Scan report

vakhov / fresh-proxy-list

View on GitHub (opens in a new tab)
PHP
378 stars
Scanned 24 Sep 2026, 10:20

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

8 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 5
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 1

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

6 total findings

Likely real: 3
Uncertain: 2
Likely noise: 1

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

3 findings likely need attention, 1 looks like noise. Most notable: A secret is exposed in the workflow-level `env:` block, making it available to every jo... in /.github/workflows/update.yml (98% confidence).

Detections by engine

Semgrep 5

Pattern-based code analysis · Vulnerability
YARA 1

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update.yml line 19

Likely real
Yes, 98% confidence

A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed.
```
ACCESS_CODE: ${{ secrets.ACCESS_CODE }}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update.yml line 25

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update.yml line 39

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: ad-m/github-push-action@master
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/index.html line 14

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/index.html line 15

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.3/angular.min.js"></script>
```