MalDet · Static Security Report
This repository has a high vulnerability score of 172.0, which means there are several dangerous coding patterns that an attacker could exploit if they gain access to the code. While the scan did not find any signs of intentional malicious behavior, it identified many issues related to how the application handles sensitive data and network connections. For example, the system logs debug information that could reveal secrets, uses weak password hashing algorithms, and allows anonymous users to connect to LDAP servers without proper authentication. Additionally, there are risks in Dockerfile configurations where containers might run as root, insecure redirects in nginx settings, and potential supply chain attacks through GitHub Actions workflows. These findings suggest the code is not safe for production use because it contains known security flaws rather than signs of deliberate harm.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 13 | 87 | 0 | 100 |
| yara | Signatures of malicious behaviour in source files | 2 | 0 | 0 | 2 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 2 | 2 |
63 of 104 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems. | 1 | /.docker/frankenphp/frankenphp-worker.php:21 |
| high | semgrep | bcrypt hash detected | 1 | /phpmyfaq/src/phpMyFAQ/Auth/AuthDatabase.php:40 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 11 | /.docker/frankenphp/Dockerfile:67 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /AGENTS.md |
| medium | semgrep | RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 1 | /phpmyfaq/assets/src/search/highlight.ts:27 |
| medium | semgrep | RegExp() called with a `event` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 1 | /phpmyfaq/admin/assets/src/content/media.browser.ts:24 |
| medium | semgrep | RegExp() called with a `currentValue` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-co | 1 | /phpmyfaq/admin/assets/src/content/faqs.autocomplete.ts:65 |
| medium | semgrep | This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from | 1 | /.github/workflows/docker-publish.yml:75 |
| medium | semgrep | Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme. | 6 | /.docker/nginx/default.conf:145 |
| medium | semgrep | Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. | 1 | /phpmyfaq/src/phpMyFAQ/Ldap.php:144 |
| medium | semgrep | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. | 1 | /phpmyfaq/admin/assets/src/content/media.browser.ts:38 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 50 | /.github/workflows/coverage-to-pages.yml:43 |
| medium | semgrep | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. | 5 | /scripts/generate-sbom.sh:44 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /kubernetes-deploy/01-phpmyfaq-deployment.yaml:27 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 19 | /phpmyfaq/src/phpMyFAQ/Category/Image.php:182 |
| low | dep_checker | Loose version constraint: 'stylelint^17.15.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'stylelint-config-standard-scss^17.0.0' — attacker could push malicious update | 1 | package.json |