MalDet · Static Security Report
This repository has a medium vulnerability score of 60, which means there are several insecure coding patterns that an attacker could exploit to break into your system. The scan did not find any signs of malicious intent, so the issues appear to be ordinary mistakes rather than deliberate attacks. However, because the code contains many unencrypted connections and potential security flaws, it is not safe to use without fixing these problems first. You should treat this as a high-risk project until you have addressed all the flagged issues in your own codebase.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 4 | 24 | 12 | 40 |
| bandit | Insecure coding patterns in Python source | 0 | 1 | 0 | 1 |
4 of 41 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order | 2 | /internal/testing/testotel/collector.go:98 |
| high | semgrep | JWT token detected | 1 | /examples/mcp/mcp_oauth_example.yaml:6 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /cmd/aigw/stdio2http.go:51 |
| medium | semgrep | Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS. | 1 | /internal/testing/ollama.go:62 |
| medium | semgrep | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically escape HTML content, which can leave your application vuln | 1 | /internal/autoconfig/config.go:16 |
| medium | semgrep | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT | 3 | /site/src/components/ApiField.tsx:47 |
| medium | semgrep | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. | 4 | /internal/mcpproxy/handlers.go:176 |
| medium | bandit | Possible binding to all interfaces. | 1 | /tests/internal/testopeninference/openai_proxy.py:147 |
| medium | semgrep | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. | 3 | /site/src/plugins/latestBlogsPlugin.ts:27 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 12 | /examples/inference-pool/with-annotations.yaml:128 |
| low | semgrep | When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resou | 12 | /examples/monitoring/monitoring.yaml:115 |