MalDet · Static Security Report
This repository has a high vulnerability score of 120.0, which means there are several serious coding mistakes that could let attackers exploit the code in dangerous ways. The scan found many instances of hardcoded secrets like AWS keys and tokens, as well as commands that might be executed by users if they provide input, but these issues appear to be common errors rather than signs of malicious intent. While some tools flagged a YARA rule for downloading files, this is considered a low-risk finding that does not pose an immediate threat. Overall, the code contains significant security flaws that need to be fixed before it can be used in production environments.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 21 | 6 | 0 | 27 |
| yara | Signatures of malicious behaviour in source files | 0 | 0 | 2 | 2 |
14 of 29 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Sauce Token detected | 1 | /src/data/lex-models/2017-04-19/examples-1.json.php:3 |
| high | semgrep | AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file. | 2 | /src/data/launch-wizard/2018-05-10/examples-1.json.php:3 |
| high | semgrep | Generic Secret detected | 8 | /src/data/sso-oidc/2019-06-10/examples-1.json:8 |
| high | semgrep | The 'phpinfo' function may reveal sensitive information about your environment. | 1 | /compatibility-test.php:166 |
| high | semgrep | JWT token detected | 8 | /src/data/sso-oidc/2019-06-10/examples-1.json.php:3 |
| high | semgrep | Executing non-constant commands. This can lead to command injection. | 1 | /src/Credentials/CredentialProvider.php:605 |
| medium | semgrep | The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`. | 1 | /src/Crypto/AesDecryptingStream.php:134 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 1 | /.github/workflows/pull-request-build.yml:27 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 4 | /src/S3/S3Transfer/Utils/FileDownloadHandler.php:386 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 2 | /.github/workflows/docs-build.yml |