{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T16:31:48.536009Z","repo":{"ref":{"host":"github.com","owner":"MatsuriDayo","name":"NekoBoxForAndroid"},"default_branch":"main","clone_url":"https://github.com/MatsuriDayo/NekoBoxForAndroid.git","html_url":"https://github.com/MatsuriDayo/NekoBoxForAndroid","description":"NekoBox for Android / sing-box / universal proxy toolchain for Android","stars":23518,"forks":1963,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":5073,"primary_language":"Kotlin","license_spdx":"NOASSERTION","created_at":"2023-03-04T13:26:16Z","pushed_at":"2026-02-09T03:54:59Z","security_policy_url":null,"distribution":{"owner_created_at":"2021-11-27T08:31:54Z","owner_type":"Organization","release_assets":[{"name":"NekoBox-1.4.2-arm64-v8a.apk","size":15252519,"download_count":743197,"release_tag":"1.4.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-arm64-v8a.apk"},{"name":"NekoBox-1.4.2-armeabi-v7a.apk","size":15509280,"download_count":78049,"release_tag":"1.4.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-armeabi-v7a.apk"},{"name":"NekoBox-1.4.2-x86.apk","size":16222828,"download_count":47082,"release_tag":"1.4.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-x86.apk"},{"name":"NekoBox-1.4.2-x86_64.apk","size":15934699,"download_count":59065,"release_tag":"1.4.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-x86_64.apk"},{"name":"NekoBox-1.4.1-arm64-v8a.apk","size":15351283,"download_count":271341,"release_tag":"1.4.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.1/NekoBox-1.4.1-arm64-v8a.apk"},{"name":"NekoBox-1.4.1-armeabi-v7a.apk","size":15605236,"download_count":32972,"release_tag":"1.4.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.1/NekoBox-1.4.1-armeabi-v7a.apk"},{"name":"NekoBox-1.4.1-x86.apk","size":16319274,"download_count":20767,"release_tag":"1.4.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.1/NekoBox-1.4.1-x86.apk"},{"name":"NekoBox-1.4.1-x86_64.apk","size":16036087,"download_count":26645,"release_tag":"1.4.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.1/NekoBox-1.4.1-x86_64.apk"},{"name":"NekoBox-1.4.0-arm64-v8a.apk","size":15323627,"download_count":74675,"release_tag":"1.4.0","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.0/NekoBox-1.4.0-arm64-v8a.apk"},{"name":"NekoBox-1.4.0-armeabi-v7a.apk","size":15578286,"download_count":8671,"release_tag":"1.4.0","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.0/NekoBox-1.4.0-armeabi-v7a.apk"},{"name":"NekoBox-1.4.0-x86.apk","size":16291430,"download_count":5266,"release_tag":"1.4.0","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.0/NekoBox-1.4.0-x86.apk"},{"name":"NekoBox-1.4.0-x86_64.apk","size":16006986,"download_count":7332,"release_tag":"1.4.0","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.0/NekoBox-1.4.0-x86_64.apk"},{"name":"NekoBox-1.3.9-arm64-v8a.apk","size":15288987,"download_count":354048,"release_tag":"1.3.9","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.9/NekoBox-1.3.9-arm64-v8a.apk"},{"name":"NekoBox-1.3.9-armeabi-v7a.apk","size":15452378,"download_count":44789,"release_tag":"1.3.9","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.9/NekoBox-1.3.9-armeabi-v7a.apk"},{"name":"NekoBox-1.3.9-x86.apk","size":16189055,"download_count":26757,"release_tag":"1.3.9","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.9/NekoBox-1.3.9-x86.apk"},{"name":"NekoBox-1.3.9-x86_64.apk","size":15922414,"download_count":32624,"release_tag":"1.3.9","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.9/NekoBox-1.3.9-x86_64.apk"},{"name":"NekoBox-1.3.8-arm64-v8a.apk","size":15066459,"download_count":116158,"release_tag":"1.3.8","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.8/NekoBox-1.3.8-arm64-v8a.apk"},{"name":"NekoBox-1.3.8-armeabi-v7a.apk","size":15225353,"download_count":11793,"release_tag":"1.3.8","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.8/NekoBox-1.3.8-armeabi-v7a.apk"},{"name":"NekoBox-1.3.8-x86.apk","size":15963516,"download_count":6851,"release_tag":"1.3.8","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.8/NekoBox-1.3.8-x86.apk"},{"name":"NekoBox-1.3.8-x86_64.apk","size":15696692,"download_count":7546,"release_tag":"1.3.8","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.8/NekoBox-1.3.8-x86_64.apk"},{"name":"NB4A-1.3.4-arm64-v8a.apk","size":15306349,"download_count":158931,"release_tag":"1.3.4","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.4/NB4A-1.3.4-arm64-v8a.apk"},{"name":"NB4A-1.3.4-armeabi-v7a.apk","size":15413321,"download_count":22163,"release_tag":"1.3.4","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.4/NB4A-1.3.4-armeabi-v7a.apk"},{"name":"NB4A-1.3.4-x86.apk","size":16074982,"download_count":10348,"release_tag":"1.3.4","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.4/NB4A-1.3.4-x86.apk"},{"name":"NB4A-1.3.4-x86_64.apk","size":15884747,"download_count":14908,"release_tag":"1.3.4","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.4/NB4A-1.3.4-x86_64.apk"},{"name":"NB4A-1.3.3-arm64-v8a.apk","size":15305721,"download_count":12777,"release_tag":"1.3.3","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.3/NB4A-1.3.3-arm64-v8a.apk"},{"name":"NB4A-1.3.3-armeabi-v7a.apk","size":15412698,"download_count":2348,"release_tag":"1.3.3","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.3/NB4A-1.3.3-armeabi-v7a.apk"},{"name":"NB4A-1.3.3-x86.apk","size":16074361,"download_count":1470,"release_tag":"1.3.3","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.3/NB4A-1.3.3-x86.apk"},{"name":"NB4A-1.3.3-x86_64.apk","size":15884113,"download_count":1499,"release_tag":"1.3.3","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.3/NB4A-1.3.3-x86_64.apk"},{"name":"NB4A-1.3.2-arm64-v8a.apk","size":16305142,"download_count":144869,"release_tag":"1.3.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.2/NB4A-1.3.2-arm64-v8a.apk"},{"name":"NB4A-1.3.2-armeabi-v7a.apk","size":16410239,"download_count":21386,"release_tag":"1.3.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.2/NB4A-1.3.2-armeabi-v7a.apk"},{"name":"NB4A-1.3.2-x86.apk","size":17070942,"download_count":8492,"release_tag":"1.3.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.2/NB4A-1.3.2-x86.apk"},{"name":"NB4A-1.3.2-x86_64.apk","size":16883277,"download_count":13030,"release_tag":"1.3.2","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.2/NB4A-1.3.2-x86_64.apk"},{"name":"NB4A-1.3.1-arm64-v8a.apk","size":15467254,"download_count":356228,"release_tag":"1.3.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.1/NB4A-1.3.1-arm64-v8a.apk"},{"name":"NB4A-1.3.1-armeabi-v7a.apk","size":15546367,"download_count":45566,"release_tag":"1.3.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.1/NB4A-1.3.1-armeabi-v7a.apk"},{"name":"NB4A-1.3.1-x86.apk","size":16176145,"download_count":24384,"release_tag":"1.3.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.1/NB4A-1.3.1-x86.apk"},{"name":"NB4A-1.3.1-x86_64.apk","size":16020376,"download_count":29943,"release_tag":"1.3.1","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.3.1/NB4A-1.3.1-x86_64.apk"}]}},"commit_sha":"5768494d8ae3c74a057bb6d46c0f8dc071b0d821","profile":{"lines_by_language":{"Kotlin":22127,"Java":7239,"Go":3534,"Shell":218},"files_by_category":{"config":248,"source":240,"docs":19,"other":15,"binary":15,"generated":1},"source_lines":33118,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":50.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":59.9,"duplication":41.8,"lint":95.9,"testing":15.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 17% of function code in complex or long functions; 15% duplicated lines. Weakest area: testing."},"security":{"score":69.0,"confidence":0.76,"coverage":0.83,"label":"weak","breakdown":{"secrets":100.0,"sast":94.6,"dependencies":39.3,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 55 known vulnerabilities in 9 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":384.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":44322.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2023-03":{"loc":35015,"attributed_loc":0},"2023-04":{"loc":1375,"attributed_loc":0},"2023-05":{"loc":786,"attributed_loc":0},"2023-06":{"loc":596,"attributed_loc":0},"2023-07":{"loc":741,"attributed_loc":0},"2023-08":{"loc":487,"attributed_loc":0},"2023-09":{"loc":742,"attributed_loc":0},"2023-10":{"loc":145,"attributed_loc":0},"2023-11":{"loc":153,"attributed_loc":0},"2023-12":{"loc":58,"attributed_loc":0},"2024-01":{"loc":356,"attributed_loc":0},"2024-02":{"loc":397,"attributed_loc":0},"2024-03":{"loc":10,"attributed_loc":0},"2024-05":{"loc":0,"attributed_loc":0},"2024-07":{"loc":40,"attributed_loc":0},"2024-08":{"loc":2,"attributed_loc":0},"2024-10":{"loc":71,"attributed_loc":0},"2024-12":{"loc":184,"attributed_loc":0},"2025-01":{"loc":49,"attributed_loc":0},"2025-02":{"loc":915,"attributed_loc":0},"2025-03":{"loc":159,"attributed_loc":0},"2025-04":{"loc":265,"attributed_loc":0},"2025-06":{"loc":25,"attributed_loc":0},"2025-09":{"loc":1511,"attributed_loc":0},"2025-10":{"loc":58,"attributed_loc":0},"2026-01":{"loc":116,"attributed_loc":0},"2026-02":{"loc":66,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":225.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":11072.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":286.8131868131868,"median_loc_per_hour":57.0660723447922,"pr_timed_units":16.0,"excluded_import_loc":33250.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["7d9798cc271a1dc28e930feb9d1ab463cb777ce6"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":43.0,"flagged_releases":0.0,"max_loc_per_day":181.9},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.5","to":"0.6","loc":224,"days":1.25,"loc_per_day":179.3,"flagged":false},{"from":"0.6","to":"0.7","loc":890,"days":4.89,"loc_per_day":181.9,"flagged":false},{"from":"0.7","to":"0.8","loc":112,"days":0.8,"loc_per_day":140.4,"flagged":false},{"from":"0.8","to":"0.9","loc":160,"days":5.3,"loc_per_day":30.2,"flagged":false},{"from":"0.9","to":"1.0.0","loc":489,"days":6.72,"loc_per_day":72.8,"flagged":false},{"from":"1.0.0","to":"1.0.1","loc":133,"days":2.86,"loc_per_day":46.6,"flagged":false},{"from":"1.0.1","to":"1.0.2","loc":652,"days":8.4,"loc_per_day":77.6,"flagged":false},{"from":"1.0.2","to":"1.0.3","loc":258,"days":6.68,"loc_per_day":38.6,"flagged":false},{"from":"1.0.3","to":"1.0.4","loc":176,"days":6.48,"loc_per_day":27.2,"flagged":false},{"from":"1.0.4","to":"1.0.5","loc":186,"days":10.96,"loc_per_day":17.0,"flagged":false},{"from":"1.0.5","to":"1.1.0","loc":508,"days":12.67,"loc_per_day":40.1,"flagged":false},{"from":"1.1.0","to":"1.1.1","loc":86,"days":5.16,"loc_per_day":16.7,"flagged":false},{"from":"1.1.1","to":"1.1.2","loc":111,"days":9.0,"loc_per_day":12.3,"flagged":false},{"from":"1.1.2","to":"1.1.3","loc":205,"days":5.92,"loc_per_day":34.6,"flagged":false},{"from":"1.1.3","to":"1.1.4","loc":102,"days":8.93,"loc_per_day":11.4,"flagged":false},{"from":"1.1.4","to":"1.1.5","loc":681,"days":14.04,"loc_per_day":48.5,"flagged":false},{"from":"1.1.5","to":"1.1.6","loc":172,"days":7.28,"loc_per_day":23.6,"flagged":false},{"from":"1.1.6","to":"1.1.7","loc":91,"days":8.69,"loc_per_day":10.5,"flagged":false},{"from":"1.1.7","to":"1.1.8","loc":22,"days":6.92,"loc_per_day":3.2,"flagged":false},{"from":"1.1.8","to":"1.2.0","loc":376,"days":15.19,"loc_per_day":24.8,"flagged":false},{"from":"1.2.0","to":"1.2.1","loc":65,"days":6.1,"loc_per_day":10.7,"flagged":false},{"from":"1.2.1","to":"1.2.2","loc":2,"days":1.1,"loc_per_day":1.8,"flagged":false},{"from":"1.2.2","to":"1.2.3","loc":44,"days":10.88,"loc_per_day":4.0,"flagged":false},{"from":"1.2.3","to":"1.2.4","loc":707,"days":15.73,"loc_per_day":44.9,"flagged":false},{"from":"1.2.4","to":"1.2.5","loc":34,"days":12.99,"loc_per_day":2.6,"flagged":false},{"from":"1.2.5","to":"1.2.6","loc":13,"days":9.08,"loc_per_day":1.4,"flagged":false},{"from":"1.2.6","to":"1.2.7","loc":13,"days":10.0,"loc_per_day":1.3,"flagged":false},{"from":"1.2.7","to":"1.2.8","loc":27,"days":12.98,"loc_per_day":2.1,"flagged":false},{"from":"1.2.8","to":"1.2.9","loc":93,"days":2.9,"loc_per_day":32.1,"flagged":false},{"from":"1.2.9","to":"1.3.0","loc":150,"days":18.31,"loc_per_day":8.2,"flagged":false},{"from":"1.3.0","to":"1.3.1","loc":781,"days":98.22,"loc_per_day":8.0,"flagged":false},{"from":"1.3.1","to":"1.3.2","loc":123,"days":227.63,"loc_per_day":0.5,"flagged":false},{"from":"1.3.2","to":"1.3.3","loc":135,"days":64.3,"loc_per_day":2.1,"flagged":false},{"from":"1.3.3","to":"1.3.4","loc":49,"days":2.91,"loc_per_day":16.9,"flagged":false},{"from":"1.3.4","to":"1.3.5","loc":49,"days":56.27,"loc_per_day":0.9,"flagged":false},{"from":"1.3.5","to":"1.3.6","loc":929,"days":16.54,"loc_per_day":56.2,"flagged":false},{"from":"1.3.6","to":"1.3.7","loc":97,"days":3.28,"loc_per_day":29.6,"flagged":false},{"from":"1.3.7","to":"1.3.8","loc":81,"days":2.02,"loc_per_day":40.2,"flagged":false},{"from":"1.3.8","to":"1.3.9","loc":265,"days":43.62,"loc_per_day":6.1,"flagged":false},{"from":"1.3.9","to":"1.4.0","loc":1536,"days":157.17,"loc_per_day":9.8,"flagged":false},{"from":"1.4.0","to":"preview","loc":1,"days":17.06,"loc_per_day":0.1,"flagged":false},{"from":"preview","to":"1.4.1","loc":57,"days":22.94,"loc_per_day":2.5,"flagged":false},{"from":"1.4.1","to":"1.4.2","loc":182,"days":101.85,"loc_per_day":1.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":33118.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"findings_high":0.0,"findings_medium":14.0,"findings_low":0.0,"weighted_findings":5.25,"scanned_lines":33118.0,"parse_errors":3.0},"findings":[{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"app/src/main/AndroidManifest.xml","line":75,"fingerprint":"java.android.security.exported_activity:app/src/main/AndroidManifest.xml:75"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"app/src/main/AndroidManifest.xml","line":211,"fingerprint":"java.android.security.exported_activity:app/src/main/AndroidManifest.xml:211"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"app/src/main/AndroidManifest.xml","line":224,"fingerprint":"java.android.security.exported_activity:app/src/main/AndroidManifest.xml:224"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"app/src/main/AndroidManifest.xml","line":233,"fingerprint":"java.android.security.exported_activity:app/src/main/AndroidManifest.xml:233"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"app/src/main/java/io/nekohasekai/sagernet/ktx/Nets.kt","line":58,"fingerprint":"kotlin.lang.security.unencrypted-socket:app/src/main/java/io/nekohasekai/sagernet/ktx/Nets.kt:58"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt","line":746,"fingerprint":"kotlin.lang.security.unencrypted-socket:app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt:746"},{"rule_id":"opengrep/go.lang.security.audit.crypto.use-of-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"libcore/crypto.go","line":10,"fingerprint":"go.lang.security.audit.crypto.use-of-sha1:libcore/crypto.go:10"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"libcore/dns_android.go","line":39,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:libcore/dns_android.go:39"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"libcore/dns_android.go","line":47,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:libcore/dns_android.go:47"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"libcore/dns_android.go","line":54,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:libcore/dns_android.go:54"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"libcore/dns_android.go","line":64,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:libcore/dns_android.go:64"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"libcore/dns_android.go","line":74,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:libcore/dns_android.go:74"},{"rule_id":"opengrep/go.lang.security.potential-dos-via-decompression-bomb","severity":"medium","message":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. [confidence low]","path":"libcore/io.go","line":69,"fingerprint":"go.lang.security.potential-dos-via-decompression-bomb:libcore/io.go:69"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"libcore/procfs/procfs.go","line":26,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:libcore/procfs/procfs.go:26"}],"evidence":[],"data":{"rulesets":["kotlin","java","go","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":9.0,"vulnerabilities":55.0,"vulns_critical":8.0,"vulns_high":6.0,"vulns_medium":11.0,"vulns_low":0.0,"vulns_unknown":30.0,"penalty":56.0},"findings":[{"rule_id":"osv/GHSA-jppx-rxg9-jmrx","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-jppx-rxg9-jmrx"},{"rule_id":"osv/GHSA-f5wc-c3c7-36mc","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-f5wc-c3c7-36mc"},{"rule_id":"osv/GHSA-vgwf-h737-ff37","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-vgwf-h737-ff37"},{"rule_id":"osv/GHSA-89gr-r52h-f8rx","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-89gr-r52h-f8rx"},{"rule_id":"osv/GHSA-rm3j-f69w-wqmq","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-rm3j-f69w-wqmq"},{"rule_id":"osv/GHSA-5cgq-3rg8-m6cv","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-5cgq-3rg8-m6cv"},{"rule_id":"osv/GHSA-x527-x647-q7gg","severity":"critical","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-x527-x647-q7gg"},{"rule_id":"osv/GHSA-p77j-4mvh-x3m3","severity":"critical","message":"google.golang.org/grpc@1.73.0 (Go) is affected by GO-2026-4762, GHSA-p77j-4mvh-x3m3","path":"libcore/go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.73.0 (Go):GHSA-p77j-4mvh-x3m3"},{"rule_id":"osv/GHSA-259r-337f-4rfw","severity":"high","message":"github.com/klauspost/compress@1.17.11 (Go) is affected by GO-2026-5841, GHSA-259r-337f-4rfw","path":"libcore/go.mod","line":null,"fingerprint":"github.com/klauspost/compress@1.17.11 (Go):GHSA-259r-337f-4rfw"},{"rule_id":"osv/GHSA-q4h4-gmj2-qvw2","severity":"high","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-q4h4-gmj2-qvw2"},{"rule_id":"osv/GHSA-w879-237q-wc7r","severity":"high","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-w879-237q-wc7r"},{"rule_id":"osv/GHSA-hrxh-6v49-42gf","severity":"high","message":"google.golang.org/grpc@1.73.0 (Go) is affected by GO-2026-6061, GHSA-hrxh-6v49-42gf","path":"libcore/go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.73.0 (Go):GHSA-hrxh-6v49-42gf"},{"rule_id":"osv/GHSA-vp52-pcj8-j9qc","severity":"high","message":"google.golang.org/grpc@1.73.0 (Go) is affected by GO-2026-6348, GHSA-vp52-pcj8-j9qc","path":"libcore/go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.73.0 (Go):GHSA-vp52-pcj8-j9qc"},{"rule_id":"osv/GHSA-2v4p-qf9q-27wj","severity":"high","message":"google.golang.org/grpc@1.73.0 (Go) is affected by GO-2026-6443, GHSA-2v4p-qf9q-27wj","path":"libcore/go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.73.0 (Go):GHSA-2v4p-qf9q-27wj"},{"rule_id":"osv/GO-2026-6888","severity":"medium","message":"github.com/andybalholm/brotli@1.1.0 (Go) is affected by GO-2026-6888","path":"libcore/go.mod","line":null,"fingerprint":"github.com/andybalholm/brotli@1.1.0 (Go):GO-2026-6888"},{"rule_id":"osv/GHSA-mqqf-5wvp-8fh8","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-4316, GHSA-mqqf-5wvp-8fh8","path":"libcore/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GHSA-mqqf-5wvp-8fh8"},{"rule_id":"osv/GHSA-3fxj-6jh8-hvhx","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-5774, GHSA-3fxj-6jh8-hvhx","path":"libcore/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GHSA-3fxj-6jh8-hvhx"},{"rule_id":"osv/GO-2026-5775","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-5775","path":"libcore/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GO-2026-5775"},{"rule_id":"osv/GO-2026-5777","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-5777","path":"libcore/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GO-2026-5777"},{"rule_id":"osv/GHSA-j6qf-3m9c-vwj3","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GHSA-j6qf-3m9c-vwj3","path":"libcore/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GHSA-j6qf-3m9c-vwj3"},{"rule_id":"osv/GO-2026-6865","severity":"medium","message":"github.com/klauspost/compress@1.17.11 (Go) is affected by GO-2026-6865","path":"libcore/go.mod","line":null,"fingerprint":"github.com/klauspost/compress@1.17.11 (Go):GO-2026-6865"},{"rule_id":"osv/GO-2025-4116","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2025-4116","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GO-2025-4116"},{"rule_id":"osv/GHSA-j5w8-q4qc-rx2x","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2025-4134, GHSA-j5w8-q4qc-rx2x","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-j5w8-q4qc-rx2x"},{"rule_id":"osv/GHSA-f6x5-jh6r-wrfv","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2025-4135, GHSA-f6x5-jh6r-wrfv","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-f6x5-jh6r-wrfv"},{"rule_id":"osv/GHSA-45gg-vh54-h5m9","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-45gg-vh54-h5m9"},{"rule_id":"osv/GHSA-78mq-xcr3-xm33","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-78mq-xcr3-xm33"},{"rule_id":"osv/GHSA-qpw4-5x99-6vjp","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-qpw4-5x99-6vjp"},{"rule_id":"osv/GHSA-9m57-25v3-79x9","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GHSA-9m57-25v3-79x9"},{"rule_id":"osv/GO-2026-5932","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-5932","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GO-2026-5932"},{"rule_id":"osv/GO-2026-6303","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-6303","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GO-2026-6303"},{"rule_id":"osv/GO-2026-6354","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-6354","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GO-2026-6354"},{"rule_id":"osv/GO-2026-6355","severity":"medium","message":"golang.org/x/crypto@0.41.0 (Go) is affected by GO-2026-6355","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.41.0 (Go):GO-2026-6355"},{"rule_id":"osv/GO-2026-6179","severity":"medium","message":"golang.org/x/mod@0.27.0 (Go) is affected by GO-2026-6179","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/mod@0.27.0 (Go):GO-2026-6179"},{"rule_id":"osv/GO-2026-6180","severity":"medium","message":"golang.org/x/mod@0.27.0 (Go) is affected by GO-2026-6180","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/mod@0.27.0 (Go):GO-2026-6180"},{"rule_id":"osv/GO-2026-4440","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-4440","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-4440"},{"rule_id":"osv/GO-2026-4441","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-4441","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-4441"},{"rule_id":"osv/GO-2026-4918","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-4918","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-4918"},{"rule_id":"osv/GO-2026-5025","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5025","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-5025"},{"rule_id":"osv/GO-2026-5026","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5026","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-5026"},{"rule_id":"osv/GO-2026-5027","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5027","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-5027"},{"rule_id":"osv/GHSA-5cv4-jp36-h3mw","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5028, GHSA-5cv4-jp36-h3mw","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GHSA-5cv4-jp36-h3mw"},{"rule_id":"osv/GO-2026-5029","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5029","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-5029"},{"rule_id":"osv/GO-2026-5030","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5030","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-5030"},{"rule_id":"osv/GO-2026-5942","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-5942","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-5942"},{"rule_id":"osv/GO-2026-6603","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6603","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6603"},{"rule_id":"osv/GO-2026-6610","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6610","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6610"},{"rule_id":"osv/GO-2026-6611","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6611","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6611"},{"rule_id":"osv/GO-2026-6612","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6612","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6612"},{"rule_id":"osv/GO-2026-6617","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6617","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6617"},{"rule_id":"osv/GO-2026-6860","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6860","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6860"},{"rule_id":"osv/GO-2026-6866","severity":"medium","message":"golang.org/x/net@0.43.0 (Go) is affected by GO-2026-6866","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/net@0.43.0 (Go):GO-2026-6866"},{"rule_id":"osv/GO-2026-5024","severity":"medium","message":"golang.org/x/sys@0.35.0 (Go) is affected by GO-2026-5024","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/sys@0.35.0 (Go):GO-2026-5024"},{"rule_id":"osv/GO-2026-5970","severity":"medium","message":"golang.org/x/text@0.28.0 (Go) is affected by GO-2026-5970","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/text@0.28.0 (Go):GO-2026-5970"},{"rule_id":"osv/GO-2026-6629","severity":"medium","message":"golang.org/x/text@0.28.0 (Go) is affected by GO-2026-6629","path":"libcore/go.mod","line":null,"fingerprint":"golang.org/x/text@0.28.0 (Go):GO-2026-6629"},{"rule_id":"osv/GHSA-qc2q-p7wx-3px3","severity":"medium","message":"google.golang.org/grpc@1.73.0 (Go) is affected by GO-2026-6441, GHSA-qc2q-p7wx-3px3","path":"libcore/go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.73.0 (Go):GHSA-qc2q-p7wx-3px3"}],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"failed","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"zizmor exited 1:     0: failed to load file:///workspace/runs/github.com/MatsuriDayo/NekoBoxForAndroid/repo/.github/workflows/preview.yml as workflow |     1: couldn't turn input into a an appropriate model |     2: data did not match any variant of untagged enum TriggerWire"},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.32,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":2.0,"binary_assets":36.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release 1.4.2 ships NekoBox-1.4.2-arm64-v8a.apk (743197 downloads)","ref":"NekoBox-1.4.2-arm64-v8a.apk","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-arm64-v8a.apk","weight":0.0},{"kind":"binary-release-asset","description":"release 1.4.2 ships NekoBox-1.4.2-armeabi-v7a.apk (78049 downloads)","ref":"NekoBox-1.4.2-armeabi-v7a.apk","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-armeabi-v7a.apk","weight":0.0},{"kind":"binary-release-asset","description":"release 1.4.2 ships NekoBox-1.4.2-x86.apk (47082 downloads)","ref":"NekoBox-1.4.2-x86.apk","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-x86.apk","weight":0.0},{"kind":"binary-release-asset","description":"release 1.4.2 ships NekoBox-1.4.2-x86_64.apk (59065 downloads)","ref":"NekoBox-1.4.2-x86_64.apk","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.2/NekoBox-1.4.2-x86_64.apk","weight":0.0},{"kind":"binary-release-asset","description":"release 1.4.1 ships NekoBox-1.4.1-arm64-v8a.apk (271341 downloads)","ref":"NekoBox-1.4.1-arm64-v8a.apk","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/releases/download/1.4.1/NekoBox-1.4.1-arm64-v8a.apk","weight":0.0},{"kind":"readme-download-lure","description":"links to file hosts or shorteners: t.me/","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1443.0,"function_nloc":15455.0,"mean_ccn":2.69,"p90_ccn":5.0,"complex_functions":27.0,"long_functions":10.0,"many_param_functions":2.0,"risky_nloc_share":0.1708},"findings":[],"evidence":[{"kind":"complex-function","description":"parseRaw in app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt: complexity 160, 389 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt#L227","weight":1.0},{"kind":"complex-function","description":"onMenuItemClick in app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt: complexity 52, 200 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt#L346","weight":0.8666666666666667},{"kind":"complex-function","description":"buildChain in app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt: complexity 38, 146 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt#L248","weight":0.6333333333333333},{"kind":"complex-function","description":"bind in app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt: complexity 30, 135 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt#L1489","weight":0.5},{"kind":"complex-function","description":"(anonymous) in app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt: complexity 25, 160 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt#L478","weight":0.4166666666666667},{"kind":"complex-function","description":"discover in libcore/stun/discover.go: complexity 25, 82 lines","ref":"libcore/stun/discover.go","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/libcore/stun/discover.go#L66","weight":0.4166666666666667},{"kind":"complex-function","description":"StandardV2RayBean::initializeDefaultValues in app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java: complexity 24, 32 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java#L70","weight":0.4},{"kind":"complex-function","description":"String in app/src/main/java/io/nekohasekai/sagernet/ktx/Formats.kt: complexity 24, 120 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/ktx/Formats.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/ktx/Formats.kt#L113","weight":0.4},{"kind":"complex-function","description":"startVpn in app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt: complexity 22, 91 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt#L89","weight":0.36666666666666664},{"kind":"complex-function","description":"doUpdate in app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt: complexity 22, 152 lines","ref":"app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt#L41","weight":0.36666666666666664}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":19650.0,"duplicated_lines":2858.0,"duplicated_share":0.1454,"files":240.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt:6 and app/src/main/java/io/nekohasekai/sagernet/fmt/mieru/MieruBean.java:4","ref":"app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt#L6","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt:12 and app/src/main/java/io/nekohasekai/sagernet/ui/QuickDisableShortcut.kt:12","ref":"app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt:76 and app/src/main/java/io/nekohasekai/sagernet/ui/QuickEnableShortcut.kt:47","ref":"app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt#L76","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt:21 and app/src/main/java/io/nekohasekai/sagernet/group/GroupInterfaceAdapter.kt:30","ref":"app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt:40 and app/src/main/java/io/nekohasekai/sagernet/database/ProfileManager.kt:47","ref":"app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt#L40","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt:37 and app/src/main/java/io/nekohasekai/sagernet/database/preference/PublicDatabase.kt:19","ref":"app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt#L37","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/database/SubscriptionBean.java:49 and app/src/main/java/io/nekohasekai/sagernet/database/SubscriptionBean.java:67","ref":"app/src/main/java/io/nekohasekai/sagernet/database/SubscriptionBean.java","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/database/SubscriptionBean.java#L49","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt:279 and app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt:318","ref":"app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt#L279","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt:301 and app/src/main/java/io/nekohasekai/sagernet/fmt/tuic/TuicFmt.kt:84","ref":"app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt#L301","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/java/io/nekohasekai/sagernet/fmt/internal/InternalBean.java:12 and app/src/main/java/moe/matsuri/nb4a/proxy/neko/NekoBean.java:67","ref":"app/src/main/java/io/nekohasekai/sagernet/fmt/internal/InternalBean.java","url":"https://github.com/MatsuriDayo/NekoBoxForAndroid/blob/5768494d8ae3c74a057bb6d46c0f8dc071b0d821/app/src/main/java/io/nekohasekai/sagernet/fmt/internal/InternalBean.java#L12","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":16.0,"weighted_findings":5.5,"scanned_lines":33118.0,"category:best-practice":1.0,"category:correctness":15.0},"findings":[{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"libcore/dns_box.go","line":135,"fingerprint":"go.lang.best-practice.hidden-goroutine:libcore/dns_box.go:135"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"libcore/nb4a.go","line":51,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:libcore/nb4a.go:51"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":6,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:6"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":7,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:7"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":8,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:8"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":20,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:20"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:25"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":26,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:26"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"buildScript/lib/assets.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:buildScript/lib/assets.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"libcore/build.sh","line":8,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:libcore/build.sh:8"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"libcore/build.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:libcore/build.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"libcore/build.sh","line":22,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:libcore/build.sh:22"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"libcore/build.sh","line":23,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:libcore/build.sh:23"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"libcore/build.sh","line":24,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:libcore/build.sh:24"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":33118.0,"test_ratio":0.0,"ci_files":2.0,"cochange_share":0.0,"cochange_commits":246.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/preview.yml","ref":".github/workflows/preview.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":63.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}