Scan report

Resinat / Resin

View on GitHub (opens in a new tab)
Go
2372 stars
Scanned 24 Sep 2026, 09:40

Report Rescan

Vulnerability High

Could an attacker exploit mistakes in this code?

120 risk score

Serious issues. Review the high-severity findings before using it.

High: 8
Medium: 33
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

14 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 4
Low: 3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

48 total findings

Likely real: 40
Uncertain: 5
Likely noise: 3

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository Resinat/Resin has a high vulnerability risk score of 120.0, which means the code contains many insecure patterns that an attacker could easily exploit to break things. While there are also some signs of potentially malicious intent with a low score of 14.0, these appear to be ordinary coding mistakes rather than intentional attacks. The most serious issues involve SQL injection risks from user-controlled data and dangerous dynamic ClientTrace functions that could allow attackers to bypass security controls. Additionally, the code uses methods like math/rand instead of the safer crypto/rand, and there are several references to downloading remote resources which could be unsafe if not handled correctly. Overall, while some issues look like standard errors, the combination of these vulnerabilities makes it important for developers to review and fix them before using this code in production.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 41

Pattern-based code analysis · Vulnerability
GuardDog 6

Supply-chain attack heuristics · Malicious pattern
YARA 1

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/requestlog/schema.go line 110

Likely real
Yes, 100% confidence

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.
```
if _, err := db.Exec(stmt); err != nil {
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/requestlog/schema.go line 117

Likely real
Yes, 100% confidence

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.
```
rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/consistency.go line 23

Likely real
Yes, 100% confidence

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.
```
if _, err := cacheDB.Exec(attachSQL); err != nil {
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/migrate.go line 152

Likely real
Yes, 100% confidence

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.
```
if err := db.QueryRow(fmt.Sprintf("SELECT COUNT(*) FROM %s", table)).Scan(&count); err != nil {
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/schema.go line 55

Likely real
Yes, 100% confidence

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.
```
if _, err := db.Exec(stmt); err != nil {
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/schema.go line 62

Likely real
Yes, 100% confidence

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.
```
rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Dockerfile line 49

Likely real
Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
```
CMD ["/usr/local/bin/resin"]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Dockerfile line 48

Likely real
Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
```
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/proxy/reverse.go line 332

Likely real
Yes, 100% confidence

Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for 'upstreamTrace.clientTrace()'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.
```
reqCtx := httptrace.WithClientTrace(req.Context(), upstreamTrace.clientTrace())
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/proxy/forward.go line 252

Likely real
Yes, 100% confidence

Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for 'upstreamTrace.clientTrace()'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.
```
outReq = outReq.WithContext(httptrace.WithClientTrace(outReq.Context(), upstreamTrace.clientTrace()))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/proxy/reverse.go line 337

Likely real
Yes, 100% confidence

Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for 'reporter.clientTrace()'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.
```
reqCtx = httptrace.WithClientTrace(reqCtx, reporter.clientTrace())
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/outbound/secure_dns.go line 223

Likely real
Yes, 99% confidence

Downcasting or changing sign of an integer with `uint16` method
```
port, err := strconv.Atoi(portRaw)
	if err != nil || port < 1 || port > 65535 {
		return "", 0, fmt.Errorf("invalid port %q", portRaw)
	}
	return host, uint16(port), nil
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/webui/src/features/platforms/PlatformAccessPanel.tsx line 232

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
shellQuote(forwardCredential),
      shellQuote("https://api.ipify.org"),
    ].join(" ");
    const curlReverse = reverseUrl ? `curl ${shellQuote(reverseUrl)}` : "";
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/webui/src/features/platforms/PlatformAccessPanel.tsx line 180

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
const [token, setToken] = useState(loadStoredProxyToken);
  const [target, setTarget] = useState("https://api.ipify.org");

  const envQuery = useQuery({
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/webui/src/i18n/translations.ts line 340

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
"目标网址": "Target URL",
  "例如 https://api.ipify.org": "e.g. https://api.ipify.org",
  "反向代理地址": "Reverse Proxy URL",
  "请输入合法的 http/https 目标网址以生成反向代理地址。":
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/webui/src/features/platforms/PlatformAccessPanel.tsx line 327

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
id="access-target"
            placeholder={t("例如 https://api.ipify.org")}
            value={target}
            onChange={(event) => setTarget(event.target.value)}
```

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /internal/proxy/reverse.go line 324
Likely real: Yes, 53% confidence

ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.

Director: func(req *http.Request) {
			req.URL = target
			req.Host = parsed.Host
			stripForwardingIdentityHeaders(req.Header)
			pendingEgressHeaderBytes = headerWireLen(req.Header)

			// Compose request-progress trace first so egress commit logic can
			// observe whether the upstream request was actually written.
			reqCtx := httptrace.WithClientTrace(req.Context(), upstreamTrace.clientTrace())

			// Add httptrace for TLS latency measurement on HTTPS.
			if parsed.Protocol == "https" && hasRoute && p.health != nil {
				reporter := newReverseLatencyReporter(p.health, nodeHashRaw, domain)
				reqCtx = httptrace.WithClientTrace(reqCtx, reporter.clientTrace())
			}
			*req = *req.WithContext(reqCtx)
		},

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/migrate.go line 152

Likely real
Yes, 53% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
if err := db.QueryRow(fmt.Sprintf("SELECT COUNT(*) FROM %s", table)).Scan(&count); err != nil {
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/schema.go line 54

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
stmt := fmt.Sprintf("ALTER TABLE %s ADD COLUMN %s", table, columnDDL)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/schema.go line 62

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/state/consistency.go line 22

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
attachSQL := fmt.Sprintf("ATTACH DATABASE %q AS state_db", stateDBPath)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/requestlog/schema.go line 109

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
stmt := fmt.Sprintf("ALTER TABLE %s ADD COLUMN %s", table, columnDDL)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/requestlog/schema.go line 117

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 167

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 217

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/build-push-action@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 208

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/metadata-action@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 191

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/login-action@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 188

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/setup-buildx-action@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 185

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/setup-qemu-action@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 176

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/download-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 170

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/download-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 148

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: softprops/action-gh-release@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 132

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/download-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 120

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 106

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/upload-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 98

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/upload-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 47

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 36

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 33

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/close-inactive-issues.yml line 15

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/stale@v10
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/proxy/errors.go line 93

Likely real
Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
```
w.Write([]byte(pe.Message))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/platform/routableview.go line 5

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/probe/manager.go line 6

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/routing/random.go line 5

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/scanloop/scanloop.go line 4

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/internal/config/env.go line 138

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
// --- Auth (tokens must be defined; empty means auth disabled) ---
	authVersionRaw := os.Getenv("RESIN_AUTH_VERSION")
	adminToken, hasAdminToken := os.LookupEnv("RESIN_ADMIN_TOKEN")
	proxyToken, hasProxyToken := os.LookupEnv("RESIN_PROXY_TOKEN")
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/cmd/resin/app_runtime.go line 47

Likely real
Yes, 91% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
func run() error {
	if err := loadDotenvFile(".env"); err != nil {
		return err
	}
```