Scan report

mattn / goreman

View on GitHub (opens in a new tab)
Go
2649 stars
Scanned 24 Sep 2026, 10:16

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

15 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 7
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 0
Low: 3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

11 total findings

Likely real: 8
Uncertain: 3
Likely noise: 0

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

8 findings likely need attention. Most notable: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unver... in /proc.go (46% confidence).

Detections by engine

Semgrep 7

Pattern-based code analysis · Vulnerability
GuardDog 3

Supply-chain attack heuristics · Malicious pattern
Bandit 1

Python security linter · Vulnerability

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/proc.go line 22

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
cmd := exec.Command(cs[0], cs[1:]...)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/_example/web.go line 18

Likely real
Yes, 56% confidence

Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.
```
fmt.Fprintf(w, "hello "+os.Getenv("AUTHOR"))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go.yml line 14

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go.yml line 20

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 17

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@master
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 19

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/_example/web.go line 20

Likely real
Uncertain, 48% confidence

Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
```
http.ListenAndServe(*addr, nil)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/_example/web.py line 19

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
18 port = int(os.environ.get("PORT", "8000"))
19 ThreadingHTTPServer(("0.0.0.0", port), Handler).serve_forever()
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/_example/web.go line 18

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintf(w, "hello "+os.Getenv("AUTHOR"))
	})
	http.ListenAndServe(*addr, nil)
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/export.go line 20

Likely real
Yes, 91% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
// values match the runtime environment.
	env, err := godotenv.Read(filepath.Join(filepath.Dir(procfile), ".env"))
	if err != nil {
		env = map[string]string{}
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/main.go line 105

Likely real
Yes, 91% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
var envFileOption = flag.String("env", ".env", "Environment files to load, comma separated")

var maxProcNameLength = 0
```