Automated code-quality scan: 4 high-severity findings (Repobility)

## Automated code-quality scan — please feel free to close if not useful Hi! [Repobility](https://repobility.com/) ran an automated scan on this repo as part of a public-repo trending-project sweep. Posting the high-signal findings here for your visibility — **this is fully automated**, so feel free to close or label as `wontfix` if any of it is off-base. **Full report (interactive):** https://repobility.com/scan/36c59998-1773-42d3-8cb0-456402726f35/ **SARIF for IDE/CI:** https://repobility.com/scan/36c59998-1773-42d3-8cb0-456402726f35/sarif/ **Score-card image:**  ### Top severity findings | Severity | Rule | File | Line | Title | |---|---|---|---|---| | **high** | `DKR001` | `docker/Dockerfile` | 4 | Docker final stage runs as root | | **high** | `SEC029` | `python/tokenspeed/runtime/pd/mini_lb.py` | 60 | [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Out | | **high** | `SEC029` | `python/tokenspeed/runtime/cache/storage/mooncake_store/mooncake_store.py` | 288 | [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Out | | **high** | `SEC029` | `python/tokenspeed/bench.py` | 285 | [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Out | | **medium** | `DKR014` | `docker/Dockerfile` | 11 | Dockerfile copies broad context with incomplete .dockerignore | ### Severity breakdown - 0 critical · 4 high · 9 medium · (51 total non-FP findings) ### Example `ai_fix_prompt` (paste into your AI coder) For `DKR001` at `docker/Dockerfile:4`: > Create an application user after package installation and switch to it with USER appuser or USER 10001. Per-finding fix bundle (with code context + similar-finding TP/FP votes): https://repobility.com/api/v1/findings/23845/fix/ ### What's Repobility? A code-quality / security / AI-coder-anti-pattern scanner. Each finding ships with an `ai_fix_prompt` your AI coder can act on directly. Free for public repos, no signup needed. ### If any of these are wrong Most rules in our scanner are still being calibrated against real-world false-positive rates. If a finding here is a false positive, please: - close this issue with a brief reason, OR - vote FP via the bridge ([protocol](https://repobility.com/agents/voting/)): the rule's confidence will adjust automatically across all repos. We've already calibrated 19 rules this way. Either way, no offence taken — and we don't auto-refile. — *Repobility automated review · https://repobility.com · open-source: WIP*