Leaderboard github.com
MHSanaei/3x-ui
Supporting multi-protocol multi-user(Vmess, Vless, Trojan, ShadowSocks, Wireguard, Hysteria, Tunnel, Mixed, HTTP, Tun, MTProto، AmneziaWG)
AI provenance
12%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
76/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
45/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
12% explicit
Explicit AI attribution on 12% of first-party code added; an estimated 12% including velocity signals.
How the score is built
- Explicitly attributed share12%
- Unattributed share in AI-pace bursts14%
- Estimated AI-generated share12%
- AI tool configuration files4
- Work sessions at AI pace13
- Releases at AI pace2
- Coding-style index (1.0+ means possible)0.15
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 74 | 71,000 | 2026-04-19 | 2026-11-13 |
| OpenAI Codex | 23 | 12,253 | 2026-07-28 | 2026-11-05 |
| GitHub Copilot coding agent | 8 | 761 | 2025-09-11 | 2026-10-12 |
| Cursor agent | 1 | 598 | 2026-06-06 | 2026-06-06 |
Lines added per month all AI-attributed share
- 2023-0257,979 · 0% AI
- 2023-031,787 · 0% AI
- 2023-043,292 · 0% AI
- 2023-053,958 · 0% AI
- 2023-061,009 · 0% AI
- 2023-071,166 · 0% AI
- 2023-08434 · 0% AI
- 2023-0949 · 0% AI
- 2023-1030 · 0% AI
- 2023-11296 · 0% AI
- 2023-1236,215 · 0% AI
- 2024-011,950 · 0% AI
- 2024-021,005 · 0% AI
- 2024-03841 · 0% AI
- 2024-0474,309 · 0% AI
- 2024-05373 · 0% AI
- 2024-06498 · 0% AI
- 2024-07568 · 0% AI
- 2024-08828 · 0% AI
- 2024-09467 · 0% AI
- 2024-101,056 · 0% AI
- 2024-11283 · 0% AI
- 2024-12396 · 0% AI
- 2025-01540 · 0% AI
- 2025-02206 · 0% AI
- 2025-031,866 · 0% AI
- 2025-04278 · 0% AI
- 2025-05692 · 0% AI
- 2025-0645 · 0% AI
- 2025-07244 · 0% AI
- 2025-08912 · 0% AI
- 2025-095,252 · 2% AI
- 2025-10795 · 0% AI
- 2025-11403 · 0% AI
- 2025-121,472 · 0% AI
- 2026-012,634 · 0% AI
- 2026-021,375 · 2% AI
- 2026-03105 · 0% AI
- 2026-046,614 · 7% AI
- 2026-05122,219 · 30% AI
- 2026-0685,862 · 3% AI
- 2026-0752,160 · 12% AI
- 2026-0861,492 · 28% AI
- 2026-0969,391 · 15% AI
- 2026-1066,311 · 12% AI
- 2026-1115,087 · 19% AI
Findings in AI-attributed lines vs the rest
From git blame: 23,340 lines trace to AI-attributed commits, 178,463 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.30 | 1.08 | 0.28× |
| Security | 0.51 | 0.35 | 1.46× |
Evidence by analyzer
Explicit AI attributionok29 items
- Claude Code: 74 attributed commits, 71,000 lines added
- OpenAI Codex: 23 attributed commits, 12,253 lines added
- GitHub Copilot coding agent: 8 attributed commits, 761 lines added
- Cursor agent: 1 attributed commits, 598 lines added
- Claude Code: PR branch 'claude/dns-draggable-ordering-da6918'
- OpenAI Codex: PR branch 'codex/issue-7023-inbound-a11y'
- OpenAI Codex: PR branch 'codex/fix-telegram-command-screens'
- OpenAI Codex: PR branch 'codex/fix-node-client-lifecycle'
- Claude Code: PR branch 'claude/unruffled-sinoussi-682e7e'
- OpenAI Codex: PR branch 'codex/fix-telegram-menu-media'
- OpenAI Codex: PR branch 'codex/issue-6993-keep-host-settings'
- OpenAI Codex: PR branch 'codex/fix-hysteria2-external-clash'
- Claude Code: PR branch 'claude/3x-ui-xray-balancer-i18n-cb0660'
- OpenAI Codex: PR branch 'codex/awg-kernel-upstream'
- OpenAI Codex: PR branch 'codex/awg-keepalive-range'
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: trailer 'Co-Authored-By: Claude'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: PR branch 'claude/6733-fix'
- OpenAI Codex: PR branch 'codex/client-calendar-weekly-renewal'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- OpenAI Codex: PR branch 'codex/pr-6572-verified'
- OpenAI Codex: PR branch 'codex/calendar-expiry-presentation'
- OpenAI Codex: PR branch 'codex/mihomo-reality-mlkem'
- attributed_commit_share
- 2.7%
- attributed_commits
- 106
- attributed_loc
- 84,612
- attributed_loc_share
- 12.4%
- commits
- 3,888
- effective_loc
- 684,744
- tools_detected
- 4
AI tool configurationok4 items
- CLAUDE.md (claude-code configuration)
- frontend/CLAUDE.md (claude-code configuration)
- .github/workflows/claude-issue-analyst.yml runs anthropics/claude-code-action
- .github/workflows/claude-pr-review.yml runs anthropics/claude-code-action
- artifacts
- 2
- earliest_adoption
- 2026-06-27
- tools_configured
- 1
- workflow_agents
- 2
Commit velocityok13 items
- 41,387 lines of first-party code in ~1.6h (25,565 lines/hour, 1 commit session)
- 34,981 lines of first-party code in ~4.0h (8,745 lines/hour, 1 commit session)
- 1,087 lines of first-party code in ~1.1h (989 lines/hour, 1 commit session)
- 1,133 lines of first-party code in ~1.2h (938 lines/hour, PR #5076)
- 1,240 lines of first-party code in ~1.3h (928 lines/hour, 2 commit session)
- 2,197 lines of first-party code in ~3.0h (735 lines/hour, 4 commit session)
- 1,703 lines of first-party code in ~2.3h (728 lines/hour, 8 commit session)
- 4,033 lines of first-party code in ~5.9h (686 lines/hour, 29 commit session)
- 1,166 lines of first-party code in ~1.7h (674 lines/hour, 4 commit session)
- 1,596 lines of first-party code in ~2.4h (667 lines/hour, 1 commit session)
- 1,457 lines of first-party code in ~2.4h (608 lines/hour, 1 commit session)
- 3,032 lines of first-party code in ~5.6h (544 lines/hour, 27 commit session)
- 2,264 lines of first-party code in ~4.4h (511 lines/hour, PR #5345)
- excluded_import_loc
- 213,639
- flagged_loc
- 97,276
- flagged_loc_share
- 23.1%
- flagged_units
- 13
- max_loc_per_hour
- 25,565.07
- measured_loc
- 421,279
- median_loc_per_hour
- 37.42
- pr_timed_units
- 807
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 1,708
Release velocityok2 items
- v2.2.8 → v2.3.0: 73,902 lines in 14.04 days (5,261.9 lines/day)
- v3.8.0 → v3.8.5: 6,222 lines in 1.3 days (4,769.2 lines/day)
- flagged_releases
- 2
- max_loc_per_day
- 5,261.90
- releases
- 99
Coding styleok4 items
- step-by-step narration comment: // Step 1: Get ClientTraffic records for emails in the input list.
- step-by-step narration comment: // Step 2: Sort clients by (Up + Down) descending
- step-by-step narration comment: // Step 3: Extract sorted valid emails and track found ones
- step-by-step narration comment: // Step 4: Identify emails that were not found in the database
- count:assistant_voice
- 0
- count:emoji_in_code
- 52
- count:narrated_steps
- 4
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 17
- files:narrated_steps
- 1
- files:placeholder
- 0
- index
- 0.15
- lines_scanned
- 201,805
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.26
- per_kloc:narrated_steps
- 0.02
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 23,340
- blame_failures
- 0
- files_blamed
- 921
- other_lines
- 178,463
- quality:ai_findings
- 7
- quality:ai_per_kloc
- 0.30
- quality:other_findings
- 193
- quality:other_per_kloc
- 1.08
- quality:ratio
- 0.28
- security:ai_findings
- 12
- security:ai_per_kloc
- 0.51
- security:other_findings
- 63
- security:other_per_kloc
- 0.35
- security:ratio
- 1.46
Code quality
76 adequate
Code quality is adequate: test-to-source ratio 0.79, CI runs tests; 30% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity41
- Duplication63
- Lint and smells85
- Tests and CI100
- Documentation80
- Type safety100
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- setRemoteTrafficLocked in internal/web/service/inbound_node.go: complexity 244, 849 lines
- answerCallback in internal/web/service/tgbot/tgbot_router.go: complexity 184, 815 lines
- InboundInfoModal in frontend/src/pages/inbounds/info/InboundInfoModal.tsx: complexity 137, 701 lines
- MergeClientRecord in internal/database/model/model.go: complexity 133, 223 lines
- BulkAdjust in internal/web/service/client_bulk.go: complexity 101, 282 lines
- UpdateInboundClient in internal/web/service/client_inbound_apply.go: complexity 98, 317 lines
- InboundFormModal in frontend/src/pages/inbounds/form/InboundFormModal.tsx: complexity 95, 561 lines
- AddInboundClient in internal/web/service/client_inbound_apply.go: complexity 80, 262 lines
- GetXrayConfig in internal/web/service/xray.go: complexity 80, 257 lines
- runSeeders in internal/database/db.go: complexity 76, 205 lines
- complex_functions
- 304
- function_nloc
- 137,333
- functions
- 9,666
- long_functions
- 133
- many_param_functions
- 10
- mean_ccn
- 3.88
- p90_ccn
- 8
- risky_nloc_share
- 29.5%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: DockerEntrypoint.sh:24 and x-ui.sh:2548
- 6+ duplicated lines: docs/components/tools/outbound-generator.tsx:21 and docs/components/tools/outbound-generator.tsx:36
- 6+ duplicated lines: docs/components/tools/shared/fields.tsx:22 and docs/components/tools/shared/fields.tsx:78
- 6+ duplicated lines: docs/lib/xray/outbounds.ts:91 and frontend/src/lib/xray/outbound-link-parser.ts:145
- 6+ duplicated lines: docs/lib/xray/protocols.ts:29 and docs/lib/xray/protocols.ts:50
- 6+ duplicated lines: frontend/scripts/build-openapi.mjs:281 and frontend/scripts/build-openapi.mjs:302
- 6+ duplicated lines: frontend/src/api/queries/useHostsQuery.ts:24 and frontend/src/api/queries/useRawHostsQuery.ts:42
- 6+ duplicated lines: frontend/src/components/clients/ClientSpeedTag.tsx:20 and frontend/src/pages/inbounds/list/InboundSpeedTag.tsx:26
- 6+ duplicated lines: frontend/src/components/clients/ConfigBlock.stories.tsx:9 and frontend/src/components/form/DateTimePicker.stories.tsx:40
- 6+ duplicated lines: frontend/src/components/clients/ConfigBlock.tsx:40 and frontend/src/pages/inbounds/qr/QrPanel.tsx:104
- compared_lines
- 147,528
- duplicated_lines
- 11,409
- duplicated_share
- 7.7%
- files
- 921
Lintok
- category:best-practice
- 49
- category:correctness
- 240
- category:maintainability
- 1
- findings
- 290
- scanned_lines
- 201,803
- weighted_findings
- 130
Tests and CIok12 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/claude-issue-analyst.yml
.github/workflows/claude-issue-analyst.yml - CI config: .github/workflows/claude-pr-review.yml
.github/workflows/claude-pr-review.yml - CI config: .github/workflows/cleanup_caches.yml
.github/workflows/cleanup_caches.yml - CI config: .github/workflows/codeql.yml
.github/workflows/codeql.yml - CI config: .github/workflows/docker.yml
.github/workflows/docker.yml - CI config: .github/workflows/docs-ci.yml
.github/workflows/docs-ci.yml - CI config: .github/workflows/docs-deploy.yml
.github/workflows/docs-deploy.yml - CI config: .github/workflows/mutation.yml
.github/workflows/mutation.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI runs tests (npm test, pnpm test, go test)
- CI runs linters (golangci-lint, shellcheck)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 10
- cochange_commits
- 267
- cochange_share
- 92.9%
- source_lines
- 201,803
- test_lines
- 158,766
- test_ratio
- 0.79
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 167
Type safetyok1 item
- TypeScript strict type checking: docs/tsconfig.json
docs/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- yes
- escapes
- 0
- escapes_per_kloc
- 0
Security
45 poor
Security posture is poor: 2 possible secret(s) in the tree, 4 only in history; 12 known vulnerabilities in 4 dependencies; 23 high-severity SAST findings; 80 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets2
- Static analysis (SAST)93
- Vulnerable dependencies57
- CI workflows0
- Security posture100
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 62
- declared
- 62
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 2
- secrets_history
- 4
- secrets_low_confidence
- 8
- secrets_nonprod
- 60
Static analysis (opengrep)ok
- findings
- 77
- findings_high
- 23
- findings_low
- 2
- findings_medium
- 52
- parse_errors
- 2
- scanned_lines
- 201,803
- weighted_findings
- 43.88
Dependencies (osv-scanner)ok
- penalty
- 34
- vulnerabilities
- 12
- vulnerable_packages
- 4
- vulns_critical
- 1
- vulns_high
- 3
- vulns_low
- 2
- vulns_medium
- 4
- vulns_unknown
- 2
CI workflows (zizmor)ok
- findings
- 104
- findings_high
- 80
- findings_low
- 21
- findings_medium
- 3
- penalty
- 921.30
- workflows
- 10
Security postureok2 items
- Security policy: SECURITY.md
SECURITY.md - Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 91.5%
- unpinned_manifests
- 0
Release downloadsok5 items
- release dev-latest ships x-ui-linux-386.tar.gz (8 downloads)
- release dev-latest ships x-ui-linux-amd64.tar.gz (323 downloads)
- release dev-latest ships x-ui-linux-arm64.tar.gz (14 downloads)
- release dev-latest ships x-ui-linux-armv5.tar.gz (10 downloads)
- release dev-latest ships x-ui-linux-armv6.tar.gz (7 downloads)
- binary_assets
- 80
- signals
- 1
- suspicious
- 0
Findings
1 critical109 high138 medium217 low2 info
467 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-cg2g-xh64-v4q7 |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 | Dependencies (osv-scanner) |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
docs/components/mdx/mermaid.tsx:26 | Calling setState on the current state is always a no-op. Did you mean to change the state like setSvg(!svg) instead? | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:180 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:181 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:211 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:212 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:216 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:230 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:231 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:246 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:247 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:264 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:265 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:280 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:281 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:295 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:296 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:303 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:316 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:317 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:338 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:339 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:68 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:69 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-issue-analyst.yml:168 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-issue-analyst.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-issue-analyst.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/claude-issue-analyst.yml:6 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:109 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:114 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:122 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:135 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:316 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:326 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:347 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/claude-pr-review.yml:352 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/claude-pr-review.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/claude-pr-review.yml:6 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/codeql.yml:40 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/codeql.yml:44 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/codeql.yml:44 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/codeql.yml:58 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/codeql.yml:64 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:24 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:41 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:47 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-ci.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-ci.yml:31 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-ci.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/docs-deploy.yml:20 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/docs-deploy.yml:21 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-deploy.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-deploy.yml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-deploy.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-deploy.yml:65 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs-deploy.yml:77 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/mutation.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/mutation.yml:40 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/mutation.yml:58 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:182 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:190 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:214 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release.yml:217 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:217 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release.yml:226 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:226 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:240 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:323 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:331 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:363 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:366 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release.yml:45 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:45 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release.yml:55 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/dockerfile.security.missing-user |
.oss-scanner/Dockerfile:59 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
Dockerfile:74 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
Dockerfile:75 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
docs/content/docs/en/reference/api/websocket.mdx:4 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
docs/content/docs/fa/reference/api/websocket.mdx:5 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
docs/content/docs/ru/reference/api/websocket.mdx:5 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
docs/content/docs/zh/reference/api/websocket.mdx:5 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | osv/GHSA-587h-7wmj-h5pm |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q | Dependencies (osv-scanner) |
| high | osv/GHSA-mrv2-3pqr-j5jr |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr | Dependencies (osv-scanner) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
docs/public/openapi.json:5072 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
frontend/public/openapi.json:5072 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/discord-client-id |
frontend/src/components/ui/notifications/DiscordNotifications.stories.tsx:63 | Possible discord-client-id secret in the current tree | Secrets (gitleaks) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
frontend/src/pages/api-docs/endpoints.ts:2885 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/private-key |
frontend/src/pages/xray/outbounds/transport/masque.tsx:62 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/amneziawgkern/manager.go:617 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
internal/database/dump_sqlite.go:166 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/mtproto/process.go:165 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:2057 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:2082 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:2672 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:2695 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:2905 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:2928 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/web/service/server.go:3023 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/xray/process.go:628 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/xray/process.go:640 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/xray/process.go:683 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
docs/app/[lang]/(home)/layout.tsx:10 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
docs/app/[lang]/docs/[[...slug]]/page.tsx:36 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
docs/app/[lang]/docs/[[...slug]]/page.tsx:36 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
docs/app/[lang]/docs/layout.tsx:8 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
docs/components/search-dialog.tsx:40 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
docs/components/theme-switch.tsx:92 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
docs/lib/xray/subscription.ts:269 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/CipherSuitesSelect.tsx:48 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/NativeSelect.stories.tsx:52 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/NativeSelect.tsx:33 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/SelectTag.tsx:65 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/rhf/FormField.stories.tsx:105 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/rhf/FormField.stories.tsx:143 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/rhf/FormField.stories.tsx:176 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/form/rhf/FormField.stories.tsx:68 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
frontend/src/components/geodata/GeoBrowserModal.stories.tsx:750 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
frontend/src/components/geodata/GeoBrowserModal.stories.tsx:751 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
frontend/src/components/geodata/GeoBrowserModal.stories.tsx:752 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/geodata/GeoBrowserModal.stories.tsx:765 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/geodata/GeoBrowserModal.stories.tsx:818 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/geodata/GeoTokenInput.stories.tsx:227 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/geodata/GeoTokenInput.stories.tsx:269 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/sponsor/SponsorCard.stories.tsx:102 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/sponsor/SponsorCard.stories.tsx:114 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/sponsor/SponsorCard.stories.tsx:131 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/sponsor/SponsorCard.stories.tsx:84 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/sponsor/SponsorCard.stories.tsx:93 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
frontend/src/hooks/useXraySetting.ts:324 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/clients/BulkAddToGroupModal.tsx:69 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/clients/ClientBulkAddModal.tsx:256 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/clients/ClientBulkAdjustModal.tsx:111 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/clients/ClientFormModal.tsx:939 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/clients/ClientQrModal.tsx:226 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/hosts/HostFormModal.tsx:250 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/hosts/json-forms/OutboundSubtreeJsonForm.tsx:60 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/inbounds/form/InboundFormModal.tsx:1236 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/login/LoginPage.tsx:196 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/nodes/NodeFormModal.tsx:257 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/settings/SubBalancerFormModal.tsx:137 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/sub/SubPage.tsx:150 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/balancers/BalancerFormModal.tsx:215 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/dns/DnsServerModal.tsx:173 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/outbounds/OutboundFormModal.tsx:386 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/overrides/NordModal.tsx:368 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/overrides/PiaModal.tsx:322 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
frontend/src/pages/xray/overrides/PiaModal.tsx:96 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/overrides/WarpModal.tsx:374 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/xray/routing/RuleFormModal.tsx:187 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/tools/oxlint/__fixtures__/antd-a11y-ok.tsx:12 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/tools/oxlint/__fixtures__/icon-marked.tsx:9 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/tools/oxlint/__fixtures__/labelled-control.tsx:9 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
frontend/vite.config.js:87 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/amneziawgkern/manager.go:511 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/database/db.go:3472 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/database/dbtest/dbtest.go:33 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/database/migrate_data.go:165 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/database/migrate_data.go:80 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/logger/logger.go:91 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/mtproto/manager.go:624 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.best-practice.hidden-goroutine |
internal/util/common/err.go:38 | Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'. | Lint |
| medium | opengrep/go.lang.maintainability.useless-if-body |
internal/web/controller/xray_setting.go:93 | Detected identical statements in the if body and the else body of an if-statement. This will lead to the same code being executed no matter what the if-expression evaluates to. Instead, remove the if statement. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/job/check_client_ip_job.go:632 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/job/clear_logs_job.go:36 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/job/clear_logs_job.go:40 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/job/clear_logs_job.go:64 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/job/clear_logs_job.go:70 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/job/tuic_journal.go:41 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/web/service/server.go:1167 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.exported_loop_pointer |
internal/web/service/tgbot/tgbot_inbound.go:143 | `traffic` is a loop pointer that may be exported from the loop. This pointer is shared between loop iterations, so the exported reference will always point to the last loop value, which is likely unintentional. To fix, copy the pointer... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/xray/process.go:669 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/xray/process.go:880 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/xray/process.go:894 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
tools/openapigen/main.go:153 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:12 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:16 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:8 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml |
docs/components/mdx/mermaid.tsx:41 | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
docs/lib/xray/telegram.ts:90 | Detected the use of a regular expression `^(\d+(\.\d+)?(ns|us|µs|ms|s|m|h))+$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... | Static analysis (opengrep) |
| medium | osv/GHSA-6688-9rhm-gjv2 |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-6688-9rhm-gjv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-c6gr-qvv4-5v3f |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-c6gr-qvv4-5v3f | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gcqx-w48m-w2h4 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
frontend/src/components/geodata/GeoBrowserModal.stories.tsx:25 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
frontend/src/components/geodata/GeoTokenInput.stories.tsx:26 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
frontend/src/i18n/AntdRootConfig.tsx:27 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
frontend/src/i18n/react.ts:47 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/lib/xray/amneziawg-obfuscation.ts:121 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
frontend/src/lib/xray/ech-presets.ts:106 | Detected the use of a regular expression `^([a-z0-9-]+\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
frontend/src/lib/xray/ech-presets.ts:117 | Detected the use of a regular expression `^([a-z0-9-]+\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
frontend/src/lib/xray/forms/transport/FinalMaskForm.tsx:798 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
frontend/src/lib/xray/inbound-link.ts:1331 | Detected the use of a regular expression `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is... | Static analysis (opengrep) |
| medium | gitleaks/curl-auth-header |
frontend/src/pages/api-docs/ApiDocsPage.tsx:44 | Possible curl-auth-header secret in history (commit edf0f36940); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/curl-auth-header |
frontend/src/pages/api-docs/ApiDocsPage.vue:29 | Possible curl-auth-header secret in history (commit e642f7324e); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
frontend/src/pages/inbounds/form/InboundFormModal.tsx:152 | Detected the use of a regular expression `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
frontend/tools/check-inbound-keyboard.mjs:51 | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/vite.config.js:74 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/vite.config.js:75 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
internal/amneziawgnet/dns.go:6 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
internal/amneziawgnet/egress.go:10 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
internal/database/db.go:304 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
internal/database/dump_sqlite.go:166 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/mtproto/process_windows.go:36 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/mtproto/process_windows.go:37 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/sub/sub.go:435 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/tuic/server.go:83 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/util/ldap/ldap.go:27 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/util/sys/sys_windows.go:64 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/util/sys/sys_windows.go:65 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/util/sys/sys_windows.go:66 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
internal/web/controller/index.go:5 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
internal/web/global/hashStorage.go:38 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/runtime/tls_client.go:327 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/service/email/email.go:212 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/service/email/email.go:318 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/service/email/email.go:86 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
internal/web/service/inbound_migration.go:21 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
internal/web/service/node.go:417 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
internal/web/service/node.go:669 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/service/node.go:91 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/service/outbound/probe_http.go:601 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
internal/web/service/outbound/probe_http.go:676 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/service/outbound_subscription.go:336 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.potential-dos-via-decompression-bomb |
internal/web/service/server.go:1182 | Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
internal/web/service/setting.go:1724 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
internal/web/service/setting.go:307 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
internal/web/session/session.go:184 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/web/web.go:613 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/xray/process_windows.go:36 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
internal/xray/process_windows.go:37 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.use-tls |
main.go:103 | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium] | Static analysis (opengrep) |
| medium | gitleaks/dropbox-api-token |
web/assets/ant-design-vue/antd.min.js.map:1 | Possible dropbox-api-token secret in history (commit 2eb9d2e2e8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/dropbox-api-token |
web/assets/[email protected]/antd.min.js.map:1 | Possible dropbox-api-token secret in history (commit d37dbb7dc8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | opengrep/bash.curl.security.curl-pipe-bash |
x-ui.sh:132 | Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or... | Static analysis (opengrep) |
| medium | opengrep/bash.curl.security.curl-pipe-bash |
x-ui.sh:151 | Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or... | Static analysis (opengrep) |
| medium | opengrep/bash.curl.security.curl-pipe-bash |
x-ui.sh:169 | Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or... | Static analysis (opengrep) |
| medium | opengrep/bash.curl.security.curl-pipe-bash |
x-ui.sh:2159 | Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
docs/lib/xray/firewall.ts:54 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
docs/lib/xray/links.ts:160 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
docs/lib/xray/links.ts:160 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
docs/lib/xray/links.ts:160 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
docs/lib/xray/reverse-proxy.ts:55 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/lib/xray/inbound-defaults.ts:246 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/lib/xray/inbound-defaults.ts:246 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientBulkAddModal.tsx:231 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientBulkAddModal.tsx:231 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientBulkAdjustModal.tsx:82 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientBulkAdjustModal.tsx:82 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientsPage.tsx:902 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientsPage.tsx:902 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientsPage.tsx:966 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientsPage.tsx:966 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientsPage.tsx:995 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/clients/ClientsPage.tsx:995 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/groups/GroupsPage.tsx:324 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/groups/GroupsPage.tsx:324 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/settings/SettingsPage.tsx:133 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/settings/SettingsPage.tsx:133 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1087 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1121 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1167 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1367 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1428 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1452 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1461 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1472 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1487 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1786 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1796 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1796 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1802 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1802 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1827 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1827 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1833 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1833 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1903 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1907 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1909 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1914 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1929 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1932 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1936 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:1940 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:2091 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:2092 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:2130 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:524 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:524 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:529 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:535 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:548 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:549 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:556 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:655 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:668 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:669 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:670 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:679 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:688 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:689 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:690 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:700 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:701 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:705 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:724 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:725 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:789 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
install.sh:824 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:824 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:827 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:869 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:885 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:895 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:897 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:898 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:901 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:903 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:904 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:91 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:921 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:174 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:175 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:178 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:226 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:478 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:511 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:519 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:524 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:538 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:553 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:553 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:558 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:558 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:566 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:590 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:610 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:618 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:621 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:632 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:633 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:634 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:635 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:636 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:637 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:638 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:640 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:640 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:642 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:642 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:644 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:645 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:646 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:647 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:649 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:654 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:656 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:659 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:670 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:673 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:678 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
update.sh:682 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
update.sh:693 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/artipacked |
.github/workflows/ci.yml:180 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:211 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:230 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:246 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:264 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:280 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:295 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:316 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:338 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:36 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:68 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/codeql.yml:39 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/docker.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/docs-ci.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/docs-deploy.yml:35 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/mutation.yml:39 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:213 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:362 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:41 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
docs/content/docs/en/config/amneziawg.mdx:197 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | osv/GHSA-9jrq-w75r-8gcw |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | osv/GHSA-p98j-92pf-mc4p |
docs/pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-p98j-92pf-mc4p | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
docs/public/openapi.json:7147 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/public/openapi.json:7147 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/api/websocket.ts:171 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
frontend/src/components/form/JsonEditor.stories.tsx:14 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/generated/examples.ts:448 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/pages/api-docs/endpoints.js:704 | Possible generic-api-key secret in history (commit b97ff40ad6); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/pages/api-docs/endpoints.ts:621 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/pages/inbounds/form/InboundFormModal.tsx:436 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/pages/sub/SubPage.tsx:225 | Possible generic-api-key secret in history (commit 92fb94d856); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/pages/sub/SubPage.vue:294 | Possible generic-api-key secret in history (commit bc00d37ad8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/__snapshots__/finalmask.test.ts.snap:120 | Possible generic-api-key secret in history (commit 3f787ae169); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/__snapshots__/inbound-defaults.test.ts.snap:56 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/__snapshots__/inbound-full.test.ts.snap:195 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/__snapshots__/inbound-link.test.ts.snap:23 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/__snapshots__/protocols.test.ts.snap:74 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/__snapshots__/security.test.ts.snap:16 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/amneziawg-outbound-adapter.test.ts:10 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/finalmask/udp-mask.json:4 | Possible generic-api-key secret in history (commit 3f787ae169); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound-full/shadowsocks-tcp-2022.json:23 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound-full/vless-tcp-reality.json:52 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound-full/wireguard-server.json:23 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound/mtproto-basic.json:8 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound/mtproto-domain-fronting.json:8 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound/shadowsocks-2022.json:5 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/inbound/wireguard-basic.json:5 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/golden/fixtures/security/reality-basic.json:8 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/inbound-defaults.test.ts:85 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/inbound-form-adapter.test.ts:135 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/inbound-from-db.test.ts:124 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/inbound-link.test.ts:714 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/mtproto-clients-link.test.ts:19 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/outbound-defaults.test.ts:43 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/outbound-form-adapter.test.ts:350 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/tunnel-host-endpoints.test.ts:36 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/vless-encryption.test.ts:5 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/private-key |
frontend/src/test/warp-masque-modal.test.tsx:9 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/wireguard-client-config.test.ts:8 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
frontend/src/test/wireguard-clients-link.test.ts:17 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/utils/zodValidate.ts:19 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
internal/amneziawg/params_test.go:276 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/amneziawgnet/client_device_test.go:79 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/amneziawgnet/device_test.go:590 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/database/model/model_wireguard_peers_test.go:19 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/database/model/model_wireguard_test.go:14 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/database/wireguard_domain_strategy_migration_test.go:13 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/database/wireguard_migration_test.go:24 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/mtproto/manager_test.go:11 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/sub/clash_service_test.go:1300 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/sub/controller_test.go:283 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/sub/service_amneziawg_test.go:98 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/sub/service_mtproto_test.go:12 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/sub/settings_cache_test.go:97 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/client_bulk_fanout_test.go:210 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/client_bulk_flow_test.go:278 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/client_sync_mtproto_test.go:26 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/inbound_amneziawg_test.go:166 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/inbound_client_stats_benchmark_test.go:68 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/inbound_import_external_proxy_test.go:109 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/inbound_node_protocol_update_test.go:18 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/inbound_node_sidecar_test.go:33 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/inbound_options_node_address_test.go:29 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/mtproto_fake_test.go:23 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/node_foreign_client_test.go:301 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/outbound_subscription_test.go:667 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/web/service/xray_config_clients_test.go:342 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/xray/api_shadowsocks_test.go:156 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/xray/hot_diff_test.go:572 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
internal/xray/outbound_validation_test.go:56 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
web/html/subscription.html:234 | Possible generic-api-key secret in history (commit 10025ffa66); removed from the current tree but still retrievable | Secrets (gitleaks) |
| info | zizmor/superfluous-actions |
.github/workflows/release.yml:190 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release.yml:331 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 104 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 12 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 77 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 74 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 5297fd3c8495 | prov-5+qual-2+sec-2 | 12% | 76 | 45 |
Full text report
- Repository: https://github.com/MHSanaei/3x-ui
- Commit:
5297fd3c8495d80fab97ae511553fa545c69e913 - Generated: 2026-11-14T16:27:11+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 12 | explicit | 95% | 100% |
| Code quality | 76 | adequate | 90% | 100% |
| Security | 45 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 12% of first-party code added; an estimated 12% including velocity signals.
- Explicitly attributed share (lower bound): 12.4%
- Unattributed share in AI-consistent velocity bursts: 14.2%
- Estimated AI-generated share: 12.4%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 74 | 71,000 |
| OpenAI Codex | 23 | 12,253 |
| GitHub Copilot coding agent | 8 | 761 |
| Cursor agent | 1 | 598 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 23,340 of 201,803.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.3 | 1.081 | 0.28x |
| Security | 0.514 | 0.353 | 1.46x |
- Stylometry index: 0.15 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 52). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 1,472 | 0% |
| 2026-01 | 2,634 | 0% |
| 2026-02 | 1,375 | 2% |
| 2026-03 | 105 | 0% |
| 2026-04 | 6,614 | 7% |
| 2026-05 | 122,219 | 30% |
| 2026-06 | 85,862 | 3% |
| 2026-07 | 52,160 | 12% |
| 2026-08 | 61,492 | 28% |
| 2026-09 | 69,391 | 15% |
| 2026-10 | 66,311 | 12% |
| 2026-11 | 15,087 | 19% |
Evidence
- Claude Code: PR branch 'claude/dns-draggable-ordering-da6918' (51f7ba47f78d)
- OpenAI Codex: PR branch 'codex/issue-7023-inbound-a11y' (f4030c889c2e)
- OpenAI Codex: PR branch 'codex/fix-telegram-command-screens' (e093854f5b49)
- OpenAI Codex: PR branch 'codex/fix-node-client-lifecycle' (81059edc91f4)
- Claude Code: PR branch 'claude/unruffled-sinoussi-682e7e' (6d9e836d6156)
- OpenAI Codex: PR branch 'codex/fix-telegram-menu-media' (4d583cebf3b4)
- OpenAI Codex: PR branch 'codex/issue-6993-keep-host-settings' (d2450e103c2b)
- OpenAI Codex: PR branch 'codex/fix-hysteria2-external-clash' (34a762f7c8d1)
- Claude Code: PR branch 'claude/3x-ui-xray-balancer-i18n-cb0660' (05199dda0003)
- OpenAI Codex: PR branch 'codex/awg-kernel-upstream' (56ac8d0fc7c5)
- OpenAI Codex: PR branch 'codex/awg-keepalive-range' (35e09191de51)
- Claude Code: PR description attribution (a403faee239e)
- Claude Code: PR description attribution (ad470681efcc)
- Claude Code: trailer 'Co-Authored-By: Claude' (1edb8b31bc14)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (c321933a5483)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.79, CI runs tests; 30% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 41 |
| Duplication | 63 |
| Code smells (Opengrep) | 85 |
| Tests and CI | 100 |
| Documentation | 80 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 9,666; mean complexity 3.9, 90th percentile 8; 304 complex and 133 long functions
- Duplicated lines: 7.7% of 147,528 compared
- Tests: 158,766 test lines for 201,803 source lines (ratio 0.79); CI test commands: npm test, pnpm test, go test; 93% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- setRemoteTrafficLocked in internal/web/service/inbound_node.go: complexity 244, 849 lines
- answerCallback in internal/web/service/tgbot/tgbot_router.go: complexity 184, 815 lines
- InboundInfoModal in frontend/src/pages/inbounds/info/InboundInfoModal.tsx: complexity 137, 701 lines
- MergeClientRecord in internal/database/model/model.go: complexity 133, 223 lines
- BulkAdjust in internal/web/service/client_bulk.go: complexity 101, 282 lines
Security
Security posture is poor: 2 possible secret(s) in the tree, 4 only in history; 12 known vulnerabilities in 4 dependencies; 23 high-severity SAST findings; 80 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 2 |
| Static analysis (Opengrep) | 93 |
| Vulnerable dependencies (OSV) | 57 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 12 in 4 packages (critical 1, high 3, medium 4, low 2)
-
Posture checks passed: security policy, dependency updates, signed commits, lockfiles; missing: none
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-cg2g-xh64-v4q7: [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 |
docs/pnpm-lock.yaml |
| high | gitleaks/discord-client-id: Possible discord-client-id secret in the current tree |
frontend/src/components/ui/notifications/DiscordNotifications.stories.tsx:63 |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
frontend/src/pages/xray/outbounds/transport/masque.tsx:62 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
.oss-scanner/Dockerfile:59 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:74 |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:75 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
docs/content/docs/en/reference/api/websocket.mdx:4 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
docs/content/docs/fa/reference/api/websocket.mdx:5 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
docs/content/docs/ru/reference/api/websocket.mdx:5 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
docs/content/docs/zh/reference/api/websocket.mdx:5 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
docs/public/openapi.json:5072 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
frontend/public/openapi.json:5072 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
frontend/src/pages/api-docs/endpoints.ts:2885 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/amneziawgkern/manager.go:617 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
internal/database/dump_sqlite.go:166 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/mtproto/process.go:165 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:2057 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:2082 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:2672 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:2695 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:2905 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:2928 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/web/service/server.go:3023 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/xray/process.go:628 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/xray/process.go:640 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release dev-latest ships x-ui-linux-386.tar.gz (8 downloads)
- binary-release-asset: release dev-latest ships x-ui-linux-amd64.tar.gz (323 downloads)
- binary-release-asset: release dev-latest ships x-ui-linux-arm64.tar.gz (14 downloads)
- binary-release-asset: release dev-latest ships x-ui-linux-armv5.tar.gz (10 downloads)
- binary-release-asset: release dev-latest ships x-ui-linux-armv6.tar.gz (7 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 201,803; test lines: 158,766
| Language | Lines |
|---|---|
| Go | 238,113 |
| TypeScript | 114,030 |
| Shell | 7,302 |
| JavaScript | 1,124 |