Overall assessment
Low
Combined score 6
· 2 findings after filtering
Summary
2 findings likely need attention. Most notable: Possible active debug code detected. Deploying an application with debug code can creat... (99% confidence).
Generated from finding counts. A plain-English summary was not
available for this scan.
Risk, by type
MalDet scores two different questions separately, because they call for
different responses: code can be badly written without being hostile, and
hostile code is not always badly written.
Vulnerability
Low
(6)
Insecure coding an attacker could exploit. Usually mistakes,
and usually fixable in place.
Malicious pattern
Safe
(0)
Signs the code may be trying to do harm: hidden payloads,
credential access, persistence, exfiltration.
What each detector found
| Detector | Looks for |
High | Medium | Low | Total |
| semgrep |
Insecure coding patterns across many languages |
0 |
2 |
0 |
2 |
2 of 2 findings
were rated more likely genuine than noise by the classifier.
Evidence
Identical findings are grouped, so a single rule firing many times takes one
row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
| medium |
semgrep |
Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. |
2 |
/src/MainMenu.java:267 |
How to read this report
- This is a static scan. The code was read, never executed.
Behaviour that only appears at runtime is outside what any of these detectors
can see.
- Findings are not all equally real. A classifier rates each
finding on how likely it is to be genuine rather than noise, and that rating
weights the scores. Measured against a hand-reviewed sample it reached
precision 0.52 and recall 0.62 — useful for ranking, not a verdict on any
single finding.
- A high score is not proof of malice. Security tools,
penetration-testing frameworks and malware research repositories contain the
same patterns as real malware by design. The two risk types above exist to
keep that distinction visible.
- Absence of findings is not proof of safety. A detector that
is not installed, or a language none of them parse, produces silence rather
than a warning.
- This scan is a snapshot. The repository may have changed
since 07 October 2026.