Leaderboard github.com
FuelLabs/fuel-core
Rust full node implementation of the Fuel v2 protocol.
AI provenance
2%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
75/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
33/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
2% explicit
Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.
How the score is built
- Explicitly attributed share2%
- Unattributed share in AI-pace bursts2%
- Estimated AI-generated share2%
- AI tool configuration files1
- Work sessions at AI pace1
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.01
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Cursor agent | 5 | 5,105 | 2026-08-25 | 2026-11-09 |
| Claude Code | 9 | 1,274 | 2026-05-13 | 2026-08-29 |
Lines added per month all AI-attributed share
- 2020-080 · 0% AI
- 2020-112,934 · 0% AI
- 2020-121,457 · 0% AI
- 2021-053,757 · 0% AI
- 2021-06631 · 0% AI
- 2021-07232 · 0% AI
- 2021-081,977 · 0% AI
- 2021-0942 · 0% AI
- 2021-10101 · 0% AI
- 2021-119,472 · 0% AI
- 2021-12630 · 0% AI
- 2022-01939 · 0% AI
- 2022-026,272 · 0% AI
- 2022-034,732 · 0% AI
- 2022-042,287 · 0% AI
- 2022-055,171 · 0% AI
- 2022-065,519 · 0% AI
- 2022-073,487 · 0% AI
- 2022-084,151 · 0% AI
- 2022-0912,358 · 0% AI
- 2022-1012,810 · 0% AI
- 2022-115,191 · 0% AI
- 2022-1214,884 · 0% AI
- 2023-0116,176 · 0% AI
- 2023-025,788 · 0% AI
- 2023-034,838 · 0% AI
- 2023-044,149 · 0% AI
- 2023-054,105 · 0% AI
- 2023-063,479 · 0% AI
- 2023-072,391 · 0% AI
- 2023-084,413 · 0% AI
- 2023-092,080 · 0% AI
- 2023-105,115 · 0% AI
- 2023-115,045 · 0% AI
- 2023-124,954 · 0% AI
- 2024-019,311 · 0% AI
- 2024-025,231 · 0% AI
- 2024-0324,091 · 0% AI
- 2024-0411,253 · 0% AI
- 2024-052,211 · 0% AI
- 2024-066,928 · 0% AI
- 2024-076,522 · 0% AI
- 2024-087,788 · 0% AI
- 2024-098,199 · 0% AI
- 2024-1023,688 · 0% AI
- 2024-115,448 · 0% AI
- 2024-123,763 · 0% AI
- 2025-0114,240 · 0% AI
- 2025-0216,283 · 0% AI
- 2025-0321,856 · 0% AI
- 2025-047,210 · 0% AI
- 2025-05998 · 0% AI
- 2025-061,356 · 0% AI
- 2025-07379 · 0% AI
- 2025-08762 · 0% AI
- 2025-093,584 · 0% AI
- 2025-104,847 · 0% AI
- 2025-111,437 · 0% AI
- 2025-12322 · 0% AI
- 2026-017,482 · 0% AI
- 2026-021,304 · 0% AI
- 2026-038,099 · 0% AI
- 2026-044,335 · 0% AI
- 2026-05759 · 82% AI
- 2026-0630 · 100% AI
- 2026-083,941 · 100% AI
- 2026-091,112 · 0% AI
- 2026-10221 · 0% AI
- 2026-111,782 · 100% AI
Findings in AI-attributed lines vs the rest
From git blame: 5,917 lines trace to AI-attributed commits, 161,845 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.01 | 0.00× |
| Security | 0.00 | 0.16 | 0.00× |
Evidence by analyzer
Explicit AI attributionok16 items
- Claude Code: 9 attributed commits, 1,274 lines added
- Cursor agent: 5 attributed commits, 5,105 lines added
- Cursor agent: trailer 'Co-authored-by: Cursor'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- attributed_commit_share
- 0.9%
- attributed_commits
- 14
- attributed_loc
- 6,379
- attributed_loc_share
- 1.7%
- commits
- 1,517
- effective_loc
- 378,339
- tools_detected
- 2
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-08-25
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok1 item
- excluded_import_loc
- 40,126
- flagged_loc
- 6,504
- flagged_loc_share
- 1.9%
- flagged_units
- 1
- max_loc_per_hour
- 1,380
- measured_loc
- 338,213
- median_loc_per_hour
- 3.52
- pr_timed_units
- 1,100
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 5,648
- work_units
- 1,107
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 1,587.90
- releases
- 90
Coding styleok2 items
- step-by-step narration comment: // first, because it adds additional information to the final response.
- step-by-step narration comment: // First, update the adaptive page sizer, to have the updated page size.
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 2
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 2
- files:placeholder
- 0
- index
- 0.01
- lines_scanned
- 167,762
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0.01
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 5,917
- blame_failures
- 0
- files_blamed
- 687
- other_lines
- 161,845
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 1
- quality:other_per_kloc
- 0.01
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 26
- security:other_per_kloc
- 0.16
- security:ratio
- 0
Code quality
75 adequate
Code quality is adequate: test-to-source ratio 0.19, CI runs tests; 13% of function code in complex or long functions; 16% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity67
- Duplication38
- Lint and smells100
- Tests and CI84
- Documentation100
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- try_from in crates/client/src/client/schema/tx/transparent_receipt.rs: complexity 77, 333 lines
- try_from in crates/client/src/client/schema/tx/transparent_tx.rs: complexity 64, 266 lines
- receipt_from_proto in crates/services/block_aggregator_api/src/blocks/old_block_source/convertor_adapter/proto_to_fuel_conversions.rs: complexity 44, 199 lines
- tx_from_proto_tx in crates/services/block_aggregator_api/src/blocks/old_block_source/convertor_adapter/proto_to_fuel_conversions.rs: complexity 42, 275 lines
- rollback_to in crates/fuel-core/src/combined_database.rs: complexity 40, 119 lines
- input_from_proto_input in crates/services/block_aggregator_api/src/blocks/old_block_source/convertor_adapter/proto_to_fuel_conversions.rs: complexity 36, 211 lines
- get_config in bin/fuel-core/src/cli/run.rs: complexity 30, 413 lines
- init_sub_services in crates/fuel-core/src/service/sub_services.rs: complexity 30, 433 lines
- run in crates/services/p2p/src/service.rs: complexity 29, 150 lines
- run_workers in crates/fuel-core/src/service/genesis/importer.rs: complexity 28, 31 lines
- complex_functions
- 42
- function_nloc
- 99,329
- functions
- 6,545
- long_functions
- 66
- many_param_functions
- 21
- mean_ccn
- 2.09
- p90_ccn
- 4
- risky_nloc_share
- 13.3%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: benches/benches/block_target_gas.rs:60 and benches/benches/vm_set/alu.rs:16
- 6+ duplicated lines: benches/benches/block_target_gas.rs:380 and benches/benches/vm_set/blockchain.rs:123
- 6+ duplicated lines: benches/benches/block_target_gas.rs:399 and crates/fuel-core/src/service.rs:215
- 6+ duplicated lines: benches/benches/block_target_gas_set/alu.rs:396 and benches/benches/vm_set/alu.rs:359
- 6+ duplicated lines: benches/benches/block_target_gas_set/alu.rs:406 and benches/benches/block_target_gas_set/alu.rs:478
- 6+ duplicated lines: benches/benches/block_target_gas_set/contract.rs:105 and benches/benches/block_target_gas_set/contract.rs:294
- 6+ duplicated lines: benches/benches/block_target_gas_set/crypto.rs:24 and benches/benches/block_target_gas_set/crypto.rs:49
- 6+ duplicated lines: benches/benches/block_target_gas_set/crypto.rs:80 and benches/benches/vm_set/crypto.rs:61
- 6+ duplicated lines: benches/benches/block_target_gas_set/memory.rs:43 and benches/benches/block_target_gas_set/memory.rs:44
- 6+ duplicated lines: benches/benches/db_lookup_times.rs:25 and benches/benches/db_lookup_times.rs:53
- compared_lines
- 119,577
- duplicated_lines
- 19,273
- duplicated_share
- 16.1%
- files
- 687
Lintok
- category:correctness
- 1
- findings
- 1
- scanned_lines
- 167,581
- weighted_findings
- 0.25
Tests and CIok12 items
- CI config: .github/workflows/chaos-test.yml
.github/workflows/chaos-test.yml - CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/create_version.yml
.github/workflows/create_version.yml - CI config: .github/workflows/delete-test-env.yml
.github/workflows/delete-test-env.yml - CI config: .github/workflows/dependencies.yml
.github/workflows/dependencies.yml - CI config: .github/workflows/deploy-test-env.yml
.github/workflows/deploy-test-env.yml - CI config: .github/workflows/docker-images.yml
.github/workflows/docker-images.yml - CI config: .github/workflows/e2e-test-beta4-dev.yml
.github/workflows/e2e-test-beta4-dev.yml - CI config: .github/workflows/nightly-benchmark.yml
.github/workflows/nightly-benchmark.yml - CI config: .github/workflows/nightly-cargo-audit.yml
.github/workflows/nightly-cargo-audit.yml - CI runs tests (go test, cargo test)
- CI runs linters (clippy, rustfmt)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 14
- cochange_commits
- 226
- cochange_share
- 39.8%
- source_lines
- 167,762
- test_lines
- 31,506
- test_ratio
- 0.19
Documentationok4 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 155
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
33 poor
Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 167 known vulnerabilities in 63 dependencies; 3 high-severity SAST findings; 114 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets17
- Static analysis (SAST)98
- Vulnerable dependencies1
- CI workflows0
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 137
- declared
- 137
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 1
- secrets_history
- 0
- secrets_low_confidence
- 30
- secrets_nonprod
- 10
Static analysis (opengrep)ok
- findings
- 28
- findings_high
- 3
- findings_low
- 25
- findings_medium
- 0
- parse_errors
- 17
- scanned_lines
- 167,581
- weighted_findings
- 11.65
Dependencies (osv-scanner)ok
- penalty
- 284
- vulnerabilities
- 167
- vulnerable_packages
- 63
- vulns_critical
- 4
- vulns_high
- 24
- vulns_low
- 17
- vulns_medium
- 28
- vulns_unknown
- 94
CI workflows (zizmor)ok
- findings
- 205
- findings_high
- 114
- findings_low
- 58
- findings_medium
- 33
- penalty
- 1,421.10
- workflows
- 14
Security postureok21 items
- Security policy: SECURITY.md
SECURITY.md - benches/Cargo.toml has no lockfile alongside it (unpinned dependencies)
benches/Cargo.toml - benches/benches-outputs/Cargo.toml has no lockfile alongside it (unpinned dependencies)
benches/benches-outputs/Cargo.toml - bin/chaos-test/Cargo.toml has no lockfile alongside it (unpinned dependencies)
bin/chaos-test/Cargo.toml - bin/e2e-test-client/Cargo.toml has no lockfile alongside it (unpinned dependencies)
bin/e2e-test-client/Cargo.toml - bin/fuel-core-client/Cargo.toml has no lockfile alongside it (unpinned dependencies)
bin/fuel-core-client/Cargo.toml - bin/fuel-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)
bin/fuel-core/Cargo.toml - bin/keygen/Cargo.toml has no lockfile alongside it (unpinned dependencies)
bin/keygen/Cargo.toml - crates/chain-config/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/chain-config/Cargo.toml - crates/client/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/client/Cargo.toml - crates/compression/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/compression/Cargo.toml - crates/database/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/database/Cargo.toml - crates/fuel-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/fuel-core/Cargo.toml - crates/fuel-gas-price-algorithm/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/fuel-gas-price-algorithm/Cargo.toml - crates/keygen/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/keygen/Cargo.toml - crates/metrics/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/metrics/Cargo.toml - crates/provider/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/provider/Cargo.toml - crates/services/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/services/Cargo.toml - crates/services/block_aggregator_api/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/services/block_aggregator_api/Cargo.toml - crates/services/compression/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/services/compression/Cargo.toml - crates/services/consensus_module/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/services/consensus_module/Cargo.toml
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 99.5%
- unpinned_manifests
- 41
Release downloadsok5 items
- release v0.48.4 ships fuel-core-0.48.4-aarch64-apple-darwin.tar.gz (5 downloads)
- release v0.48.4 ships fuel-core-0.48.4-aarch64-unknown-linux-gnu.tar.gz (6 downloads)
- release v0.48.4 ships fuel-core-0.48.4-x86_64-apple-darwin.tar.gz (5 downloads)
- release v0.48.4 ships fuel-core-0.48.4-x86_64-unknown-linux-gnu.tar.gz (23 downloads)
- release v0.48.3 ships fuel-core-0.48.3-aarch64-apple-darwin.tar.gz (237 downloads)
- binary_assets
- 40
- signals
- 1
- suspicious
- 0
Findings
4 critical142 high155 medium120 low16 info
437 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-897f-g5gm-fmxm |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0380, GHSA-897f-g5gm-fmxm | Dependencies (osv-scanner) |
| critical | osv/GHSA-mghf-wjfp-p5xm |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0379, GHSA-mghf-wjfp-p5xm | Dependencies (osv-scanner) |
| critical | osv/RUSTSEC-2026-0095 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0095 | Dependencies (osv-scanner) |
| critical | osv/RUSTSEC-2026-0096 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0096 | Dependencies (osv-scanner) |
| high | zizmor/unpinned-uses |
.github/actions/slack-notify-template/action.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/chaos-test.yml:117 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/chaos-test.yml:42 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/chaos-test.yml:45 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/chaos-test.yml:65 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/chaos-test.yml:68 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/chaos-test.yml:74 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/chaos-test.yml:93 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/chaos-test.yml:94 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/chaos-test.yml:95 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/chaos-test.yml:96 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:158 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:159 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:165 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:168 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:169 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:169 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:180 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:180 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:194 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:204 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:205 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:210 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:234 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:235 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:238 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:239 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:239 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:271 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:273 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:276 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:277 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:277 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:313 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:315 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:328 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:329 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:329 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:377 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/ci.yml:384 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:396 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:399 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:405 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:439 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:443 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:447 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:455 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:462 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:477 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:486 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:543 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:556 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:557 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:62 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:64 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:75 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:76 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:87 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/create_version.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/create_version.yml:26 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/delete-test-env.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:63 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:66 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependencies.yml:70 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/deploy-test-env.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:110 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:113 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:116 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:123 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:128 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:135 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:142 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:156 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:167 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:181 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:204 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:207 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:210 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:217 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:222 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:229 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:236 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:250 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:261 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:275 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:300 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:49 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:62 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:68 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:82 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/e2e-test-beta4-dev.yml:12 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-benchmark.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-benchmark.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-benchmark.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-benchmark.yml:47 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-benchmark.yml:66 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-cargo-audit.yml:11 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-cargo-audit.yml:12 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-codecov.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-codecov.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-codecov.yml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-codecov.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/publish-codecov.yml:58 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/releasy-dependency-commits.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/spellcheck.yml:11 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update_readme_versions.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-2f9f-gq7v-9h6m |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0435, GHSA-2f9f-gq7v-9h6m; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-2pgj-5cv2-6xxw |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-2pgj-5cv2-6xxw; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-3v94-mw7p-v465 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0118, GHSA-3v94-mw7p-v465; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-5j98-2g5x-46v6 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-5j98-2g5x-46v6 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-6w6g-hm98-mhgm |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0513, GHSA-6w6g-hm98-mhgm; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-vxx9-2994-q338 |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-vxx9-2994-q338; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0505 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0505; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0509 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0509; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| high | gitleaks/coinbase-access-token |
bin/e2e-test-client/src/snapshots/fuel_core_e2e_client__config__tests__default_config_snapshot.snap:8 | Possible coinbase-access-token secret in the current tree | Secrets (gitleaks) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
deployment/Dockerfile:91 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
deployment/Dockerfile:92 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
deployment/e2e-client.Dockerfile:48 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | osv/GHSA-2pgj-5cv2-6xxw |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-2pgj-5cv2-6xxw | Dependencies (osv-scanner) |
| high | osv/GHSA-5gc2-7c65-8fq8 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-5gc2-7c65-8fq8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5hq8-qhww-jm7q |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0525, GHSA-5hq8-qhww-jm7q | Dependencies (osv-scanner) |
| high | osv/GHSA-5j98-2g5x-46v6 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6 | Dependencies (osv-scanner) |
| high | osv/GHSA-82j2-j2ch-gfr8 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8 | Dependencies (osv-scanner) |
| high | osv/GHSA-8qv2-5vq6-g2g7 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2023-0052, GHSA-8qv2-5vq6-g2g7 | Dependencies (osv-scanner) |
| high | osv/GHSA-gc42-3jg7-rxr2 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0535, GHSA-gc42-3jg7-rxr2 | Dependencies (osv-scanner) |
| high | osv/GHSA-hx6p-xpx3-jvvv |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0093, GHSA-hx6p-xpx3-jvvv | Dependencies (osv-scanner) |
| high | osv/GHSA-m758-wjhj-p3jq |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0085, GHSA-m758-wjhj-p3jq | Dependencies (osv-scanner) |
| high | osv/GHSA-xqmp-fxgv-xvq5 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0537, GHSA-xqmp-fxgv-xvq5 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2024-0336 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0336 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0269 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0269 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0340 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0340 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0343 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0343 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0505 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0505 | Dependencies (osv-scanner) |
| medium | zizmor/excessive-permissions |
.github/workflows/chaos-test.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/chaos-test.yml:35 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/chaos-test.yml:57 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/template-injection |
.github/workflows/chaos-test.yml:88 | code injection via template expansion [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/template-injection |
.github/workflows/chaos-test.yml:88 | code injection via template expansion [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:200 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:216 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:248 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:300 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:33 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:359 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:370 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:386 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:410 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/archived-uses |
.github/workflows/ci.yml:543 | action or reusable workflow from archived repository [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:552 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:59 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:72 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:84 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:92 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/delete-test-env.yml:12 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/deploy-test-env.yml:12 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/docker-images.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/docker-images.yml:109 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/docker-images.yml:203 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/docker-images.yml:286 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/e2e-test-beta4-dev.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/nightly-benchmark.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/nightly-benchmark.yml:16 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/nightly-cargo-audit.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/releasy-dependency-commits.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/spellcheck.yml:7 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | osv/GHSA-3pv8-6f4r-ffg2 |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-3pv8-6f4r-ffg2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6f2x-v7q7-m7m5 |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-6f2x-v7q7-m7m5; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-6f2x-v7q7-m7m5 |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-6f2x-v7q7-m7m5; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-7gcf-g7xr-8hxj |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-7gcf-g7xr-8hxj | Dependencies (osv-scanner) |
| medium | osv/GHSA-g98v-hv3f-hcfr |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2021-0145, GHSA-g98v-hv3f-hcfr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2qq-hmj6-3wpp |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0119, GHSA-q2qq-hmj6-3wpp; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2023-0089 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2023-0089; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0375 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0375 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0388 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0388; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0436 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0436; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0449 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0449 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0105 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0105 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0173 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0173; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0253 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0253 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0386 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0386 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0387 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0387; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0441 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0441; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0487 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0487; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0487 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0487; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0488 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0488; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0489 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0489; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0489 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0489; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0490 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0490; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0490 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0490; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0491 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0491; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0491 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0491; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0504 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0504; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0506 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0506; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0507 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0507; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0508 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0508; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0511 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0511; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0512 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0512; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0515 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0515; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0516 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0516; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0517 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0517; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0518 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0518; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0519 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0519; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0520 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0520; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0523 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0523 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0524 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0524 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0530 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0530; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0531 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0531; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0532 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0532; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0534 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0534; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0538 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0538 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0539 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0539; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0540 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0540; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0541 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0541; also in version-compatibility/Cargo.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-243v-98vx-264h |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0021, GHSA-243v-98vx-264h | Dependencies (osv-scanner) |
| medium | osv/GHSA-2mjx-qc3c-rqvc |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc | Dependencies (osv-scanner) |
| medium | osv/GHSA-394w-hwhg-8vgm |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0091, GHSA-394w-hwhg-8vgm | Dependencies (osv-scanner) |
| medium | osv/GHSA-4p46-pwfr-66x6 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0009, GHSA-4p46-pwfr-66x6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-852m-cvvp-9p4w |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0020, GHSA-852m-cvvp-9p4w | Dependencies (osv-scanner) |
| medium | osv/GHSA-c8m5-c952-6cm4 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-c8m5-c952-6cm4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c8m5-c952-6cm4 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c8m5-c952-6cm4 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h395-gr6q-cpjc |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-h395-gr6q-cpjc | Dependencies (osv-scanner) |
| medium | osv/GHSA-h97m-ww89-6jmq |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0421, GHSA-h97m-ww89-6jmq | Dependencies (osv-scanner) |
| medium | osv/GHSA-jxhv-7h78-9775 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0092, GHSA-jxhv-7h78-9775 | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2qq-hmj6-3wpp |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0119, GHSA-q2qq-hmj6-3wpp | Dependencies (osv-scanner) |
| medium | osv/GHSA-q8hx-mm92-4wvg |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-q8hx-mm92-4wvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-qqfj-4vcm-26hv |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0087, GHSA-qqfj-4vcm-26hv | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2020-0168 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2020-0168 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0384 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0384 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0010 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0010 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0057 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0057 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0119 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0119 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0134 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0134 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0141 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0141 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0089 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0089 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0094 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0094 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0253 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0253 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0253 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0253 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0258 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0258 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0338 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0338 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0363 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0363 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0381 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0381 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0381 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0381 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0382 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0382 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0382 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0382 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0383 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0383 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0385 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0385 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0386 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0386 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0391 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0391 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0395 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0395 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0395 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0395 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0396 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0396 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0397 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0397 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0397 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0397 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0398 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0398 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0399 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0399 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0399 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0399 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0400 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0400 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0400 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0400 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0401 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0401 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0401 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0401 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0402 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0402 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0402 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0402 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0403 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0403 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0403 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0403 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0404 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0404 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0404 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0404 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0405 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0405 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0406 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.2 (crates.io) is affected by RUSTSEC-2026-0406 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0406 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0406 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0410 |
version-compatibility/Cargo.lock | [email protected]+zstd.1.5.7 (crates.io) is affected by RUSTSEC-2026-0410 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0418 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0418 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0424 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0424 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0487 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0487 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0489 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0489 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0490 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0490 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0491 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0491 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0511 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0511 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0512 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0512 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0523 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0523 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0524 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0524 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0530 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0530 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0531 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0531 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0534 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0534 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0536 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0536 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0538 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0538 | Dependencies (osv-scanner) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
.github/workflows/scripts/verify_tag.sh:28 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/artipacked |
.github/workflows/chaos-test.yml:65 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:158 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:203 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:234 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:271 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:313 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:37 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:376 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:395 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:438 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/ci.yml:532 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:556 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:62 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:75 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:87 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/create_version.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/delete-test-env.yml:16 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/delete-test-env.yml:33 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/delete-test-env.yml:33 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/dependencies.yml:32 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/dependencies.yml:62 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/deploy-test-env.yml:16 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/deploy-test-env.yml:33 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/deploy-test-env.yml:33 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/docker-images.yml:38 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/docker-images.yml:94 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/e2e-test-beta4-dev.yml:12 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/nightly-benchmark.yml:25 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/nightly-benchmark.yml:65 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/nightly-cargo-audit.yml:11 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/publish-codecov.yml:28 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/publish-codecov.yml:41 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/publish-codecov.yml:50 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/publish-codecov.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/releasy-dependency-commits.yml:15 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/spellcheck.yml:10 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/update_readme_versions.yml:15 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | osv/GHSA-6g2r-675j-hx59 |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-6g2r-675j-hx59 | Dependencies (osv-scanner) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:113 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:126 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:131 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:144 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
benches/src/utils.rs:24 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:62 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:75 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:80 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
benches/src/utils.rs:94 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | gitleaks/coinbase-access-token |
bin/e2e-test-client/README.md:13 | Possible coinbase-access-token secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/e2e-test-client/README.md:17 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/e2e-test-client/src/snapshots/fuel_core_e2e_client__config__tests__default_config_snapshot.snap:11 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/e2e-test-client/src/tests/test_data/large_state/chain_config.json:275 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/e2e-test-client/src/tests/test_data/large_state/state_config.json:14 | Possible generic-api-key secret in history (commit 099853c739); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/e2e-test-client/tests/chainconfig.json:228 | Possible generic-api-key secret in history (commit c7bc4c2b57); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/fuel-core/chainspec/local-testnet/README.md:7 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/fuel-core/chainspec/local-testnet/chain_config.json:316 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bin/fuel-core/chainspec/local-testnet/state_config.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.temp-dir |
crates/chain-config/src/config/chain.rs:161 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/config/snapshots/fuel_core_chain_config__config__chain__tests__snapshot_configurable_block_height.snap.new:198 | Possible generic-api-key secret in history (commit d6027f3ab9); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/config/snapshots/fuel_core_chain_config__config__chain__tests__snapshot_configurable_block_height.snap:259 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/config/snapshots/fuel_core_chain_config__config__chain__tests__snapshot_local_testnet_config.snap.new:308 | Possible generic-api-key secret in history (commit 020656a7ee); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/config/snapshots/fuel_core_chain_config__config__chain__tests__snapshot_local_testnet_config.snap:320 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/config/state/snapshots/fuel_core_chain_config__config__state__writer__tests__json_snapshot_is_human_readable.snap:64 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_configurable_block_height.snap:264 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_contract_with_balances.snap:278 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_contract_with_state.snap:278 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_contract_with_tx_pointer.snap:274 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_contract_with_utxo_id.snap:274 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_local_testnet_config.snap:264 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_simple_coin_state.snap:277 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_simple_contract.snap:272 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/chain-config/src/snapshots/fuel_core_chain_config__config__tests__snapshot_simple_message_state.snap:276 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/fuel-core/src/state/rocks_db.rs:472 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
crates/services/consensus_module/poa/src/signer.rs:218 | Possible generic-api-key secret in history (commit 6ef1d58b2a); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/services/executor/src/hacks.rs:28 | Possible generic-api-key secret in history (commit 8fa66f2276); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/p2p/src/peer_manager.rs:354 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/src/seqlock.rs:141 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/src/seqlock.rs:170 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/src/seqlock.rs:48 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/src/seqlock.rs:92 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/txpool_v2/src/service.rs:807 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:146 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:165 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:180 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:198 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:224 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:245 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:250 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/services/upgradable-executor/wasm-executor/src/ext.rs:265 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
crates/types/src/signer.rs:247 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
deployment/scripts/chainspec/beta/chain_config.json:247 | Possible generic-api-key secret in history (commit c9757ad4fa); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
deployment/scripts/chainspec/beta_chainparams_spec.json:232 | Possible generic-api-key secret in history (commit 498dae6b3b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
deployment/scripts/chainspec/beta_chainspec.json:202 | Possible generic-api-key secret in history (commit 01827a4feb); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
deployment/scripts/chainspec/dev/chain_config.json:252 | Possible generic-api-key secret in history (commit 36e33631c2); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
deployment/scripts/chainspec/dev_chainparams_spec.json:193 | Possible generic-api-key secret in history (commit 498dae6b3b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
deployment/scripts/chainspec/dev_chainspec.json:172 | Possible generic-api-key secret in history (commit 01827a4feb); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | osv/GHSA-965h-392x-2mh5 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0098, GHSA-965h-392x-2mh5 | Dependencies (osv-scanner) |
| low | osv/GHSA-c2f5-jxjv-2hh8 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0438, GHSA-c2f5-jxjv-2hh8 | Dependencies (osv-scanner) |
| low | osv/GHSA-fm79-3f68-h2fc |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0046, GHSA-fm79-3f68-h2fc | Dependencies (osv-scanner) |
| low | osv/GHSA-h2v8-394m-p7vv |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-h2v8-394m-p7vv | Dependencies (osv-scanner) |
| low | osv/GHSA-h2v8-394m-p7vv |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by GHSA-h2v8-394m-p7vv | Dependencies (osv-scanner) |
| low | osv/GHSA-h2v8-394m-p7vv |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv | Dependencies (osv-scanner) |
| low | osv/GHSA-hc7m-r6v8-hg9q |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0118, GHSA-hc7m-r6v8-hg9q | Dependencies (osv-scanner) |
| low | osv/GHSA-rhfx-m35p-ff5j |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0002, GHSA-rhfx-m35p-ff5j | Dependencies (osv-scanner) |
| low | osv/GHSA-w44r-93j7-qv28 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28 | Dependencies (osv-scanner) |
| low | osv/GHSA-w44r-93j7-qv28 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28 | Dependencies (osv-scanner) |
| low | osv/GHSA-w44r-93j7-qv28 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28 | Dependencies (osv-scanner) |
| low | osv/GHSA-xgp8-3hg3-c2mh |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0099, GHSA-xgp8-3hg3-c2mh | Dependencies (osv-scanner) |
| low | osv/RUSTSEC-2026-0086 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0086 | Dependencies (osv-scanner) |
| low | osv/RUSTSEC-2026-0088 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0088 | Dependencies (osv-scanner) |
| low | osv/RUSTSEC-2026-0222 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0222 | Dependencies (osv-scanner) |
| low | osv/RUSTSEC-2026-0316 |
version-compatibility/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0316 | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/ignition-v21/README.md:7 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/ignition-v21/chain_config.json:315 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/ignition/README.md:6 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/ignition/chain_config.json:268 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/v36/README.md:8 | Possible generic-api-key secret in history (commit 301fb606d4); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/v36/chain_config.json:303 | Possible generic-api-key secret in history (commit 301fb606d4); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/v44/README.md:8 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
version-compatibility/forkless-upgrade/chain-configurations/v44/chain_config.json:303 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/create_version.yml:103 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/create_version.yml:75 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/create_version.yml:76 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/create_version.yml:83 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/create_version.yml:84 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/docker-images.yml:94 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:104 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:51 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:51 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:52 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:56 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:56 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:57 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:61 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:61 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update_readme_versions.yml:62 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 1 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 200 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 167 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 28 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 41 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 8bd82d4d1ff4 | prov-5+qual-2+sec-2 | 2% | 75 | 33 |
Full text report
- Repository: https://github.com/FuelLabs/fuel-core
- Commit:
8bd82d4d1ff4e6da7a0e9febbe96e6a864d79f1f - Generated: 2026-11-14T15:46:54+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 2 | explicit | 95% | 100% |
| Code quality | 75 | adequate | 90% | 100% |
| Security | 33 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.
- Explicitly attributed share (lower bound): 1.7%
- Unattributed share in AI-consistent velocity bursts: 1.7%
- Estimated AI-generated share: 1.7%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 9 | 1,274 |
| Cursor agent | 5 | 5,105 |
- AI tooling configured in repo: generic-agent
Current source lines last changed by AI-attributed commits: 5,917 of 167,762.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.006 | 0.0x |
| Security | 0.0 | 0.161 | 0.0x |
- Stylometry index: 0.01 per 1,000 lines (narrated steps 2, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-11 | 1,437 | 0% |
| 2025-12 | 322 | 0% |
| 2026-01 | 7,482 | 0% |
| 2026-02 | 1,304 | 0% |
| 2026-03 | 8,099 | 0% |
| 2026-04 | 4,335 | 0% |
| 2026-05 | 759 | 82% |
| 2026-06 | 30 | 100% |
| 2026-08 | 3,941 | 100% |
| 2026-09 | 1,112 | 0% |
| 2026-10 | 221 | 0% |
| 2026-11 | 1,782 | 100% |
Evidence
- Cursor agent: trailer 'Co-authored-by: Cursor' (8bd82d4d1ff4)
- Cursor agent: trailer 'Co-authored-by: Cursor' (773481623431)
- Cursor agent: trailer 'Co-authored-by: Cursor' (fec988ebe877)
- Cursor agent: trailer 'Co-authored-by: Cursor' (93a5400ecee3)
- Claude Code: trailer 'Co-authored-by: Claude' (5a8c7f85cf57)
- Claude Code: trailer 'Co-authored-by: Claude' (e40b9b3ee891)
- Claude Code: trailer 'Co-authored-by: Claude' (eceb72b9a073)
- Cursor agent: trailer 'Co-authored-by: Cursor' (ad8c75564a67)
- Claude Code: trailer 'Co-authored-by: Claude' (b9d4d170da3a)
- Claude Code: trailer 'Co-authored-by: Claude' (bafc0a4f4058)
- Claude Code: trailer 'Co-authored-by: Claude' (540fb5f1afdb)
- Claude Code: trailer 'Co-authored-by: Claude' (d7b0ac856a13)
- Claude Code: trailer 'Co-authored-by: Claude' (dd7fd89a700e)
- Claude Code: trailer 'Co-authored-by: Claude' (a433b39ada31)
- AGENTS.md (generic-agent configuration) (AGENTS.md)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.19, CI runs tests; 13% of function code in complex or long functions; 16% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 67 |
| Duplication | 38 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 84 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 6,545; mean complexity 2.1, 90th percentile 4; 42 complex and 66 long functions
- Duplicated lines: 16.1% of 119,577 compared
- Tests: 31,506 test lines for 167,762 source lines (ratio 0.19); CI test commands: go test, cargo test; 40% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- try_from in crates/client/src/client/schema/tx/transparent_receipt.rs: complexity 77, 333 lines
- try_from in crates/client/src/client/schema/tx/transparent_tx.rs: complexity 64, 266 lines
- receipt_from_proto in crates/services/block_aggregator_api/src/blocks/old_block_source/convertor_adapter/proto_to_fuel_conversions.rs: complexity 44, 199 lines
- tx_from_proto_tx in crates/services/block_aggregator_api/src/blocks/old_block_source/convertor_adapter/proto_to_fuel_conversions.rs: complexity 42, 275 lines
- rollback_to in crates/fuel-core/src/combined_database.rs: complexity 40, 119 lines
Security
Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 167 known vulnerabilities in 63 dependencies; 3 high-severity SAST findings; 114 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 17 |
| Static analysis (Opengrep) | 98 |
| Vulnerable dependencies (OSV) | 1 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 167 in 63 packages (critical 4, high 24, medium 28, low 17)
-
Posture checks passed: security policy, signed commits; missing: dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/RUSTSEC-2026-0095: [email protected] (crates.io) is affected by RUSTSEC-2026-0095 |
version-compatibility/Cargo.lock |
| critical | osv/RUSTSEC-2026-0096: [email protected] (crates.io) is affected by RUSTSEC-2026-0096 |
version-compatibility/Cargo.lock |
| critical | osv/GHSA-mghf-wjfp-p5xm: [email protected] (crates.io) is affected by RUSTSEC-2026-0379, GHSA-mghf-wjfp-p5xm |
version-compatibility/Cargo.lock |
| critical | osv/GHSA-897f-g5gm-fmxm: [email protected] (crates.io) is affected by RUSTSEC-2026-0380, GHSA-897f-g5gm-fmxm |
version-compatibility/Cargo.lock |
| high | gitleaks/coinbase-access-token: Possible coinbase-access-token secret in the current tree |
bin/e2e-test-client/src/snapshots/fuel_core_e2e_client__config__tests__default_config_snapshot.snap:8 |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
deployment/Dockerfile:91 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
deployment/Dockerfile:92 |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
deployment/e2e-client.Dockerfile:48 |
| high | osv/GHSA-2pgj-5cv2-6xxw: [email protected] (crates.io) is affected by GHSA-2pgj-5cv2-6xxw; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/RUSTSEC-2026-0509: [email protected] (crates.io) is affected by RUSTSEC-2026-0509; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-3v94-mw7p-v465: [email protected] (crates.io) is affected by RUSTSEC-2026-0118, GHSA-3v94-mw7p-v465; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/RUSTSEC-2026-0505: [email protected] (crates.io) is affected by RUSTSEC-2026-0505; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-5j98-2g5x-46v6: [email protected] (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-6w6g-hm98-mhgm: [email protected] (crates.io) is affected by RUSTSEC-2026-0513, GHSA-6w6g-hm98-mhgm; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-5j98-2g5x-46v6: [email protected] (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-2f9f-gq7v-9h6m: [email protected] (crates.io) is affected by RUSTSEC-2026-0435, GHSA-2f9f-gq7v-9h6m; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-vxx9-2994-q338: [email protected] (crates.io) is affected by GHSA-vxx9-2994-q338; also in version-compatibility/Cargo.lock |
Cargo.lock |
| high | osv/GHSA-5gc2-7c65-8fq8: [email protected] (crates.io) is affected by GHSA-5gc2-7c65-8fq8 |
version-compatibility/Cargo.lock |
| high | osv/GHSA-2pgj-5cv2-6xxw: [email protected] (crates.io) is affected by GHSA-2pgj-5cv2-6xxw |
version-compatibility/Cargo.lock |
| high | osv/RUSTSEC-2026-0505: [email protected] (crates.io) is affected by RUSTSEC-2026-0505 |
version-compatibility/Cargo.lock |
| high | osv/GHSA-5j98-2g5x-46v6: [email protected] (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6 |
version-compatibility/Cargo.lock |
| high | osv/GHSA-gc42-3jg7-rxr2: [email protected] (crates.io) is affected by RUSTSEC-2026-0535, GHSA-gc42-3jg7-rxr2 |
version-compatibility/Cargo.lock |
| high | osv/GHSA-xqmp-fxgv-xvq5: [email protected] (crates.io) is affected by RUSTSEC-2026-0537, GHSA-xqmp-fxgv-xvq5 |
version-compatibility/Cargo.lock |
| high | osv/GHSA-5hq8-qhww-jm7q: [email protected] (crates.io) is affected by RUSTSEC-2026-0525, GHSA-5hq8-qhww-jm7q |
version-compatibility/Cargo.lock |
| high | osv/RUSTSEC-2026-0340: [email protected] (crates.io) is affected by RUSTSEC-2026-0340 |
version-compatibility/Cargo.lock |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.48.4 ships fuel-core-0.48.4-aarch64-apple-darwin.tar.gz (5 downloads)
- binary-release-asset: release v0.48.4 ships fuel-core-0.48.4-aarch64-unknown-linux-gnu.tar.gz (6 downloads)
- binary-release-asset: release v0.48.4 ships fuel-core-0.48.4-x86_64-apple-darwin.tar.gz (5 downloads)
- binary-release-asset: release v0.48.4 ships fuel-core-0.48.4-x86_64-unknown-linux-gnu.tar.gz (23 downloads)
- binary-release-asset: release v0.48.3 ships fuel-core-0.48.3-aarch64-apple-darwin.tar.gz (237 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 167,762; test lines: 31,506
| Language | Lines |
|---|---|
| Rust | 198,819 |
| Shell | 251 |
| Lua | 181 |
| Python | 17 |