MalDet · Static Security Report
This repository has two major security issues that are critical to address before anyone can use it. The most serious problem is that the code contains insecure patterns, which means an attacker could exploit these flaws and steal sensitive information or break into the system. Additionally, there are several signs of malicious intent in the code, including suspicious typosquatting and workflows that leak secrets by default. While some findings appear to be ordinary mistakes like logging hardcoded passwords or missing version locks for dependencies, they still represent significant risks because they could lead to credential exposure or supply chain attacks if not fixed. The overall score indicates a high level of vulnerability that requires immediate attention from the developer team to ensure the code is safe and secure.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 3 | 159 | 0 | 162 |
| bandit | Insecure coding patterns in Python source | 0 | 20 | 54 | 74 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 1 | 5 | 42 | 48 |
| yara | Signatures of malicious behaviour in source files | 5 | 0 | 4 | 9 |
| guarddog | Malicious package and install-time behaviour | 0 | 1 | 0 | 1 |
196 of 294 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | dep_checker | Typosquatting: 'psycopg' is suspiciously similar to 'psycopg2' | 1 | pyproject.toml |
| high | semgrep | This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised | 1 | /.github/workflows/bump-version.yml:130 |
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/pact.yml:86 |
| high | semgrep | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition | 1 | /nextcloud_mcp_server/auth/storage.py:1654 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 5 | /.github/workflows/bump-version.yml |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Refresh token stored for user %s (lookup key: %s...)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/browser_oauth_routes.py:613 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Using app password for background sync: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/vector/oauth_sync.py:213 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Username mismatch in app password operation for path user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/api/passwords.py:156 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Stored scoped app password for user %s (scopes=%s, username=%s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:2167 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No app password found for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 2 | /nextcloud_mcp_server/auth/storage.py:1942 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Refreshed access token with scopes %s (expires in %ss)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:495 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Refresh token for user %s has expired (expired at %s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:936 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Provisioned app password for user: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/api/passwords.py:520 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "🔍 list_tools called - Token type: %s, User scopes: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/app.py:1917 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret " get_provisioning_status: app password FOUND for user_id=%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/server/oauth_tools.py:118 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "ingest.skip_no_credentials user=%s doc=%s:%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/vector/queue/procrastinate.py:221 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "[BasicAuth] Removed stale app password for %s after HTTP %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/vector/oauth_sync.py:150 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No refresh token found for user_id=%s (checked provisioning_client_id=%s... and user_id) — " "user completed elicitation but token wasn't stored" being logged. This may lead to secret credentials being exposed. Make sur | 1 | /nextcloud_mcp_server/server/oauth_tools.py:579 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "[BasicAuth] Periodic cleanup removed %s stale app password(s): %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/vector/oauth_sync.py:523 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "[BasicAuth] No stale app password to remove for %s (HTTP %s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/vector/oauth_sync.py:158 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "[BasicAuth] Failed to remove stale app password for %s: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/vector/oauth_sync.py:164 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "App password for %s is invalid (HTTP %s), removing" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:2072 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Using static OIDC client credentials: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/app.py:1226 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No app password to delete for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1996 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No access token for %s - allowing (BasicAuth mode)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/scope_authorization.py:147 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Management API token validated (no audience check) for user: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/unified_verifier.py:476 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "App password for %s validated (HTTP %s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:2080 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "BasicAuth credentials extracted for user: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/app.py:844 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Generated background token for user %s with scopes: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:316 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Token refreshed by another thread for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:289 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Failed to get background token for user %s: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:325 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Cleaned up %s stale app password(s): %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/app.py:2453 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Token introspected successfully for user: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/unified_verifier.py:903 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Token found in cache after lock acquisition for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:275 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Retrieved app password for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1952 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Failed to decrypt app password for user %s: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1959 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Could not revoke the refused Login Flow app password: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/grant_ownership.py:119 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Retrieved refresh token for user %s (flow_type: %s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:949 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Deleted app password for user: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/api/passwords.py:613 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Deleted app password for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1989 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Stored app password for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1899 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Session %s… has no refresh token for user %s; rejecting" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/session_backend.py:100 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No refresh token found for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 3 | /nextcloud_mcp_server/auth/token_broker.py:301 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Stored rotated refresh token for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 2 | /nextcloud_mcp_server/auth/token_broker.py:403 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy token refresh failed: %s %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1539 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Retrieved OAuth client credentials (client_id: %s...)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1320 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy token request: grant_type=%s params=%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1259 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy token: client_id mismatch (got=%s, expected=%s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1382 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy token: received code=%s client_id=%s redirect_uri=%s " "code_verifier=%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1328 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy token: redirect_uri mismatch (got=%s, expected=%s)" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1407 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy token: returning IdP token to client %s: refresh_token=%s " "scope=%s expires_in=%s fields=%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive inform | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1452 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "AS proxy: IdP token response: refresh_token=%s scope=%s expires_in=%s " "token_type=%s fields=%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/oauth_routes.py:1154 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "App password cleanup failed (non-fatal): %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/app.py:2459 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Cached token expired for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:59 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Cached token expiring soon for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:64 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Cached token for user %s until %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:80 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "Could not validate app password for %s: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:2087 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No refresh token to delete for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/storage.py:1101 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No token via provisioning_client_id=%s...; falling back to user_id=%s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/server/oauth_tools.py:560 |
| medium | semgrep | Detected a python logger call with a potential hardcoded secret "No refresh token to rotate for user %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information. | 1 | /nextcloud_mcp_server/auth/token_broker.py:515 |
Showing the 60 most significant of 211 distinct findings. The counts in the previous section cover all of them.