MalDet · Static Security Report
This repository has a high vulnerability score of 136.0, which means there are several dangerous coding patterns that could let attackers exploit the code if it were used in production. While the malicious-pattern risk is low at 0.0, indicating no obvious signs of intentional harm, the actual security issues found are mostly standard mistakes rather than clever attacks. The most critical issue is that debug logging is turned on, which would leak sensitive information to anyone viewing the site. Another serious problem involves executing commands with user input, a common error where developers forget to sanitize data before running it. Additionally, there is a risk of supply-chain attacks because GitHub Actions steps are using tags or branch names without proper integrity checks. These findings represent ordinary insecure coding practices that should be fixed to make the code safer for real-world use.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 16 | 6 | 0 | 22 |
15 of 22 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems. | 11 | /channelsAssets.php:2 |
| high | semgrep | Executing non-constant commands. This can lead to command injection. | 5 | /config-test.php:509 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 4 | /.github/workflows/php.yml:32 |
| medium | semgrep | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted | 1 | /index.html:12 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 1 | /functions.php:358 |