Scan report

xunholy / k8s-gitops

View on GitHub (opens in a new tab)
PHP
641 stars
Scanned 24 Sep 2026, 09:36

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

18 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 12
Low: 5

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Medium

Does this code look like it is trying to cause harm?

21 risk score

Real issues worth reviewing before you rely on this code.

High: 4
Medium: 1
Low: 7

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

29 total findings

Likely real: 10
Uncertain: 2
Likely noise: 17

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository shows a low vulnerability score of 18.0, which means there are some insecure coding patterns that could be exploited if an attacker gets inside the codebase. However, the medium malicious-pattern score of 21.0 suggests that these issues might not be intentional attacks but rather common mistakes in how the code is written. Most of the flagged problems relate to standard security risks like potential network access or missing encryption for HTTP servers, which are typical vulnerabilities found in many applications rather than signs of a specific threat actor targeting this project. While some rules indicate dangerous behaviors such as memory scraping or process injection, the confidence scores and context suggest these are likely false positives from the codebase's own structure rather than deliberate malicious intent. Overall, while the code contains several known security weaknesses that need attention, they do not appear to be evidence of a sophisticated attack against this specific repository.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 17

Pattern-based code analysis · Vulnerability
GuardDog 7

Supply-chain attack heuristics · Malicious pattern
YARA 5

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 1

Likely real
Yes, 94% confidence

Detects keylogging and input capture patterns [threat-runtime-keylogging]
```
...xt WinAPI_SetWindowLong WinAPI_SetWindowOrg WinAPI_SetWindowPlacement WinAPI_SetWindowPos WinAPI_SetWindowRgn WinAPI_SetWindowsHookEx WinAPI_SetWindowSubclass WinAPI_SetWindowText WinAPI_SetWindowTheme WinAPI_SetWinEventHook WinAPI_SetWorldTransform ...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/enemy-territory/app/helmrelease.yaml line 63

Likely real
Yes, 99% confidence

Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.
```
hostNetwork: true
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/talos/integrations/cilium/cilium.yaml line 13563

Likely real
Yes, 99% confidence

Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.
```
hostNetwork: true
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/talos/integrations/cilium/cilium.yaml line 14024

Likely real
Yes, 99% confidence

Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.
```
hostNetwork: true
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 1

Likely real
Yes, 98% confidence

Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
```
...:0,c:[e.BE]}]},e.TM={cN:"title",b:e.IR,r:0},e.UTM={cN:"title",b:e.UIR,r:0},e.registerLanguage("1c",function(e){var t="[a-zA-Zа-яА-Я][a-zA-Z0-9_а-яА-Я]*",r="возврат дата для если и или иначе иначеесли исключение конецесли конецпопытки конецпроцедуры к...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/main.go line 290

Likely real
Uncertain, 48% confidence

Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
```
err := http.ListenAndServe(listenURL.Host, nil)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/talos/integrations/cilium/cilium.yaml line 13959

Likely real
Probably noise, 29% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
securityContext:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/cmangos-database/app/backup-cronjob.yaml line 37

Likely real
Probably noise, 27% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
- name: dump
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/cmangos-ptr/app/db-init-job.yaml line 27

Likely real
Probably noise, 27% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
- name: init
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.archive/kubernetes/cloudflare-ddns/app/deployment.yaml line 49

Likely real
Probably noise, 27% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
name: cloudflare-ddns
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/preview-system/app/resourceset.yaml line 106

Likely real
Probably noise, 27% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
- name: comment
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/cmangos-ptr/app/realm-row-migration-job.yaml line 51

Likely real
Probably noise, 27% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
- name: migrate
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/azerothcore/app/realm-config-job.yaml line 25

Likely real
Probably noise, 27% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
- name: migrate
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.archive/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set/app/helmrelease.yaml line 39

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
- name: runner
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 1

Likely real
Yes, 92% confidence

Detects DLL injection and process injection techniques [threat-process-injection-dll]
```
...heckDiv Max MemGlobalAlloc MemGlobalFree MemGlobalLock MemGlobalSize MemGlobalUnlock MemMoveMemory MemVirtualAlloc MemVirtualAllocEx MemVirtualFree MemVirtualFreeEx Min MouseTrap NamedPipes_CallNamedPipe NamedPipes_ConnectNamedPipe NamedPipes_CreateN...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 1

Likely real
Yes, 92% confidence

Detects DLL injection and process injection techniques [threat-process-injection-dll]
```
...WindowFromPoint WinAPI_WordToShort WinAPI_Wow64EnableWow64FsRedirection WinAPI_WriteConsole WinAPI_WriteFile WinAPI_WriteProcessMemory WinAPI_ZeroMemory WinNet_AddConnection WinNet_AddConnection2 WinNet_AddConnection3 WinNet_CancelConnection WinNet_C...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 4

Likely real
Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]
```
...ames nativeCharToNum normalizeText num number numToByte numToChar numToCodepoint numToNativeChar offset open openfiles openProcesses openProcessIDs openSockets paragraphOffset paramCount param params peerAddress pendingMessages platform popStdDev po...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 1

Likely real
Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]
```
...f Security__IsValidSid Security__LookupAccountName Security__LookupAccountSid Security__LookupPrivilegeValue Security__OpenProcessToken Security__OpenThreadToken Security__OpenThreadTokenEx Security__SetPrivilege Security__SetTokenInformation Securi...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js line 1

Likely real
Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]
```
...unter WinAPI_QueryPerformanceFrequency WinAPI_RadialGradientFill WinAPI_ReadDirectoryChanges WinAPI_ReadFile WinAPI_ReadProcessMemory WinAPI_Rectangle WinAPI_RectInRegion WinAPI_RectIsEmpty WinAPI_RectVisible WinAPI_RedrawWindow WinAPI_RegCloseKey W...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.archive/kubernetes/cloudflare-ddns/app/deployment.yaml line 20

Likely real
Probably noise, 25% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
spec:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/azerothcore/app/realm-config-job.yaml line 18

Likely real
Probably noise, 25% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
spec:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/cmangos-ptr/app/db-init-job.yaml line 20

Likely real
Probably noise, 25% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
spec:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/game-servers/cmangos-ptr/app/realm-row-migration-job.yaml line 44

Likely real
Probably noise, 25% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
spec:
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/kubernetes/apps/base/preview-system/app/resourceset.yaml line 103

Likely real
Probably noise, 25% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
spec:
```