MalDet · Static Security Report
This repository has two distinct security issues that need to be addressed before it can be considered safe for production use. The most critical finding is that the code contains 267 vulnerabilities, with the highest risk being missing mutex locks in several functions which could cause the application to crash unexpectedly if a lock is released twice. While these are standard coding errors rather than signs of malicious intent, they represent significant risks that must be fixed immediately. Additionally, there are multiple services running inside containers with writable root filesystems, which allows attackers to potentially modify files or download harmful payloads from the internet. The scan also identified one private key stored in code and several medium-risk findings related to environment variable exposure. To use this repository safely, you should first fix all the missing mutex unlock errors and ensure that no services are running with a writable root filesystem by changing their configuration settings.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 13 | 249 | 0 | 262 |
| yara | Signatures of malicious behaviour in source files | 0 | 0 | 3 | 3 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 2 | 2 |
205 of 267 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Missing mutex unlock (`a.mut` variable) before returning from a function. This could result in panics resulting from double lock operations | 4 | /common/quotas/global/algorithm/requestweighted.go:397 |
| high | semgrep | Missing mutex unlock (`r.mut` variable) before returning from a function. This could result in panics resulting from double lock operations | 2 | /common/clock/ratelimiter.go:241 |
| high | semgrep | Missing mutex unlock (`c.mut` variable) before returning from a function. This could result in panics resulting from double lock operations | 1 | /common/cache/lru.go:141 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 4 | /common/scripting/exec.go:33 |
| high | semgrep | Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. | 2 | /config/credentials/keytest:1 |
| medium | semgrep | Variable `details` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 8 | /common/dynamicconfig/openfeatureclient/client.go:285 |
| medium | semgrep | Service 'kafka' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service t | 6 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:29 |
| medium | semgrep | Service 'cassandra' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this servi | 5 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:3 |
| medium | semgrep | Variable `profile` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 2 | /canary/cancellation.go:220 |
| medium | semgrep | Variable `resp` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /service/history/handler/handler.go:1149 |
| medium | semgrep | Service 'zookeeper' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this servi | 1 | /docker/dev/cassandra-pinot-kafka.yml:10 |
| medium | semgrep | Service 'pinot-broker' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this se | 1 | /docker/dev/cassandra-pinot-kafka.yml:29 |
| medium | semgrep | Service 'cadence' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:54 |
| medium | semgrep | Service 'opensearch-dashboards' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' t | 1 | /docker/dev/cassandra-opensearch-kafka-migration.yml:28 |
| medium | semgrep | Service 'cadence-secondary' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to th | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:96 |
| medium | semgrep | Service 'mongo' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service t | 1 | /docker/dev/mongo-esv7-kafka.yml:3 |
| medium | semgrep | Service 'cadence-web' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this ser | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:136 |
| medium | semgrep | Service 'opensearch' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this serv | 1 | /docker/dev/cassandra-opensearch-kafka-migration.yml:10 |
| medium | semgrep | Service 'mongo-express' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this s | 1 | /docker/dev/mongo-esv7-kafka.yml:12 |
| medium | semgrep | Service 'pinot-server' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this se | 1 | /docker/dev/cassandra-pinot-kafka.yml:40 |
| medium | semgrep | Service 'pinot-controller' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to thi | 1 | /docker/dev/cassandra-pinot-kafka.yml:18 |
| medium | semgrep | Service 'mysql' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service t | 3 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:15 |
| medium | semgrep | Service 'grafana' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:148 |
| medium | semgrep | Service 'prometheus' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this serv | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:21 |
| medium | semgrep | Service 'elasticsearch' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this s | 5 | /docker/dev/mysql-esv7-kafka.yml:9 |
| medium | semgrep | Service 'mongo-express' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/mongo-esv7-kafka.yml:12 |
| medium | semgrep | Service 'elasticsearch' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 5 | /docker/dev/cassandra-opensearch-kafka-migration.yml:22 |
| medium | semgrep | Service 'pinot-controller' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/cassandra-pinot-kafka.yml:18 |
| medium | semgrep | Service 'opensearch-dashboards' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/cassandra-opensearch-kafka-migration.yml:28 |
| medium | semgrep | Service 'cadence-secondary' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:96 |
| medium | semgrep | Service 'kafka' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 6 | /docker/dev/cassandra-opensearch-kafka-migration.yml:37 |
| medium | semgrep | Service 'cassandra' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 5 | /docker/dev/cassandra-pinot-kafka.yml:3 |
| medium | semgrep | Service 'mongo' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/mongo-esv7-kafka.yml:3 |
| medium | semgrep | Service 'zookeeper' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/cassandra-pinot-kafka.yml:10 |
| medium | semgrep | Service 'opensearch' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/cassandra-opensearch-kafka-migration.yml:10 |
| medium | semgrep | Service 'cadence-web' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:136 |
| medium | semgrep | Service 'pinot-broker' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/cassandra-pinot-kafka.yml:29 |
| medium | semgrep | Service 'cadence' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:54 |
| medium | semgrep | Service 'mysql' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 3 | /docker/dev/mysql-esv7-kafka.yml:3 |
| medium | semgrep | Service 'prometheus' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:21 |
| medium | semgrep | Service 'grafana' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/docker-compose-multiclusters-cass-mysql-es.yaml:148 |
| medium | semgrep | Service 'pinot-server' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/cassandra-pinot-kafka.yml:40 |
| medium | semgrep | Downcasting or changing sign of an integer with `int32` method | 3 | /common/cache/domainCache.go:997 |
| medium | semgrep | Service 'postgres' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker/dev/postgres.yml:3 |
| medium | semgrep | Service 'postgres' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this servic | 1 | /docker/dev/postgres.yml:3 |
| medium | semgrep | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 2 | /schema/common/schema.go:158 |
| medium | semgrep | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. | 3 | /common/persistence/nosql/nosqlplugin/cassandra/setup.go:44 |
| medium | semgrep | `MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsuppor | 5 | /common/config/tls.go:69 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 104 | /.github/workflows/codecov-on-pr.yml:26 |
| medium | semgrep | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically escape HTML content, which can leave your application vuln | 1 | /tools/cli/render.go:31 |
| medium | semgrep | Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities (CWE-502). Use a concrete struct type instead. | 9 | /tools/cli/workflow_commands.go:1421 |
| medium | semgrep | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | 2 | /simulation/replication/worker/cmd/main.go:114 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 43 | /tools/cli/workflow_commands.go:31 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 2 | /common/persistence/sql/sqlplugin/postgres/plugin.go:177 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 3 | /Dockerfile |