Scan report

matterpoll / matterpoll

View on GitHub (opens in a new tab)
Go
299 stars
Scanned 29 Oct 2026, 10:14

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

19 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 4
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

12 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 0
Low: 2

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

8 total findings

Likely real: 8
Uncertain: 0
Likely noise: 0

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

8 findings likely need attention. Most notable: Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted so... in /webapp/package.json (98% confidence).

Detections by engine

Semgrep 5

Pattern-based code analysis · Vulnerability
GuardDog 3

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/webapp/package.json line 108

Likely real
Yes, 98% confidence

Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency]
```
"testEnvironmentOptions": {
      "url": "http://localhost:8065"
    }
  }
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.nvmrc line 1

Likely real
Yes, 95% confidence

This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or a floating alias whose patch level cannot be verified. Pin to a fixed release 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and 25 are end-of-life and will not receive a fix.
```
24.13.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/server/plugin/api.go line 191

Likely real
Yes, 99% confidence

Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.
```
_, _ = io.WriteString(w, infoMessage+root.Manifest.Version+"\n")
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/webapp/.npmrc line 1

Likely real
Yes, 97% confidence

This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
```
save-exact=true
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/check-mocks.yml line 17

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/check-mocks.yml line 22

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v7
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/build/pluginctl/main.go line 90

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
adminUsername := os.Getenv("MM_ADMIN_USERNAME")
	adminPassword := os.Getenv("MM_ADMIN_PASSWORD")

	if siteURL == "" {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/build/pluginctl/main.go line 88

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
siteURL := os.Getenv("MM_SERVICESETTINGS_SITEURL")
	adminToken := os.Getenv("MM_ADMIN_TOKEN")
	adminUsername := os.Getenv("MM_ADMIN_USERNAME")
	adminPassword := os.Getenv("MM_ADMIN_PASSWORD")
```