MalDet · Static Security Report
The repository has a medium vulnerability score of 29, which indicates that while the code does not appear to be maliciously crafted, it contains several common insecure coding patterns that an attacker could exploit. These issues include running the application with a writable root filesystem and allowing it to bind to all network interfaces, which means anyone on the internet could potentially access or modify files inside the container. Additionally, there are concerns about using weak hash algorithms and dynamic file paths, but these are standard weaknesses found in many applications rather than signs of hidden malicious intent. The scan also flagged a GitHub Actions workflow that uses mutable tags, which is a supply chain risk but does not necessarily mean the code itself is dangerous. Overall, the findings suggest the project needs careful review to fix these specific security gaps before it can be considered safe for production use.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 0 | 5 | 11 | 16 |
| semgrep | Insecure coding patterns across many languages | 2 | 9 | 0 | 11 |
| yara | Signatures of malicious behaviour in source files | 0 | 0 | 2 | 2 |
6 of 29 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 2 | /collector/Dockerfile:12 |
| medium | semgrep | Service 'hello-ctf' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this servi | 1 | /docker-compose.yml:3 |
| medium | semgrep | Running flask app with host 0.0.0.0 could expose the server publicly. | 1 | /admin/app.py:382 |
| medium | semgrep | Service 'hello-ctf' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker-compose.yml:3 |
| medium | semgrep | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | 1 | /collector/app.py:65 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 2 | /.github/workflows/ghdeploy.yml:26 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 2 | /events_update.py:263 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 1 | /collector/app.py:65 |
| medium | bandit | Possible binding to all interfaces. | 2 | /collector/app.py:184 |
| medium | semgrep | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted | 3 | /overrides/main.html:152 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 3 | /admin/deployer.py:7 |
| low | bandit | Starting a process with a partial executable path | 3 | /admin/repo_sync.py:26 |
| low | bandit | subprocess call - check for execution of untrusted input. | 5 | /admin/repo_sync.py:26 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 2 | /events_update.py |