Scan report

matterpoll / matterpoll

View on GitHub (opens in a new tab)
Go
296 stars
Scanned 24 Sep 2026, 10:23

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

9 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 4
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

12 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 0
Low: 2

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

7 total findings

Likely real: 7
Uncertain: 0
Likely noise: 0

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a low vulnerability score of 9.0, which means that while there are some coding patterns that could be exploited by an attacker, they do not represent serious threats to your system. The most critical issue is the use of io.WriteString() to write directly to HTTP response objects, which bypasses security checks and allows attackers to inject malicious code into web pages. This specific finding indicates a clear intent to exploit vulnerabilities rather than just sloppy coding, so it should be addressed immediately. Additionally, the project relies on potentially unstable npm packages without enforcing a minimum age of seven days before using them, which could introduce new risks if those packages are compromised later. While there are also some concerning practices like reading environment variables and using mutable GitHub Actions tags that need attention, these appear to be standard security issues rather than signs of malicious activity. Overall, the codebase is not safe for immediate use without significant refactoring to fix the direct HTTP writing vulnerability and strengthen dependency management.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 4

Pattern-based code analysis · Vulnerability
GuardDog 3

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/webapp/package.json line 108

Likely real
Yes, 98% confidence

Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency]
```
"testEnvironmentOptions": {
      "url": "http://localhost:8065"
    }
  }
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/server/plugin/api.go line 104

Likely real
Yes, 99% confidence

Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.
```
_, _ = io.WriteString(w, infoMessage+root.Manifest.Version+"\n")
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/webapp/.npmrc line 1

Likely real
Yes, 97% confidence

This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
```
save-exact=true
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/check-mocks.yml line 17

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/check-mocks.yml line 22

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v7
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/build/pluginctl/main.go line 90

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
adminUsername := os.Getenv("MM_ADMIN_USERNAME")
	adminPassword := os.Getenv("MM_ADMIN_PASSWORD")

	if siteURL == "" {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/build/pluginctl/main.go line 88

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
siteURL := os.Getenv("MM_SERVICESETTINGS_SITEURL")
	adminToken := os.Getenv("MM_ADMIN_TOKEN")
	adminUsername := os.Getenv("MM_ADMIN_USERNAME")
	adminPassword := os.Getenv("MM_ADMIN_PASSWORD")
```