backend/open_webui/functions.py | 153 | async def generate_function_chat_completion(request, form_data, user, models: dict | None = None): | CODE |
| LOW | backend/open_webui/tasks.py | 28 | async def redis_task_command_listener(app): | CODE |
| LOW | backend/open_webui/tasks.py | 226 | async def get_response_streams_by_chat_id(redis, chat_id: str) -> list[dict]: | CODE |
| LOW | backend/open_webui/config.py | 85 | async def import_legacy_config_json(): | CODE |
| LOW | backend/open_webui/env.py | 559 | def _build_ssl_context_from_file(path: str) -> '_ssl.SSLContext | None': | CODE |
| LOW | backend/open_webui/events.py | 854 | async def migrate_legacy_webhook_config() -> list[dict[str, Any]]: | CODE |
| LOW | backend/open_webui/events.py | 1062 | def schedule_webhook_dispatch(app: Any, event: Event) -> None: | CODE |
| LOW | backend/open_webui/events.py | 1074 | def schedule_notification_dispatch(app: Any, event: Event) -> None: | CODE |
| LOW | backend/open_webui/events.py | 1159 | def schedule_event_function_dispatch(app: Any, event: Event, request: Any | None = None) -> None: | CODE |
| LOW | backend/open_webui/events.py | 1205 | async def publish_model_provider_request_failed( | CODE |
| LOW | backend/open_webui/main.py | 2143 | async def list_tasks_by_chat_id_endpoint(request: Request, chat_id: str, user=Depends(get_verified_user)): | CODE |
| LOW | backend/open_webui/main.py | 2161 | async def stop_tasks_by_chat_id_endpoint(request: Request, chat_id: str, user=Depends(get_verified_user)): | CODE |
| LOW | backend/open_webui/main.py | 2595 | async def get_app_latest_release_version(user=Depends(get_verified_user)): | CODE |
| LOW | backend/open_webui/main.py | 516 | async def recurrence_timeout_handler(request: Request, exc: RecurrenceEvaluationTimeout): | STRING |
| LOW | backend/open_webui/main.py | 621 | async def initialize_runtime_config(app: FastAPI): | STRING |
| LOW | backend/open_webui/main.py | 1486 | async def run_initial_title_generation(): | STRING |
| LOW | backend/open_webui/main.py | 1894 | async def resolve_chat_message_tool_call( | STRING |
| LOW | backend/open_webui/main.py | 1943 | async def passthrough_anthropic_messages(request: Request, form_data: dict, user) -> Response | dict: | STRING |
| LOW | backend/open_webui/routers/functions.py | 462 | async def get_function_valves_by_id( | CODE |
| LOW | backend/open_webui/routers/functions.py | 488 | async def get_function_valves_spec_by_id( | CODE |
| LOW | backend/open_webui/routers/functions.py | 518 | async def update_function_valves_by_id( | CODE |
| LOW | backend/open_webui/routers/functions.py | 570 | async def get_function_user_valves_by_id( | CODE |
| LOW | backend/open_webui/routers/functions.py | 591 | async def get_function_user_valves_spec_by_id( | CODE |
| LOW | backend/open_webui/routers/functions.py | 619 | async def update_function_user_valves_by_id( | CODE |
| LOW | backend/open_webui/routers/files.py | 111 | def _matches_configured_mime_type(supported: list[str] | str, content_type: str) -> bool: | CODE |
| LOW | backend/open_webui/routers/files.py | 120 | def _media_supported_for_extraction( | CODE |
| LOW | backend/open_webui/routers/files.py | 689 | async def get_file_data_content_by_id( | CODE |
| LOW | backend/open_webui/routers/files.py | 719 | async def update_file_data_content_by_id( | CODE |
| LOW | backend/open_webui/routers/files.py | 859 | async def get_html_file_content_by_id( | CODE |
| LOW⚡ | backend/open_webui/routers/terminals.py | 257 | async def _resolve_authenticated_connection(ws: WebSocket, server_id: str): | CODE |
| LOW | backend/open_webui/routers/tasks.py | 80 | async def get_task_model_generation_config(default_model_id: str, models) -> tuple[str, dict]: | CODE |
| LOW | backend/open_webui/routers/configs.py | 327 | async def get_terminal_servers_config(request: Request, user=Depends(get_admin_user)): | CODE |
| LOW | backend/open_webui/routers/configs.py | 332 | async def set_terminal_servers_config( | CODE |
| LOW | backend/open_webui/routers/configs.py | 356 | async def verify_terminal_server_connection( | CODE |
| LOW | backend/open_webui/routers/configs.py | 431 | async def put_terminal_server_policy( | CODE |
| LOW | backend/open_webui/routers/configs.py | 468 | async def put_terminal_server_lifecycle( | CODE |
| LOW | backend/open_webui/routers/configs.py | 505 | async def refresh_terminal_server_terminals( | CODE |
| LOW | backend/open_webui/routers/configs.py | 552 | async def verify_tool_servers_config(request: Request, form_data: ToolServerConnection, user=Depends(get_admin_user)): | CODE |
| LOW | backend/open_webui/routers/configs.py | 705 | async def get_code_execution_config(request: Request, user=Depends(get_admin_user)): | CODE |
| LOW | backend/open_webui/routers/configs.py | 710 | async def set_code_execution_config( | CODE |
| LOW | backend/open_webui/routers/models.py | 60 | def add_chat_variables_schema(model_dict: dict) -> dict: | CODE |
| LOW | backend/open_webui/routers/models.py | 70 | def _safe_static_redirect_path(url: str) -> str | None: | CODE |
| LOW | backend/open_webui/routers/models.py | 126 | async def _verify_knowledge_file_access( | CODE |
| LOW | backend/open_webui/routers/models.py | 1036 | async def update_model_access_by_id( | CODE |
| LOW | backend/open_webui/routers/skills.py | 358 | async def update_skill_access_by_id( | CODE |
| LOW | backend/open_webui/routers/users.py | 373 | def _build_cumulative_heatmap(heatmap: list[dict]) -> list[dict]: | CODE |
| LOW | backend/open_webui/routers/users.py | 412 | async def get_default_user_permissions(request: Request, user=Depends(get_admin_user)): | CODE |
| LOW | backend/open_webui/routers/users.py | 425 | async def update_default_user_permissions(request: Request, form_data: UserPermissions, user=Depends(get_admin_user)): | CODE |
| LOW | backend/open_webui/routers/users.py | 439 | async def get_default_user_permissions_defaults(user=Depends(get_admin_user)): | CODE |
| LOW | backend/open_webui/routers/users.py | 458 | async def get_user_settings_by_session_user( | CODE |
| LOW | backend/open_webui/routers/users.py | 483 | async def update_user_settings_by_session_user( | CODE |
| LOW | backend/open_webui/routers/users.py | 571 | async def get_user_status_by_session_user( | CODE |
| LOW | backend/open_webui/routers/users.py | 590 | async def update_user_status_by_session_user( | CODE |
| LOW | backend/open_webui/routers/users.py | 623 | async def get_user_info_by_session_user(user=Depends(get_verified_user)): | CODE |
| LOW | backend/open_webui/routers/users.py | 642 | async def get_user_variables_by_session_user(user=Depends(get_verified_user)): | CODE |
| LOW | backend/open_webui/routers/users.py | 652 | async def update_user_variables_by_session_user( | CODE |
| LOW | backend/open_webui/routers/users.py | 680 | async def update_user_info_by_session_user( # PATCH-style merge | CODE |
| LOW | backend/open_webui/routers/users.py | 707 | async def get_user_usage_by_session_user( | CODE |
| LOW | backend/open_webui/routers/users.py | 836 | async def get_user_oauth_sessions_by_id( | CODE |
| 544 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker-update-models.sh | 4 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-update-models.sh | 6 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-ollama.sh | 4 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-ollama.sh | 6 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-cleanup.sh | 4 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-cleanup.sh | 6 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-run.sh | 4 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-run.sh | 6 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker-compose-launcher.sh | 4 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker-compose-launcher.sh | 7 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker-compose-launcher.sh | 16 | # ── GPU detection ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 35 | # ── Argument helpers ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 69 | # ── Defaults ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 82 | # ── Parse arguments ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 100 | # ── Drop mode ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 108 | # ── Build compose command ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 144 | # ── Confirmation ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose-launcher.sh | 164 | # ── Launch ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | backend/start.sh | 4 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | backend/start.sh | 8 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | backend/start.sh | 19 | # ── Playwright browser installation (if configured) ────────────────────────── | COMMENT |
| MEDIUM | backend/start.sh | 29 | # ── Secret key setup ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | backend/start.sh | 52 | # ── Ollama (bundled Docker image) ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | backend/start.sh | 59 | # ── CUDA library paths ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | backend/start.sh | 66 | # ── HuggingFace Space deployment ───────────────────────────────────────────── | COMMENT |
| MEDIUM | backend/start.sh | 96 | # ── Launch uvicorn ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | backend/open_webui/tasks.py | 83 | ### ------------------------------ | COMMENT |
| MEDIUM⚡ | backend/open_webui/tasks.py | 85 | ### ------------------------------ | COMMENT |
| MEDIUM⚡ | backend/open_webui/routers/terminals.py | 252 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | backend/open_webui/routers/terminals.py | 254 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 289 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 291 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 365 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 367 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 513 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 515 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 628 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 630 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 3693 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 3695 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 4088 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 4090 | # ============================================================================= | COMMENT |
| MEDIUM | backend/open_webui/tools/builtin.py | 126 | # ============================================================================= | COMMENT |
| MEDIUM | backend/open_webui/tools/builtin.py | 128 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 795 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 797 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 1122 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 1124 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 1507 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 1509 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 1675 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 1677 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 2041 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 2043 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 3477 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 3479 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 3548 | # ============================================================================= | STRING |
| MEDIUM⚡ | backend/open_webui/tools/builtin.py | 3550 | # ============================================================================= | STRING |
| MEDIUM | backend/open_webui/tools/builtin.py | 1758 | # ============================================================================= | STRING |
| MEDIUM | backend/open_webui/tools/builtin.py | 1760 | # ============================================================================= | STRING |
| 93 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | backend/open_webui/functions.py | 180 | except Exception: | CODE |
| HIGH | backend/open_webui/config.py | 108 | except Exception as e: | CODE |
| HIGH | backend/open_webui/config.py | 365 | except Exception: | CODE |
| HIGH | backend/open_webui/config.py | 106 | except Exception as e: | CODE |
| HIGH | backend/open_webui/env.py | 69 | except Exception: | CODE |
| HIGH | backend/open_webui/main.py | 1771 | except Exception: | CODE |
| HIGH | backend/open_webui/main.py | 1683 | except Exception: | CODE |
| HIGH | backend/open_webui/main.py | 1712 | except Exception: | CODE |
| HIGH | backend/open_webui/main.py | 1769 | except asyncio.CancelledError: | CODE |
| HIGH | backend/open_webui/routers/terminals.py | 470 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/terminals.py | 412 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/terminals.py | 428 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/configs.py | 258 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/configs.py | 385 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/configs.py | 395 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/configs.py | 659 | except Exception as e: | CODE |
| HIGH | backend/open_webui/routers/configs.py | 615 | except Exception as e: | CODE |
| HIGH | backend/open_webui/routers/models.py | 857 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/users.py | 886 | except Exception as e: | CODE |
| HIGH | backend/open_webui/routers/auths.py | 988 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/auths.py | 744 | except Exception as e: | CODE |
| HIGH | backend/open_webui/routers/openai.py | 912 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/retrieval.py | 1961 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/retrieval.py | 2290 | except ValueError: | CODE |
| HIGH | backend/open_webui/routers/chats.py | 402 | except Exception as e: | CODE |
| HIGH | backend/open_webui/routers/audio.py | 1183 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/channels.py | 1867 | except Exception as e: | CODE |
| HIGH | backend/open_webui/routers/knowledge.py | 2009 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 298 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 352 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 402 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 437 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 484 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 524 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 567 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 114 | except Exception: | CODE |
| HIGH | backend/open_webui/routers/pipelines.py | 180 | except Exception: | CODE |
| HIGH | backend/open_webui/tools/builtin.py | 1467 | except Exception: | CODE |
| HIGH | backend/open_webui/tools/builtin.py | 4106 | except Exception: | CODE |
| HIGH | backend/open_webui/tools/builtin.py | 188 | except Exception: | CODE |
| HIGH | backend/open_webui/tools/builtin.py | 251 | except Exception: | CODE |
| HIGH | backend/open_webui/tools/builtin.py | 280 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/auth.py | 307 | except (ValueError, TypeError): | CODE |
| HIGH | backend/open_webui/utils/misc.py | 942 | except (TypeError, ValueError, UnicodeEncodeError): | CODE |
| HIGH | backend/open_webui/utils/task.py | 56 | except Exception as e: | CODE |
| HIGH | backend/open_webui/utils/task.py | 69 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/payload.py | 110 | except JSONCodec.JSONDecodeError: | CODE |
| HIGH | backend/open_webui/utils/payload.py | 175 | except JSONCodec.JSONDecodeError: | CODE |
| HIGH | backend/open_webui/utils/payload.py | 209 | except JSONCodec.JSONDecodeError: | CODE |
| HIGH | backend/open_webui/utils/anthropic.py | 76 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/anthropic.py | 895 | except (JSONCodec.JSONDecodeError, ValueError): | CODE |
| HIGH | backend/open_webui/utils/filter.py | 95 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 431 | except (JSONCodec.JSONDecodeError, TypeError): | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 2535 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 2088 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 3176 | except Exception: | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 4776 | except Exception as e: | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 3936 | except Exception as e: | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 6635 | except (asyncio.CancelledError, Exception): | CODE |
| HIGH | backend/open_webui/utils/middleware.py | 4035 | except Exception as e: | CODE |
| 26 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 7 | CODE | |
| LOW | backend/open_webui/functions.py | 18 | CODE | |
| LOW | backend/open_webui/functions.py | 21 | CODE | |
| LOW | backend/open_webui/functions.py | 32 | CODE | |
| LOW | backend/open_webui/functions.py | 32 | CODE | |
| LOW | backend/open_webui/functions.py | 32 | CODE | |
| LOW | backend/open_webui/functions.py | 43 | CODE | |
| LOW | backend/open_webui/config.py | 1 | CODE | |
| LOW | backend/open_webui/config.py | 3 | CODE | |
| LOW | backend/open_webui/config.py | 9 | CODE | |
| LOW | backend/open_webui/config.py | 11 | CODE | |
| LOW | backend/open_webui/config.py | 11 | CODE | |
| LOW | backend/open_webui/config.py | 14 | CODE | |
| LOW | backend/open_webui/config.py | 19 | CODE | |
| LOW | backend/open_webui/config.py | 19 | CODE | |
| LOW | backend/open_webui/config.py | 19 | CODE | |
| LOW | backend/open_webui/config.py | 19 | CODE | |
| LOW | backend/open_webui/config.py | 19 | CODE | |
| LOW | backend/open_webui/events.py | 1 | CODE | |
| LOW | backend/open_webui/constants.py | 1 | CODE | |
| LOW | backend/open_webui/__init__.py | 76 | CODE | |
| LOW | backend/open_webui/main.py | 1 | CODE | |
| LOW | backend/open_webui/routers/functions.py | 1 | CODE | |
| LOW | backend/open_webui/routers/functions.py | 4 | CODE | |
| LOW | backend/open_webui/routers/functions.py | 6 | CODE | |
| LOW | backend/open_webui/routers/functions.py | 7 | CODE | |
| LOW | backend/open_webui/routers/files.py | 30 | CODE | |
| LOW | backend/open_webui/routers/files.py | 39 | CODE | |
| LOW | backend/open_webui/routers/tasks.py | 2 | CODE | |
| LOW | backend/open_webui/routers/tasks.py | 5 | CODE | |
| LOW | backend/open_webui/routers/tasks.py | 6 | CODE | |
| LOW | backend/open_webui/routers/tasks.py | 7 | CODE | |
| LOW | backend/open_webui/routers/configs.py | 1 | CODE | |
| LOW | backend/open_webui/routers/configs.py | 4 | CODE | |
| LOW | backend/open_webui/routers/configs.py | 13 | CODE | |
| LOW | backend/open_webui/routers/configs.py | 17 | CODE | |
| LOW | backend/open_webui/routers/models.py | 1 | CODE | |
| LOW | backend/open_webui/routers/models.py | 8 | CODE | |
| LOW | backend/open_webui/routers/models.py | 34 | CODE | |
| LOW | backend/open_webui/routers/skills.py | 23 | CODE | |
| LOW | backend/open_webui/routers/users.py | 1 | CODE | |
| LOW | backend/open_webui/routers/users.py | 23 | CODE | |
| LOW | backend/open_webui/routers/tools.py | 1 | CODE | |
| LOW | backend/open_webui/routers/tools.py | 6 | CODE | |
| LOW | backend/open_webui/routers/tools.py | 19 | CODE | |
| LOW | backend/open_webui/routers/groups.py | 2 | CODE | |
| LOW | backend/open_webui/routers/groups.py | 3 | CODE | |
| LOW | backend/open_webui/routers/groups.py | 7 | CODE | |
| LOW | backend/open_webui/routers/evaluations.py | 13 | CODE | |
| LOW | backend/open_webui/routers/evaluations.py | 23 | CODE | |
| LOW | backend/open_webui/routers/evaluations.py | 23 | CODE | |
| LOW | backend/open_webui/routers/notes.py | 5 | CODE | |
| LOW | backend/open_webui/routers/notes.py | 6 | CODE | |
| LOW | backend/open_webui/routers/notes.py | 6 | CODE | |
| 259 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | contribution_stats.py | 42 | CODE | |
| LOW | backend/open_webui/functions.py | 71 | CODE | |
| LOW | backend/open_webui/tasks.py | 28 | CODE | |
| LOW | backend/open_webui/main.py | 621 | CODE | |
| LOW | backend/open_webui/main.py | 957 | CODE | |
| LOW | backend/open_webui/main.py | 1110 | CODE | |
| LOW | backend/open_webui/main.py | 2161 | CODE | |
| LOW | backend/open_webui/main.py | 2677 | CODE | |
| LOW | backend/open_webui/main.py | 1647 | CODE | |
| LOW | backend/open_webui/routers/functions.py | 164 | CODE | |
| LOW | backend/open_webui/routers/files.py | 128 | CODE | |
| LOW | backend/open_webui/routers/files.py | 625 | CODE | |
| LOW | backend/open_webui/routers/files.py | 719 | CODE | |
| LOW | backend/open_webui/routers/files.py | 796 | CODE | |
| LOW | backend/open_webui/routers/files.py | 1014 | CODE | |
| LOW | backend/open_webui/routers/files.py | 137 | CODE | |
| LOW | backend/open_webui/routers/files.py | 646 | CODE | |
| LOW | backend/open_webui/routers/terminals.py | 110 | CODE | |
| LOW | backend/open_webui/routers/terminals.py | 323 | CODE | |
| LOW | backend/open_webui/routers/terminals.py | 401 | CODE | |
| LOW | backend/open_webui/routers/terminals.py | 415 | CODE | |
| LOW | backend/open_webui/routers/configs.py | 241 | CODE | |
| LOW | backend/open_webui/routers/configs.py | 552 | CODE | |
| LOW | backend/open_webui/routers/models.py | 382 | CODE | |
| LOW | backend/open_webui/routers/models.py | 442 | CODE | |
| LOW | backend/open_webui/routers/models.py | 776 | CODE | |
| LOW | backend/open_webui/routers/users.py | 855 | CODE | |
| LOW | backend/open_webui/routers/users.py | 916 | CODE | |
| LOW | backend/open_webui/routers/auths.py | 426 | CODE | |
| LOW | backend/open_webui/routers/auths.py | 476 | CODE | |
| LOW | backend/open_webui/routers/auths.py | 718 | CODE | |
| LOW | backend/open_webui/routers/auths.py | 956 | CODE | |
| LOW | backend/open_webui/routers/auths.py | 1244 | CODE | |
| LOW | backend/open_webui/routers/calendar.py | 144 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 155 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 601 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 676 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 796 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 866 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1067 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1276 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1436 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1487 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1757 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1884 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 1995 | CODE | |
| LOW | backend/open_webui/routers/openai.py | 816 | CODE | |
| LOW | backend/open_webui/routers/scim.py | 48 | CODE | |
| LOW | backend/open_webui/routers/scim.py | 660 | CODE | |
| LOW | backend/open_webui/routers/scim.py | 740 | CODE | |
| LOW | backend/open_webui/routers/scim.py | 1079 | CODE | |
| LOW | backend/open_webui/routers/retrieval.py | 172 | CODE | |
| LOW | backend/open_webui/routers/retrieval.py | 1705 | CODE | |
| LOW | backend/open_webui/routers/retrieval.py | 1926 | CODE | |
| LOW | backend/open_webui/routers/retrieval.py | 2511 | CODE | |
| LOW | backend/open_webui/routers/retrieval.py | 2883 | CODE | |
| LOW | backend/open_webui/routers/retrieval.py | 3288 | CODE | |
| LOW | backend/open_webui/routers/images.py | 202 | CODE | |
| LOW | backend/open_webui/routers/images.py | 363 | CODE | |
| LOW | backend/open_webui/routers/images.py | 596 | CODE | |
| 255 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/open_webui/functions.py | 86 | # Check if function is a manifold | COMMENT |
| LOW | backend/open_webui/functions.py | 229 | # Check if tool_ids is None | COMMENT |
| LOW | backend/open_webui/config.py | 2117 | # Check if the scheme is either http or https, or a custom scheme | STRING |
| LOW | backend/open_webui/env.py | 234 | # Check if the data directory exists in the package directory | COMMENT |
| LOW | backend/open_webui/env.py | 263 | # Check if the file exists | COMMENT |
| LOW | backend/open_webui/main.py | 1149 | # Check if user has access to the model | STRING |
| LOW | backend/open_webui/routers/files.py | 815 | # Check if the file already exists in the cache | COMMENT |
| LOW | backend/open_webui/routers/files.py | 882 | # Check if the file already exists in the cache | COMMENT |
| LOW | backend/open_webui/routers/files.py | 931 | # Check if the file already exists in the cache | COMMENT |
| LOW | backend/open_webui/routers/auths.py | 1291 | # Check if the input string matches the pattern | COMMENT |
| LOW | backend/open_webui/routers/auths.py | 1652 | # Check if provider is configured | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 621 | # Check if the file already exists in the cache | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 1539 | # Check if model is already in app state cache to avoid expensive get_all_models() call | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 1568 | # Check if model is a reasoning model that needs special handling | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 1670 | # Check if response is SSE | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 1774 | # Check if model is already in app state cache to avoid expensive get_all_models() call | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 1949 | # Check if response is SSE | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 2071 | # Check if response is SSE | COMMENT |
| LOW | backend/open_webui/routers/scim.py | 259 | # Check if SCIM is enabled | COMMENT |
| LOW | backend/open_webui/routers/retrieval.py | 1734 | # Check if entries with the same hash (metadata.hash) already exist | COMMENT |
| LOW | backend/open_webui/routers/retrieval.py | 1744 | # Check if the existing document belongs to the same file | COMMENT |
| LOW | backend/open_webui/routers/retrieval.py | 3291 | # Check if the directory exists | COMMENT |
| LOW | backend/open_webui/routers/chats.py | 617 | # Check if the user has permission to share/export chats | COMMENT |
| LOW | backend/open_webui/routers/chats.py | 666 | # Check if the user has permission to share/export chats | COMMENT |
| LOW | backend/open_webui/routers/channels.py | 1847 | # Check if it's url or base64 | COMMENT |
| LOW | backend/open_webui/routers/folders.py | 165 | # Check if creating a subfolder in a shared folder | COMMENT |
| LOW | backend/open_webui/routers/folders.py | 351 | # Check if folder with same name exists | COMMENT |
| LOW | backend/open_webui/routers/pipelines.py | 233 | # Check if the uploaded file is a python file | COMMENT |
| LOW | backend/open_webui/tools/builtin.py | 1926 | # Check if user has access to the channel | STRING |
| LOW | backend/open_webui/utils/files.py | 228 | # Check if the file already exists in the cache | COMMENT |
| LOW | backend/open_webui/utils/task.py | 19 | # Check if the user has a custom task model and use that model | COMMENT |
| LOW | backend/open_webui/utils/tools.py | 1493 | # Check if URL ends with .yaml or .yml to determine format | COMMENT |
| LOW⚡ | backend/open_webui/utils/payload.py | 328 | # Iterate through the list of content items | COMMENT |
| LOW⚡ | backend/open_webui/utils/payload.py | 330 | # Check if it's a text type | COMMENT |
| LOW⚡ | backend/open_webui/utils/payload.py | 334 | # Check if it's an image URL type | COMMENT |
| LOW | backend/open_webui/utils/payload.py | 296 | # Check if the content is a string (just a simple message) | COMMENT |
| LOW | backend/open_webui/utils/chat.py | 198 | # Check if user has access to the model | COMMENT |
| LOW⚡ | backend/open_webui/utils/middleware.py | 1624 | # Check if generated queries are empty | COMMENT |
| LOW⚡ | backend/open_webui/utils/middleware.py | 1628 | # Check if queries are not found | COMMENT |
| LOW⚡ | backend/open_webui/utils/middleware.py | 3206 | # Check if file context extraction is enabled for this model (default True) | COMMENT |
| LOW⚡ | backend/open_webui/utils/middleware.py | 5840 | # Check if citations are enabled for this model | COMMENT |
| LOW | backend/open_webui/utils/middleware.py | 2057 | # Check if all files are in full context mode | COMMENT |
| LOW | backend/open_webui/utils/middleware.py | 2574 | # Check if the request has chat_id and is inside of a folder | COMMENT |
| LOW | backend/open_webui/utils/middleware.py | 5292 | # Check if the tool call already exists | COMMENT |
| LOW | backend/open_webui/utils/middleware.py | 5581 | # Check if we're inside a tag-based block | COMMENT |
| LOW | backend/open_webui/utils/oauth.py | 2010 | # Check if the user exists | COMMENT |
| LOW | backend/open_webui/utils/oauth.py | 2015 | # Check if the user exists by email | COMMENT |
| LOW | backend/open_webui/utils/oauth.py | 2096 | # Check if an existing user with the same email already exists | COMMENT |
| LOW | backend/open_webui/utils/access_control/files.py | 45 | # Check if the file is associated with any knowledge bases the user has access to. | COMMENT |
| LOW | backend/open_webui/utils/access_control/files.py | 66 | # Check if the file is associated with any channels the user has access to | COMMENT |
| LOW | backend/open_webui/utils/access_control/files.py | 71 | # Check if the file is associated with any chats the user has access to | COMMENT |
| LOW | backend/open_webui/utils/access_control/files.py | 85 | # Check if the file is directly attached to a shared workspace model (per the ownership | COMMENT |
| LOW | backend/open_webui/utils/access_control/__init__.py | 256 | # Check if user can share publicly | COMMENT |
| LOW⚡ | backend/open_webui/models/functions.py | 364 | # Check if user has "functions" and "valves" settings | COMMENT |
| LOW⚡ | backend/open_webui/models/functions.py | 382 | # Check if user has "functions" and "valves" settings | COMMENT |
| LOW⚡ | backend/open_webui/models/tools.py | 277 | # Check if user has "tools" and "valves" settings | COMMENT |
| LOW⚡ | backend/open_webui/models/tools.py | 295 | # Check if user has "tools" and "valves" settings | COMMENT |
| LOW | backend/open_webui/models/notes.py | 379 | # Check if already pinned | COMMENT |
| LOW | backend/open_webui/models/prompts.py | 433 | # Check if content changed to decide on history creation | COMMENT |
| LOW | backend/open_webui/models/prompts.py | 499 | # Check if content changed to decide on history creation | COMMENT |
| 13 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | backend/open_webui/config.py | 524 | # this uses the model defined in the Dockerfile ENV variable. If you dont use docker or docker based deployments such as | COMMENT |
| MEDIUM | backend/open_webui/config.py | 838 | # Information Retrieval (RAG) | COMMENT |
| MEDIUM | backend/open_webui/config.py | 867 | # RAG Content Extraction | COMMENT |
| MEDIUM | backend/open_webui/routers/files.py | 755 | # collection and RAG returns both stale and current data (#20558). | COMMENT |
| MEDIUM | backend/open_webui/routers/openai.py | 1367 | # separately via metadata.files/RAG and must not be converted here. | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 144 | # not into hallucination, but deliver us from noise. | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 524 | # unloads current internal embedding model and clears VRAM cache | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 635 | # RAG settings | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 874 | # RAG settings | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 964 | # RAG settings | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 1402 | # RAG settings | COMMENT |
| MEDIUM | backend/open_webui/routers/memories.py | 359 | # same RELEVANCE_THRESHOLD used by RAG ensures only genuinely matching | COMMENT |
| MEDIUM | backend/open_webui/routers/channels.py | 1126 | # tools, filters, RAG — everything. The pipeline runs as | COMMENT |
| MEDIUM | backend/open_webui/utils/headers.py | 120 | # UA from the live request; fall back to metadata for detached RAG/tool calls. | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 3216 | # Save the pre-RAG message state so the native tool call loop can | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 3218 | # than a snapshot that already has the RAG template baked in. | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 5845 | # Use the pre-RAG system content captured before the | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 5847 | # This ensures restore truly undoes the RAG template. | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 6169 | # Restoring to pre-RAG original prevents duplicating | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 6170 | # the RAG template across file and tool sources. | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 6173 | # Restore pre-RAG message state before re-applying | COMMENT |
| MEDIUM⚡ | backend/open_webui/utils/middleware.py | 6174 | # to prevent RAG template duplication. | COMMENT |
| MEDIUM | backend/open_webui/utils/middleware.py | 2600 | # Native FC: skip RAG injection, builtin tools | COMMENT |
| MEDIUM | backend/open_webui/utils/middleware.py | 2707 | # Skip forced RAG web search when native FC is enabled - model can use web_search tool | COMMENT |
| MEDIUM | backend/open_webui/retrieval/utils.py | 1131 | # Deferred so a missing local model degrades RAG instead of crashing boot. | COMMENT |
| MEDIUM | …c/lib/components/admin/Functions/FunctionEditor.svelte | 295 | # This is where you can add your custom pipelines like RAG. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ckend/open_webui/retrieval/vector/dbs/elasticsearch.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | …open_webui/retrieval/vector/dbs/qdrant_multitenancy.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/milvus.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/pinecone.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/opensearch.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/qdrant.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/s3vector.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/opengauss.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | backend/open_webui/retrieval/vector/dbs/weaviate.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | …open_webui/retrieval/vector/dbs/milvus_multitenancy.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| HIGH | …kend/open_webui/retrieval/vector/dbs/mariadb_vector.py | 0 | note: this vector database integration is community-supported and maintained on a best-effort basis. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | backend/open_webui/tasks.py | 162 | task = asyncio.create_task(coroutine) # Create the task | CODE |
| MEDIUM | backend/open_webui/main.py | 411 | # Creating a mock request object to pass to get_all_models | STRING |
| MEDIUM | backend/open_webui/routers/files.py | 944 | # Create a generator that encodes the file content | COMMENT |
| MEDIUM | backend/open_webui/routers/retrieval.py | 3011 | # Create a single collection for all documents | COMMENT |
| MEDIUM | backend/open_webui/routers/chats.py | 1973 | # Create a new share | COMMENT |
| MEDIUM | backend/open_webui/internal/db.py | 297 | # Create a custom creator function that uses sqlcipher3 | COMMENT |
| MEDIUM | backend/open_webui/utils/misc.py | 838 | # Create a SHA256 hash of the final string | COMMENT |
| MEDIUM | backend/open_webui/utils/misc.py | 860 | # Create a new SHA-256 hash object | COMMENT |
| MEDIUM | backend/open_webui/utils/chat.py | 99 | # Define a generator to stream responses | COMMENT |
| MEDIUM | backend/open_webui/utils/chat.py | 120 | # Define a background task to run the event generator | COMMENT |
| MEDIUM | backend/open_webui/utils/plugin.py | 231 | # Create a temporary file and use it to define `__file__` so | COMMENT |
| MEDIUM | backend/open_webui/utils/plugin.py | 281 | # Create a temporary file and use it to define `__file__` so | COMMENT |
| MEDIUM | backend/open_webui/utils/middleware.py | 4468 | task_id = str(uuid4()) # Create a unique task ID. | CODE |
| MEDIUM | backend/open_webui/models/functions.py | 203 | # Create a dict for O(1) lookup | COMMENT |
| MEDIUM | backend/open_webui/retrieval/utils.py | 629 | # Create the output dictionary | COMMENT |
| MEDIUM | backend/open_webui/retrieval/vector/dbs/pinecone.py | 420 | # Create a zero vector for the dimension as Pinecone requires a vector | COMMENT |
| MEDIUM | backend/open_webui/retrieval/vector/dbs/pgvector.py | 149 | # Create the tables if they do not exist | STRING |
| MEDIUM | backend/open_webui/retrieval/vector/dbs/pgvector.py | 465 | # Create the values for query vectors | STRING |
| MEDIUM | backend/open_webui/retrieval/vector/dbs/oracle23ai.py | 111 | # Create the appropriate connection pool based on DB type | COMMENT |
| MEDIUM | …c/lib/components/admin/Functions/FunctionEditor.svelte | 92 | # This function is the pre-processor for the API where various checks on the input can be performed. | STRING |
| MEDIUM | …c/lib/components/admin/Functions/FunctionEditor.svelte | 119 | # This function is the post-processor for the API, which can be used to modify the response | STRING |
| MEDIUM | …c/lib/components/admin/Functions/FunctionEditor.svelte | 203 | # This function is the pre-processor for the API where various checks on the input can be performed. | STRING |
| MEDIUM | …c/lib/components/admin/Functions/FunctionEditor.svelte | 228 | # This function is the post-processor for the API, which can be used to modify the response | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 187 | # Step 1: Request presigned upload URL | COMMENT |
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 190 | # Step 2: Upload file to presigned URL | COMMENT |
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 193 | # Step 3: Poll for results | COMMENT |
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 196 | # Step 4: Download and extract markdown from ZIP | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 817 | // Step 1: Safely extract the response string | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 820 | // Step 2: Attempt to fix common JSON format issues like single quotes | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 823 | // Step 3: Find the relevant JSON block within the response | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 827 | // Step 4: Check if we found a valid JSON block (with both `{` and `}`) | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 831 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 834 | // Step 6: If there's a "tags" key, return the tags array; otherwise, return an empty array | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 889 | // Step 1: Safely extract the response string | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 892 | // Step 2: Attempt to fix common JSON format issues like single quotes | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 895 | // Step 3: Find the relevant JSON block within the response | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 899 | // Step 4: Check if we found a valid JSON block (with both `{` and `}`) | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 903 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 906 | // Step 6: If there's a "tags" key, return the tags array; otherwise, return an empty array | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1012 | // Step 1: Safely extract the response string | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1022 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1025 | // Step 6: If there's a "queries" key, return the queries array; otherwise, return an empty array | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1095 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1098 | // Step 6: If there's a "queries" key, return the queries array; otherwise, return an empty array | COMMENT |
| LOW | src/lib/components/notes/NoteEditor.svelte | 405 | // Step 1: Safely extract the response string | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 187 | # Step 1: Request presigned upload URL | COMMENT |
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 190 | # Step 2: Upload file to presigned URL | COMMENT |
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 193 | # Step 3: Poll for results | COMMENT |
| LOW⚡ | backend/open_webui/retrieval/loaders/mineru.py | 196 | # Step 4: Download and extract markdown from ZIP | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 817 | // Step 1: Safely extract the response string | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 820 | // Step 2: Attempt to fix common JSON format issues like single quotes | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 823 | // Step 3: Find the relevant JSON block within the response | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 827 | // Step 4: Check if we found a valid JSON block (with both `{` and `}`) | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 831 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 834 | // Step 6: If there's a "tags" key, return the tags array; otherwise, return an empty array | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 889 | // Step 1: Safely extract the response string | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 892 | // Step 2: Attempt to fix common JSON format issues like single quotes | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 895 | // Step 3: Find the relevant JSON block within the response | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 899 | // Step 4: Check if we found a valid JSON block (with both `{` and `}`) | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 903 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 906 | // Step 6: If there's a "tags" key, return the tags array; otherwise, return an empty array | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1012 | // Step 1: Safely extract the response string | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1022 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1025 | // Step 6: If there's a "queries" key, return the queries array; otherwise, return an empty array | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1095 | // Step 5: Parse the JSON block | COMMENT |
| LOW⚡ | src/lib/apis/index.ts | 1098 | // Step 6: If there's a "queries" key, return the queries array; otherwise, return an empty array | COMMENT |
| LOW | src/lib/components/notes/NoteEditor.svelte | 405 | // Step 1: Safely extract the response string | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/start.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | backend/open_webui/env.py | 421 | except ValueError: | COMMENT |
| LOW | backend/open_webui/env.py | 941 | COMMENT | |
| LOW | backend/open_webui/alembic.ini | 1 | # A generic, single database configuration. | COMMENT |
| LOW | backend/open_webui/alembic.ini | 21 | # timezone = | COMMENT |
| LOW | backend/open_webui/alembic.ini | 41 | COMMENT | |
| LOW | backend/open_webui/alembic.ini | 61 | # sqlalchemy.url = REPLACE_WITH_DATABASE_URL | COMMENT |
| LOW | backend/open_webui/main.py | 581 | COMMENT | |
| LOW | backend/open_webui/main.py | 601 | ######################################## | COMMENT |
| LOW | backend/open_webui/main.py | 781 | ######################################## | COMMENT |
| LOW | backend/open_webui/main.py | 1721 | detail=error_detail, | COMMENT |
| LOW | backend/open_webui/routers/evaluations.py | 41 | return {field: values[storage_key] for field, storage_key in key_map.items() if storage_key in values} | COMMENT |
| LOW | backend/open_webui/routers/openai.py | 61 | COMMENT | |
| LOW | backend/open_webui/internal/db.py | 41 | COMMENT | |
| LOW | backend/open_webui/internal/db.py | 441 | # ASYNC ENGINE (used for ALL runtime database operations) | COMMENT |
| LOW | backend/open_webui/retrieval/utils.py | 261 | # YoutubeLoader, which uses youtube-transcript-api and never needs the | COMMENT |
| LOW | scripts/generate-sbom.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | src/lib/apis/ollama/index.ts | 521 | // }, | COMMENT |
| LOW | src/lib/components/chat/MessageInput.svelte | 701 | let isComposing = false; | COMMENT |
| LOW | …/lib/components/common/RichTextInput/AutoCompletion.js | 141 | const { $head } = selection; | COMMENT |
| LOW | …/lib/components/common/RichTextInput/AutoCompletion.js | 241 | }, | COMMENT |
| LOW | src/routes/+layout.js | 1 | // if you want to generate a static html file | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | backend/open_webui/storage/provider.py | 33 | from azure.core.exceptions import ResourceNotFoundError | CODE |
| CRITICAL | backend/open_webui/retrieval/vector/dbs/weaviate.py | 129 | vector_config=weaviate.classes.config.Configure.Vectors.self_provided(), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/open_webui/routers/models.py | 167 | CODE | |
| LOW | backend/open_webui/routers/evaluations.py | 422 | CODE | |
| LOW | backend/open_webui/routers/notes.py | 149 | CODE | |
| LOW | backend/open_webui/routers/prompts.py | 72 | CODE | |
| LOW | backend/open_webui/routers/analytics.py | 126 | CODE | |
| LOW | backend/open_webui/routers/analytics.py | 286 | CODE | |
| LOW | backend/open_webui/routers/knowledge.py | 222 | CODE | |
| LOW | backend/open_webui/routers/knowledge.py | 1352 | CODE | |
| LOW | backend/open_webui/routers/ollama.py | 97 | CODE | |
| LOW | backend/open_webui/tools/builtin.py | 1680 | CODE | |
| LOW | backend/open_webui/tools/builtin.py | 2750 | CODE | |
| LOW | backend/open_webui/tools/builtin.py | 4240 | CODE | |
| LOW | backend/open_webui/tools/builtin.py | 4367 | CODE | |
| LOW | backend/open_webui/utils/response.py | 227 | CODE | |
| LOW | backend/open_webui/utils/oauth.py | 1327 | CODE | |
| LOW | backend/open_webui/models/chats.py | 1543 | CODE | |
| LOW | backend/open_webui/retrieval/utils.py | 636 | CODE | |
| LOW | backend/open_webui/retrieval/utils.py | 818 | CODE | |
| LOW | backend/open_webui/retrieval/web/utils.py | 399 | CODE | |
| LOW | backend/open_webui/retrieval/web/utils.py | 668 | CODE | |
| LOW | backend/open_webui/retrieval/web/utils.py | 935 | CODE | |
| LOW | backend/open_webui/retrieval/loaders/datalab_marker.py | 16 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | package-lock.json | 12718 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz", | CODE |
| MEDIUM | backend/open_webui/utils/oauth.py | 954 | # TODO: Replace this logic with a more robust OAuth client registration validation | COMMENT |
| LOW | backend/open_webui/utils/mcp/client.py | 176 | # We simply call aclose() directly. If the task is cancelled, the | COMMENT |
| MEDIUM | src/lib/components/common/Textarea.svelte | 40 | // and it makes the fix 100% robust without relying on hardcoded CSS classes. | COMMENT |
| MEDIUM | src/lib/components/common/DropdownSub.svelte | 84 | // Vertical positioning with robust bounds clamping (shift method) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/open_webui/main.py | 1097 | async def _set_direct_model(request: Request, model_item: dict, user) -> None: | STRING |
| LOW⚡ | backend/open_webui/routers/knowledge.py | 633 | async def _set_external_connections(connections: list[dict]) -> None: | CODE |
| LOW | backend/open_webui/utils/code_interpreter.py | 12 | logger = logging.getLogger(__name__) | CODE |
| LOW | backend/open_webui/utils/asgi_middleware.py | 126 | def _set_token(self, request: Request) -> None: | CODE |
| LOW | backend/open_webui/utils/automations.py | 202 | async def _set_terminal_cwd(app, server_id: str, user, cwd: str, chat_id: str) -> None: | CODE |
| LOW | backend/open_webui/utils/timers.py | 422 | async def _set_timer_state(timer_id: str, status: str, **fields) -> None: | CODE |
| LOW⚡ | backend/open_webui/utils/telemetry/metrics.py | 53 | logger = logging.getLogger(__name__) | CODE |
| LOW | backend/open_webui/utils/telemetry/instrumentors.py | 31 | logger = logging.getLogger(__name__) | CODE |
| LOW | backend/open_webui/models/users.py | 770 | async def update_last_active_by_id(self, id: str, db: AsyncSession | None = None) -> None: | CODE |
| LOW | backend/open_webui/models/chats.py | 865 | async def update_chat_tags_by_id(self, id: str, tags: list[str], user) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | backend/open_webui/retrieval/vector/dbs/oracle23ai.py | 377 | Handle Decimal objects for JSON serialization. Args: obj: Object to serialize Ret | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/lib/workers/pyodide.worker.ts | 217 | print(f"data:image/png;base64,{img_str}") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/open_webui/utils/chat_variables.py | 109 | 'placeholder', | CODE |
| LOW | backend/open_webui/models/auths.py | 23 | PLACEHOLDER_HASH = bcrypt.hashpw(b'placeholder', bcrypt.gensalt()).decode('utf-8') | CODE |
| LOW | backend/open_webui/retrieval/loaders/main.py | 282 | 'image_export_mode': 'placeholder', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/generate-sbom.sh | 13 | # Usage: | COMMENT |
| LOW | src/lib/components/common/RichTextInput.svelte | 796 | // Usage example | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/lib/components/workspace/Tools/ToolkitEditor.svelte | 69 | # Add your custom tools using pure Python code here, make sure to add type hints and descriptions | COMMENT |
| MEDIUM | …c/lib/components/admin/Functions/FunctionEditor.svelte | 295 | # This is where you can add your custom pipelines like RAG. | STRING |