Scan report

terraform-lxd / terraform-provider-lxd

View on GitHub (opens in a new tab)
Go
273 stars
Scanned 24 Sep 2026, 10:26

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

9 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 5
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

5 total findings

Likely real: 4
Uncertain: 1
Likely noise: 0

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

4 findings likely need attention. Most notable: Variable `instance` is likely modified and later used on error. In some cases this coul... in /internal/instance/resource_instance_file.go (100% confidence).

Detections by engine

Semgrep 5

Pattern-based code analysis · Vulnerability

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/instance/resource_instance_file.go line 255

Likely real
Yes, 100% confidence

Variable `instance` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference
```
instance, _, err := server.GetInstance(instanceName)
	if err != nil {
		if errors.IsNotFoundError(err) {
			// If instance is not found, file cannot exist. Remove it
			// from the state to ensure it is created on next apply.
			resp.State.RemoveResource(ctx)
			return
		}

		resp.Diagnostics.AddError(fmt.Sprintf("Failed retrieve instance %q", instance.Name), err.Error())
		return
	}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/actions/cluster/action.yml line 36

Likely real
Yes, 53% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: canonical/lxd/.github/actions/reclaim-disk-space@main # zizmor: ignore[unpinned-uses]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/actions/cluster/action.yml line 40

Likely real
Yes, 53% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: canonical/lxd/.github/actions/disable-docker@main # zizmor: ignore[unpinned-uses]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/test.yml line 163

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: $/.github/actions/cluster
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/acctest/testutils.go line 5

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```