MalDet · Static Security Report
The repository has a medium vulnerability score of 53.0, which indicates that some code contains insecure patterns an attacker could exploit, but the scan did not find any signs of intentional malicious behavior. The most critical issues are related to missing security features like cross-site request forgery protection and mass assignment limits in your controllers and models. While one finding suggests a manual ERB template was created, this is likely just standard development practice rather than a deliberate attack attempt. Additionally, the code does not use the latest dependency updates with a cooldown period, which could theoretically introduce new risks from unstable packages. Overall, these are typical coding mistakes that should be fixed to improve security, but they do not suggest the project is currently compromised or trying to harm others.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 2 | 19 | 0 | 21 |
| yara | Signatures of malicious behaviour in source files | 1 | 0 | 0 | 1 |
21 of 22 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. | 1 | /spec/dummy/app/controllers/application_controller.rb:3 |
| high | semgrep | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ | 1 | /spec/unit/adapters/abstract_adapter_spec.rb:8 |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /README.md |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 2 | /.github/dependabot.yml:12 |
| medium | semgrep | Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off. | 1 | /spec/dummy/config/environments/test.rb:6 |
| medium | semgrep | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'. | 1 | /spec/integration/v4/support.rb:173 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 15 | /.github/workflows/ci.yml:62 |